RUST-2235 Implement GSSAPI auth support #1413

mattChiaravalloti · 2025-07-08T15:42:53Z

This PR implements the GSSAPI auth mechanism, as described by the spec. This took a bit longer than anticipated because manual end-to-end testing revealed that the initial implementation was not correct. Subsequent fixes made slow progress towards correctness. Ultimately, the implementation you see here has been manually tested on macOS (locally, against a local KDC and mongod) and an ubuntu2204-arm64-small evergreen host (against the LDAPTEST KDC/mongod). I still need to test this on Windows. I have a separate follow-up ticket to implement automated end-to-end testing, RUST-2236, which I will put up a PR for after confirming this works on Windows and actually writing end-to-end tests.

This implementation is guarded by a feature flag, and passes the existing spec tests when the feature flag is enabled.

…e flag

mattChiaravalloti · 2025-07-08T15:44:03Z

src/client/auth.rs

@@ -67,8 +69,7 @@ pub enum AuthMechanism {
    /// Kerberos authentication mechanism as defined in [RFC 4752](http://tools.ietf.org/html/rfc4752).
    ///
    /// See the [MongoDB documentation](https://www.mongodb.com/docs/manual/core/kerberos/) for more information.
-    ///
-    /// Note: This mechanism is not currently supported by this driver but will be in the future.
+    #[cfg(feature = "gssapi-auth")]


I followed the same pattern as the aws-auth feature flag.

mattChiaravalloti · 2025-07-08T15:48:12Z

src/client/auth/gssapi.rs

+    // Limit number of auth challenge steps (typically, only one step is needed, however
+    // different configurations may require more).
+    for _ in 0..10 {


This idea is taken directly from the python driver's implementation (link).

It seems there may be some circumstances where multiple challenges need to be stepped through, so we need to do this multiple times. However, based on the python implementation's comments, it seems there may be protocol and/or library issues that could result in endless looping so a limit is put in place (10 tries).

mattChiaravalloti · 2025-07-08T15:54:04Z

src/client/auth/gssapi.rs

+impl GssapiProperties {
+    pub fn from_credential(credential: &Credential) -> Result<Self> {
+        let mut properties = GssapiProperties {
+            service_name: "mongodb".to_string(),


You may notice that in options.rs, we also ensure that mongodb is the default service name. That is required in options.rs for spec compliance (as in, the spec tests cannot pass without doing that). At this point, although we know mechanism_properites.get(SERVICE_NAME) must always return Some(...), it felt cleanest to me to implement this code the way you see here (including "mongodb" as a default value).

mattChiaravalloti · 2025-07-08T15:56:53Z

src/client/auth/gssapi.rs

+        } else if let Some(user_principal) = user_principal.as_ref() {
+            if let Some(idx) = user_principal.find('@') {
+                // If no SERVICE_REALM was specified, use realm specified in the
+                // username. Note that `realm` starts with '@'.
+                let (_, realm) = user_principal.split_at(idx);
+                service_principal = format!("{}{}", service_principal, realm);
+            }
+        }


This is not mentioned in the spec but it did end up being required since there is no other way to specify a realm for the service principal if not done manually. Perhaps other language libraries default to this behavior, but not cross-krb5/libgssapi in Rust. I spoke to James about this and he said he had to do something similar in the C# driver's GSSAPI implementation.

mattChiaravalloti · 2025-07-08T16:11:47Z

src/client/auth/gssapi.rs

+    }
+}
+
+fn canonicalize_hostname(hostname: &str, mode: &CanonicalizeHostName) -> Result<String> {


I wrote some unit tests for this but ultimately removed them since they are trivial. The more interesting testing of this will be indirect via the end-to-end GSSAPI auth tests in the next ticket.

Yea, I'm personally trying to move away from unit tests that just explicitly encode basic code.

mattChiaravalloti · 2025-07-08T16:12:36Z

@abr-egn I am not able to add other reviewers, so if you know who else could/should be tagged on this, can you add them? Thank you!

codeowners-service-app · 2025-07-09T16:05:51Z

Assigned rishitb-mongodb for team dbx-rust because abr-egn is out of office.
Assigned rishitb-mongodb for team dbx-rust because abr-egn is out of office.
Assigned rishitb-mongodb for team dbx-rust because abr-egn is out of office.
Assigned rishitb-mongodb for team dbx-rust because abr-egn is out of office.

mattChiaravalloti · 2025-07-09T18:51:50Z

Ok I believe I've addressed the majority of failures now. The two remaining issues are:

Compiling with the MSRV (1.81.0) fails because libgssapi-sys (a deeply nested indirect dependency) uses unsafe extern "C" blocks, which are disallowed in that version. I'm still trying to figure out how best to address this. Any ideas from reviewers are appreciated.
It seems the Graviton tests are failing because libgssapi-sys cannot compile without setting an ENV variable. The relevant error seems to be: Unable to find libclang: "couldn't find any valid shared libraries matching: ['libclang.so', 'libclang-*.so', 'libclang.so.*', 'libclang-*.so.*'], set the LIBCLANG_PATH environment variable to a path where one of these files can be found (invalid: [])". So we should be able to set LIBCLANG_PATH for that distro and be good to go. I know nothing about this distro though. Perhaps @abr-egn can help out with this one when he's back!

Beyond addressing those two issues, the last thing I need to do is double check the spec for how to handle password being provided on Windows. It looks like there is supposed to be some special handling that happens only on Windows if the password is provided as a uri option. I'll look into that and make any relevant changes.

pmeredit

LGTM once everything is working on every OS/tests are passing. Good design. Just fix the format!s because clippy will start complaining whenever they update.

pmeredit · 2025-07-11T16:25:05Z

Cargo.toml

@@ -58,6 +58,9 @@ gcp-oidc = ["dep:reqwest"]
 # This can only be used with the tokio-runtime feature flag.


@abr-egn

Unrelated to this PR, really (though we could fix it here), should we update this comment since async-std support was dropped?

Hah, yes, good catch.

pmeredit · 2025-07-11T16:30:16Z

src/client/auth.rs

+                }
+
+                if credential.source.as_deref().unwrap_or("$external") != "$external" {
+                    return Err(ErrorKind::InvalidArgument {


Hmm, just noticed that the "must be $external" message for OIDC is slightly different than everything else, maybe we should update it 🤔

pmeredit · 2025-07-11T16:38:57Z

src/client/auth/gssapi.rs

+        hostname: &str,
+    ) -> Result<(Self, Vec<u8>)> {
+        let service_name: &str = properties.service_name.as_ref();
+        let mut service_principal = format!("{}/{}", service_name, hostname);


Suggested change

let mut service_principal = format!("{}/{}", service_name, hostname);

let mut service_principal = format!("{service_name}/{hostname}");

Let's just fix this before clippy starts whining about it the next time they update it :)

pmeredit · 2025-07-11T16:39:32Z

src/client/auth/gssapi.rs

+        let service_name: &str = properties.service_name.as_ref();
+        let mut service_principal = format!("{}/{}", service_name, hostname);
+        if let Some(service_realm) = properties.service_realm.as_ref() {
+            service_principal = format!("{}@{}", service_principal, service_realm);


Suggested change

service_principal = format!("{}@{}", service_principal, service_realm);

service_principal = format!("{service_principal}@{service_realm}");

ditto

pmeredit · 2025-07-11T16:39:59Z

src/client/auth/gssapi.rs

+                // If no SERVICE_REALM was specified, use realm specified in the
+                // username. Note that `realm` starts with '@'.
+                let (_, realm) = user_principal.split_at(idx);
+                service_principal = format!("{}{}", service_principal, realm);


Suggested change

service_principal = format!("{}{}", service_principal, realm);

service_principal = format!("{service_principal}{realm}");

pmeredit · 2025-07-11T16:41:45Z

src/client/auth/gssapi.rs

+    }
+}
+
+fn canonicalize_hostname(hostname: &str, mode: &CanonicalizeHostName) -> Result<String> {


Yea, I'm personally trying to move away from unit tests that just explicitly encode basic code.

pmeredit · 2025-07-11T16:48:12Z

@mattChiaravalloti all the failures atm seem to be from missing libclang, it may make sense to turn off the gssapi feature flag for those tests

abr-egn

Looks very reasonable!

The MSRV issue can be solved by just bumping up MSRV to 1.82 which introduced the unsafe extern block syntax; that's well past our six month rolling window.

