PYTHON-3313 Cache AWS Credentials Where Possible

[blink1073]

No description provided.

[ShaneHarvey]

Can we remove the get_pool/reset logic?

[ShaneHarvey]

Is this test supposed to fail without caching? If so it would be good to make that explicit by asserting that this fails initially:

        # Auth fails without env variables.
        with mock.patch.dict(os.environ, {}, clear=True):
            with MongoClient(self.uri) as client:
                with self.assertRaises(OperationFailure):
                    client.get_database().test.find_one()

        # Auth succeeds and caches credential.
        with MongoClient(self.uri) as client:
            client.get_database().test.find_one()
        # Auth succeeds with cached credential.
        with mock.patch.dict(os.environ, {}, clear=True):
            with MongoClient(self.uri) as client:
                client.get_database().test.find_one()

[blink1073]

This may not be possible to test. We don't cache when the creds environment variables are given directly, which is why those tests are failing. We have no way of knowing if cached creds were used on EC2 without using requests-mock which seems like too much of invasion into implementation details.

[ShaneHarvey]

We at least need to test what we can. For example, the cache reset on auth failure logic. We can use failCommand to trigger a server side auth failure.

Would it be possible to use the connectionStatus command to determine which credential was authed?

>>> client.admin.command('connectionStatus')
{'authInfo': {'authenticatedUsers': [...]

https://www.mongodb.com/docs/manual/reference/command/connectionStatus/#mongodb-data-connectionStatus.authinfo.authenticatedUsers

Probably not I suppose, since I imagine different temp creds will map to the same database level user.

[ShaneHarvey]

Or a test that "poisons" the cache with invalid creds. The first auth attempt should fail and clear the cache, the next attempt should generate a new cred and succeed.

[ShaneHarvey]

This can be updated to use the new set_use_cached_credentials api now: mongodb/pymongo-auth-aws#11

[blink1073]

This can be updated to use the new set_use_cached_credentials api

Done

[blink1073]

This is ready for review. The remaining failure is tracked by https://jira.mongodb.org/browse/PYTHON-3468

[ShaneHarvey]

Code LGTM but could you add a changelog entry too?

[blink1073]

could you add a changelog entry too?

Done