const (
// SCRAMSHA1 holds the mechanism name "SCRAM-SHA-1"
SCRAMSHA1 = "SCRAM-SHA-1"
// SCRAMSHA256 holds the mechanism name "SCRAM-SHA-256"
SCRAMSHA256 = "SCRAM-SHA-256"
)
GSSAPI is the mechanism name for GSSAPI.
const GSSAPI = "GSSAPI"
MONGODBCR is the mechanism name for MONGODB-CR.
The MONGODB-CR authentication mechanism is deprecated in MongoDB 3.6 and removed in MongoDB 4.0.
const MONGODBCR = "MONGODB-CR"
MongoDBAWS is the mechanism name for MongoDBAWS.
const MongoDBAWS = "MONGODB-AWS"
MongoDBX509 is the mechanism name for MongoDBX509.
const MongoDBX509 = "MONGODB-X509"
PLAIN is the mechanism name for PLAIN.
const PLAIN = "PLAIN"
func ConductSaslConversation(ctx context.Context, cfg *Config, authSource string, client SaslClient) error
ConductSaslConversation runs a full SASL conversation to authenticate the given connection.
func Handshaker(h driver.Handshaker, options *HandshakeOptions) driver.Handshaker
Handshaker creates a connection handshaker for the given authenticator.
func RegisterAuthenticatorFactory(name string, factory AuthenticatorFactory)
RegisterAuthenticatorFactory registers the authenticator factory.
Authenticator handles authenticating a connection.
type Authenticator interface {
// Auth authenticates the connection.
Auth(context.Context, *Config) error
}
func CreateAuthenticator(name string, cred *Cred) (Authenticator, error)
CreateAuthenticator creates an authenticator.
AuthenticatorFactory constructs an authenticator.
type AuthenticatorFactory func(cred *Cred) (Authenticator, error)
Config holds the information necessary to perform an authentication attempt.
type Config struct {
Description description.Server
Connection driver.Connection
ClusterClock *session.ClusterClock
HandshakeInfo driver.HandshakeInformation
ServerAPI *driver.ServerAPIOptions
HTTPClient *http.Client
}
Cred is a user's credential.
type Cred struct {
Source string
Username string
Password string
PasswordSet bool
Props map[string]string
}
DefaultAuthenticator uses SCRAM-SHA-1 or MONGODB-CR depending on the server version.
type DefaultAuthenticator struct {
Cred *Cred
// contains filtered or unexported fields
}
func (a *DefaultAuthenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the connection.
func (a *DefaultAuthenticator) CreateSpeculativeConversation() (SpeculativeConversation, error)
CreateSpeculativeConversation creates a speculative conversation for SCRAM authentication.
Error is an error that occurred during authentication.
type Error struct {
// contains filtered or unexported fields
}
func (e *Error) Error() string
func (e *Error) Inner() error
Inner returns the wrapped error.
func (e *Error) Message() string
Message returns the message.
func (e *Error) Unwrap() error
Unwrap returns the underlying error.
ExtraOptionsSaslClient is a SaslClient that appends options to the saslStart command.
type ExtraOptionsSaslClient interface {
StartCommandOptions() bsoncore.Document
}
HandshakeOptions packages options that can be passed to the Handshaker() function. DBUser is optional but must be of the form <dbname.username>; if non-empty, then the connection will do SASL mechanism negotiation.
type HandshakeOptions struct {
AppName string
Authenticator Authenticator
Compressors []string
DBUser string
PerformAuthentication func(description.Server) bool
ClusterClock *session.ClusterClock
ServerAPI *driver.ServerAPIOptions
LoadBalanced bool
HTTPClient *http.Client
}
MongoDBAWSAuthenticator uses AWS-IAM credentials over SASL to authenticate a connection.
type MongoDBAWSAuthenticator struct {
// contains filtered or unexported fields
}
func (a *MongoDBAWSAuthenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the connection.
MongoDBCRAuthenticator uses the MONGODB-CR algorithm to authenticate a connection.
The MONGODB-CR authentication mechanism is deprecated in MongoDB 3.6 and removed in MongoDB 4.0.
type MongoDBCRAuthenticator struct {
DB string
Username string
Password string
}
func (a *MongoDBCRAuthenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the connection.
The MONGODB-CR authentication mechanism is deprecated in MongoDB 3.6 and removed in MongoDB 4.0.
MongoDBX509Authenticator uses X.509 certificates over TLS to authenticate a connection.
type MongoDBX509Authenticator struct {
User string
}
func (a *MongoDBX509Authenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the provided connection by conducting an X509 authentication conversation.
func (a *MongoDBX509Authenticator) CreateSpeculativeConversation() (SpeculativeConversation, error)
CreateSpeculativeConversation creates a speculative conversation for X509 authentication.
PlainAuthenticator uses the PLAIN algorithm over SASL to authenticate a connection.
type PlainAuthenticator struct {
Username string
Password string
}
func (a *PlainAuthenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the connection.
SaslClient is the client piece of a sasl conversation.
type SaslClient interface {
Start() (string, []byte, error)
Next(challenge []byte) ([]byte, error)
Completed() bool
}
SaslClientCloser is a SaslClient that has resources to clean up.
type SaslClientCloser interface {
SaslClient
Close()
}
ScramAuthenticator uses the SCRAM algorithm over SASL to authenticate a connection.
type ScramAuthenticator struct {
// contains filtered or unexported fields
}
func (a *ScramAuthenticator) Auth(ctx context.Context, cfg *Config) error
Auth authenticates the provided connection by conducting a full SASL conversation.
func (a *ScramAuthenticator) CreateSpeculativeConversation() (SpeculativeConversation, error)
CreateSpeculativeConversation creates a speculative conversation for SCRAM authentication.
SpeculativeAuthenticator represents an authenticator that supports speculative authentication.
type SpeculativeAuthenticator interface {
CreateSpeculativeConversation() (SpeculativeConversation, error)
}
SpeculativeConversation represents an authentication conversation that can be merged with the initial connection handshake.
FirstMessage method returns the first message to be sent to the server. This message will be included in the initial hello command.
Finish takes the server response to the initial message and conducts the remainder of the conversation to authenticate the provided connection.
type SpeculativeConversation interface {
FirstMessage() (bsoncore.Document, error)
Finish(ctx context.Context, cfg *Config, firstResponse bsoncore.Document) error
}