I agree with Patrick that it makes sense to turn off the GSSAPI feature flag for the Graviton variants; I don't think there's enough value in the marginal test coverage increase to justify the engineer time to figure out if it can be made to work.

abr-egn · 2025-07-14T08:40:09Z

Cargo.toml

@@ -58,6 +58,9 @@ gcp-oidc = ["dep:reqwest"]
 # This can only be used with the tokio-runtime feature flag.


Hah, yes, good catch.

abr-egn · 2025-07-14T08:42:13Z

Cargo.toml

 derive_more = "0.99.17"
 derive-where = "1.2.7"
+dns-lookup = { version = "2.0", optional = true }


Why not use hickory-resolver which we already have as an optional dep?

mattChiaravalloti added 10 commits July 8, 2025 11:29

RUST-2235: Initial Devin code

b1f648f

RUST-2235: Update auth spec tests to guard GSSAPI tests behind featur…

9789819

…e flag

RUST-2235: Clean up options and client/auth

e406e16

RUST-2235: Fix warnings

50aa9d9

RUST-2235: Clean up gssapi.rs and include debug code for further testing

9267940

RUST-2235: Update wrap_unwrap

43a4472

RUST-2235: Update final wrap step to use proper starting bytes

774375a

RUST-2235: Clean up gssapi auth code

9e6e38d

RUST-2235: Clean up canonicalize_hostname

7e040aa

RUST-2235: Fix api calls after rebase

3134bb6

mattChiaravalloti requested a review from a team as a code owner July 8, 2025 15:42

mattChiaravalloti requested a review from abr-egn July 8, 2025 15:42

mattChiaravalloti added 2 commits July 8, 2025 11:55

RUST-2235: Update constants

f323fe1

RUST-2235: Combine new and init

e175e2e

mattChiaravalloti commented Jul 8, 2025

View reviewed changes

mattChiaravalloti requested a review from pmeredit July 8, 2025 18:17

mattChiaravalloti added 4 commits July 9, 2025 11:48

SQL-2235: Properly alphabetize Cargo.toml

de0c4b7

SQL-2235: Update compile-only task to include gssapi feature flag

3fec2d9

RUST-2235: Update Cargo.lock

8ef6097

RUST-2235: Properly update Cargo.lock

13a6878

codeowners-service-app bot requested a review from rishitb-mongodb July 9, 2025 16:05

mattChiaravalloti removed the request for review from rishitb-mongodb July 9, 2025 17:02

codeowners-service-app bot requested a review from rishitb-mongodb July 9, 2025 17:03

mattChiaravalloti added 3 commits July 9, 2025 13:57

RUST-2235: Update tests to run with gssapi-auth feature enabled

fafc56f

RUST-2235: Fix rustfmt failures

934f0f4

RUST-2235: Address clippy failures

5f5722c

mattChiaravalloti removed the request for review from rishitb-mongodb July 10, 2025 20:09

codeowners-service-app bot requested a review from rishitb-mongodb July 10, 2025 20:10

rishitb-mongodb removed their request for review July 10, 2025 20:42

codeowners-service-app bot requested a review from rishitb-mongodb July 10, 2025 20:42

pmeredit approved these changes Jul 11, 2025

View reviewed changes

abr-egn removed the request for review from rishitb-mongodb July 14, 2025 08:38

abr-egn reviewed Jul 14, 2025

View reviewed changes

		@@ -58,6 +58,9 @@ gcp-oidc = ["dep:reqwest"]
		# This can only be used with the tokio-runtime feature flag.

	let mut service_principal = format!("{}/{}", service_name, hostname);
	let mut service_principal = format!("{service_name}/{hostname}");

	service_principal = format!("{}@{}", service_principal, service_realm);
	service_principal = format!("{service_principal}@{service_realm}");

	service_principal = format!("{}{}", service_principal, realm);
	service_principal = format!("{service_principal}{realm}");

RUST-2235 Implement GSSAPI auth support #1413

Are you sure you want to change the base?

RUST-2235 Implement GSSAPI auth support #1413

Uh oh!

Conversation

mattChiaravalloti commented Jul 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattChiaravalloti commented Jul 8, 2025

Uh oh!

codeowners-service-app bot commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattChiaravalloti commented Jul 9, 2025

Uh oh!

pmeredit left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmeredit commented Jul 11, 2025

Uh oh!

abr-egn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codeowners-service-app bot commented Jul 9, 2025 •

edited

Loading