Skip to content

fix: register MongoDB AWS authentication for Atlas IAM (driver 3.x)#1324

Merged
SebastianStehle merged 1 commit into
Squidex:masterfrom
sinadarbouy:fix/mongodb-aws-authentication-driver-3
Jun 16, 2026
Merged

fix: register MongoDB AWS authentication for Atlas IAM (driver 3.x)#1324
SebastianStehle merged 1 commit into
Squidex:masterfrom
sinadarbouy:fix/mongodb-aws-authentication-driver-3

Conversation

@sinadarbouy

Copy link
Copy Markdown
Contributor

Summary

Fixes startup failure when MongoDB is configured with Atlas IAM authentication (authMechanism=MONGODB-AWS).

Adds the MongoDB.Driver.Authentication.AWS package and registers the AWS auth provider in MongoClientFactory.Create().

Problem

Starting with MongoDB .NET Driver 3.0, MONGODB-AWS was moved out of the core driver into an optional package and must be registered explicitly. Squidex uses driver 3.x but does not register the extension, so Atlas IAM connection strings fail at startup.

Example connection string:
mongodb+srv://cluster.example.mongodb.net/?authSource=%24external&authMechanism=MONGODB-AWS

Error without this change

MongoDB.Driver.MongoConnectionException: An exception occurred while opening a connection to the server. ---> System.NotSupportedException: Unable to create an authenticator. at MongoDB.Driver.MongoCredential.ToAuthenticator(...) at MongoDB.Driver.Core.Connections.ConnectionInitializer.CreateAuthenticator(...) ... at Squidex.Hosting.InitializerHost.StartAsync(...)

The application never becomes ready.

Root cause

Driver 2.x included MONGODB-AWS in the core package. Driver 3.x requires:

  1. Package reference: MongoDB.Driver.Authentication.AWS (version aligned with MongoDB.Driver)
  2. One-time registration: MongoClientSettings.Extensions.AddAWSAuthentication()

Without (2), the driver cannot resolve the SASL mechanism from the connection string.

Changes

  • Squidex.Data.MongoDb.csproj — add MongoDB.Driver.Authentication.AWS 3.8.0
  • MongoClientFactory.cs — register AWS authentication once before creating a MongoClient

All Mongo clients in Squidex go through MongoClientFactory.Create() (via ServiceExtensions).

Test plan

  • Verified on EKS with Atlas IAM connection string and IRSA
  • Application starts; /healthz and /readiness return 200
  • No Unable to create an authenticator in logs

References

MongoDB.Driver 3.x moved MONGODB-AWS into MongoDB.Driver.Authentication.AWS
and requires explicit registration. Without it, Atlas IAM connection strings
fail at startup with "Unable to create an authenticator".

Co-authored-by: Cursor <cursoragent@cursor.com>
@sinadarbouy

Copy link
Copy Markdown
Contributor Author

Hi @SebastianStehle , could you please take a look at this PR when you have a chance? Thank you!

@SebastianStehle SebastianStehle merged commit 9dbc5ed into Squidex:master Jun 16, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants