Skip to content

Commit be937e7

Browse files
committed
Fix auth enforcement test to use a command that requires auth
ping is on MongoDB's auth bypass list and always succeeds even when --auth is enabled, so the unauthenticated connection check never actually tested auth enforcement. Use listDatabases instead, which requires authentication and will fail without credentials.
1 parent 4d4c58a commit be937e7

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

.evergreen/tests/test-mongodb-runner.sh

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,14 @@ pushd $SCRIPT_DIR/.. > /dev/null
1616
function connect_mongodb() {
1717
local use_tls=false
1818
local use_auth=false
19+
local eval_cmd='db.runCommand({"ping":1})'
1920

2021
# Parse flags
2122
while [[ $# -gt 0 ]]; do
2223
case "$1" in
2324
--ssl) use_tls=true; shift ;;
2425
--auth) use_auth=true; shift ;;
26+
--eval-cmd) eval_cmd="$2"; shift 2 ;;
2527
*) echo "Unknown option: $1"; return 1 ;;
2628
esac
2729
done
@@ -37,7 +39,7 @@ function connect_mongodb() {
3739
fi
3840
echo "Connecting to server..."
3941
# shellcheck disable=SC2068
40-
$MONGODB_BINARIES/mongosh "$URI" ${TLS_OPTS[@]:-} --eval "db.runCommand({\"ping\":1})"
42+
$MONGODB_BINARIES/mongosh "$URI" ${TLS_OPTS[@]:-} --eval "$eval_cmd"
4143
echo "Connecting to server... done."
4244
}
4345

@@ -57,7 +59,7 @@ connect_mongodb --ssl
5759
# Verify that auth is enforced when starting with AUTH=auth SSL=yes.
5860
# An unauthenticated connection must be rejected, and an authenticated one must succeed.
5961
AUTH=auth SSL=yes bash ./run-mongodb.sh start
60-
if connect_mongodb --ssl 2>/dev/null; then
62+
if connect_mongodb --ssl --eval-cmd 'db.adminCommand({listDatabases:1})' 2>/dev/null; then
6163
echo "ERROR: unauthenticated connection should have been rejected on an auth+ssl server"
6264
exit 1
6365
fi

0 commit comments

Comments
 (0)