GODRIVER-3246: Support human flow for OIDC

[pmeredit]

GODRIVER-3246

Summary

Implements OIDC Human Flow

Background & Motivation

Needed for OIDC epic

[mongodb-drivers-pr-bot]

API Change Report

./x/mongo/driver/auth

incompatible changes

SaslClient.Next: changed from func([]byte) ([]byte, error) to func(context.Context, []byte) ([]byte, error)

[pmeredit]

API Change Report

./x/mongo/driver/auth

incompatible changes

SaslClient.Next: changed from func([]byte) ([]byte, error) to func(context.Context, []byte) ([]byte, error)

I originally just stuck the context in the two step struct, but I know everyone says that's "bad form". I never agreed with that, but I definitely don't want to argue over idiomatic go 😂

[blink1073]

This build failure looks relevant:

[2024/07/25 12:17:06.147] # go.mongodb.org/mongo-driver/x/mongo/driver/auth [go.mongodb.org/mongo-driver/mongo/readpref.test]
[2024/07/25 12:17:06.147] x/mongo/driver/auth/gssapi.go:60:56: cannot use client (variable of type *gssapi.SaslClient) as SaslClient value in argument to ConductSaslConversation: *gssapi.SaslClient does not implement SaslClient (wrong type for method Next)
[2024/07/25 12:17:06.147] 		have Next([]byte) ([]byte, error)
[2024/07/25 12:17:06.147] 		want Next(context.Context, []byte) ([]byte, error)

[matthewdale]

The build for "gssapi" fails because Next needs to be updated in sspi.go and gss.go. Those files use build constraints, so are easy to miss because the compiler ignores them unless specific build tags are used.

Here's the build failure:

x/mongo/driver/auth/gssapi.go:60:56: cannot use client (variable of type *gssapi.SaslClient) as SaslClient value in argument to ConductSaslConversation: *gssapi.SaslClient does not implement SaslClient (wrong type for method Next)
	have Next([]byte) ([]byte, error)
	want Next(context.Context, []byte) ([]byte, error)

[matthewdale]

err is never checked here.

[matthewdale]

Optional: Consider initializing allowedHosts in newOIDCAuthenticator, which would allow compiling the ALLOWED_HOSTS patterns as a slice of *regexp.Regexp there. That would also allow pre-compiling the default allowed hosts patterns, avoiding the CodeQL warnings and catching any regex compilation errors at initialization time.

For example:

func newOIDCAuthenticator(...) (Authenticator, error) {
	// ...
	var allowedHosts []*regexp.Regexp
	if v, ok := cred.Props[allowedHostsProp]; ok {
		patterns := strings.Split(v, ",")
		for _, pattern := range patterns {
			r, err := regexp.Compile(pattern)
			if err != nil {
				return nil, err
			}
			allowedHosts = append(allowedHosts, r)
		}
	} else {
		allowedHosts = defaultAllowedHosts
	}
	oa := &OIDCAuthenticator{
		userName:                cred.Username,
		httpClient:              httpClient,
		AuthMechanismProperties: cred.Props,
		OIDCMachineCallback:     cred.OIDCMachineCallback,
		OIDCHumanCallback:       cred.OIDCHumanCallback,
		allowedHosts:            allowedHosts,
	}
	return oa, nil
}

Then defaultAllowedHosts becomes:

var defaultAllowedHosts = []*regexp.Regexp{
	regexp.MustCompile("^.*[.]mongodb[.]net(:\\d+)?$"),
	regexp.MustCompile("^.*[.]mongodb-qa[.]net(:\\d+)?$"),
	regexp.MustCompile("^.*[.]mongodb-dev[.]net(:\\d+)?$"),
	regexp.MustCompile("^.*[.]mongodbgov[.]net(:\\d+)?$"),
	regexp.MustCompile("^localhost(:\\d+)?$"),
	regexp.MustCompile("^127[.]0[.]0[.]1(:\\d+)?$"),
	regexp.MustCompile("^::1(:\\d+)?$"),
}

[pmeredit]

Ok, I've adapted most of this, but kept the logic abstracted to a separate method.

[matthewdale]

Looks good! 👍