Skip to content

Commit

Permalink
chore(e2e-tests): add workload OIDC test MONGOSH-1832
Browse files Browse the repository at this point in the history
Now that the driver has support for the Kubernetes OIDC workload
integration, it's quite easy to add a test for OIDC workload
usage with mongosh.
  • Loading branch information
addaleax committed Nov 27, 2024
1 parent a0c8ca5 commit b84ecf3
Show file tree
Hide file tree
Showing 3 changed files with 42 additions and 0 deletions.
1 change: 1 addition & 0 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/e2e-tests/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
"dependencies": {
"@mongosh/cli-repl": "0.0.0-dev.0",
"@mongosh/service-provider-core": "0.0.0-dev.0",
"@mongodb-js/oidc-plugin": "^1.1.5",
"strip-ansi": "^6.0.0"
},
"devDependencies": {
Expand Down
40 changes: 40 additions & 0 deletions packages/e2e-tests/test/e2e-oidc.spec.ts
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import {
commonOidcServerArgs,
skipOIDCTestsDueToPlatformOrServerVersion,
} from './oidc-helpers';
import { createMongoDBOIDCPlugin } from '@mongodb-js/oidc-plugin';

/**
* @securityTest OIDC Authentication End-to-End Tests
Expand Down Expand Up @@ -528,4 +529,43 @@ describe('OIDC auth e2e', function () {
shell.assertContainsOutput('"lastServerIdPInfo":');
shell.assertContainsOutput(/"refreshToken": "(?!debugid:)/);
});

it('can successfully authenticate using workload OIDC', async function () {
// Get a token from the OIDC server, store it to disk, then pass that to mongosh
const tokenFile = path.join(tmpdir.path, 'token');
let accessToken!: string;
const plugin = createMongoDBOIDCPlugin({
notifyDeviceFlow: () => {},
allowedFlows: ['device-auth'],
});
try {
({ accessToken } =
await plugin.mongoClientOptions.authMechanismProperties.OIDC_HUMAN_CALLBACK(
{
version: 1,
idpInfo: { issuer: oidcMockProvider.issuer, clientId: 'workload' },
}
));
} finally {
await plugin.destroy();
}
await fs.writeFile(tokenFile, accessToken);

shell = this.startTestShell({
args: [
await testServer.connectionString({
authMechanism: 'MONGODB-OIDC',
authMechanismProperties: 'ENVIRONMENT:k8s',
}),
],
env: {
...process.env,
AWS_WEB_IDENTITY_TOKEN_FILE: tokenFile,
},
});
await shell.waitForPrompt();

await verifyUser(shell, 'testuser', 'workload-group');
shell.assertNoErrors();
});
});

0 comments on commit b84ecf3

Please sign in to comment.