Skip to content

Commit 3aaeb6d

Browse files
rustagirrustagir
committed
updates
1 parent 6822c37 commit 3aaeb6d

File tree

4 files changed

+118
-91
lines changed

4 files changed

+118
-91
lines changed

‎source/includes/security/AwsAssumeRoleCredentialProvider.java

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
public class AwsAssumeRoleCredentialProvider implements CustomCredentialProvider {
2+
3+
public AwsAssumeRoleCredentialProvider() {}
4+
@Override
5+
public MongoCredential getCustomCredential(Map<?, ?> map) {
6+
AWSCredentialsProvider provider = new DefaultAWSCredentialsProviderChain();
7+
Supplier<AwsCredential> awsFreshCredentialSupplier = () -> {
8+
AWSSecurityTokenService stsClient = AWSSecurityTokenServiceAsyncClientBuilder.standard()
9+
.withCredentials(provider)
10+
.withRegion("us-east-1")
11+
.build();
12+
AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withDurationSeconds(3600)
13+
.withRoleArn((String)map.get("mongodbaws.auth.mechanism.roleArn"))
14+
.withRoleSessionName("Test_Session");
15+
AssumeRoleResult assumeRoleResult = stsClient.assumeRole(assumeRoleRequest);
16+
Credentials creds = assumeRoleResult.getCredentials();
17+
// Add your code to fetch new credentials
18+
return new AwsCredential(creds.getAccessKeyId(), creds.getSecretAccessKey(), creds.getSessionToken());
19+
};
20+
return MongoCredential.createAwsCredential(null, null)
21+
.withMechanismProperty(MongoCredential.AWS_CREDENTIAL_PROVIDER_KEY, awsFreshCredentialSupplier);
22+
}
23+
24+
// Validates presence of an ARN
25+
@Override
26+
public void validate(Map<?, ?> map) {
27+
String roleArn = (String) map.get("mongodbaws.auth.mechanism.roleArn");
28+
if (StringUtils.isNullOrEmpty(roleArn)) {
29+
throw new RuntimeException("Invalid value set for customProperty");
30+
}
31+
}
32+
33+
// Initializes the custom provider
34+
@Override
35+
public void init(Map<?, ?> map) {
36+
37+
}
38+
}

‎source/security-and-authentication.txt

+4-3
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ Security and Authentication
1010

1111
SSL/TLS and X.509 Certificates </security-and-authentication/tls-and-x509>
1212
MongoDB AWS-based Authentication </security-and-authentication/mongodb-aws-auth>
13+
Custom Authentication Provider </security-and-authentication/custom-auth>
1314

1415
Read the following sections to learn how to secure communications between MongoDB
1516
and the {+connector+}:
1617

17-
- :doc:`Encrypt the Messages Your Connector Sends with SSL/TLS </security-and-authentication/tls-and-x509>`
18-
- :doc:`Authenticate Your Connector with MongoDB using Amazon Web Services </security-and-authentication/mongodb-aws-auth>`
19-
18+
- :ref:`Encrypt the Messages Your Connector Sends with SSL/TLS <kafka-configure-ssl>`
19+
- :ref:`Authenticate Your Connector with MongoDB using Amazon Web Services <kafka-mongodb-aws>`
20+
- :ref:`Implement a Custom Authentication Provider <kafka-custom-auth>`

‎source/security-and-authentication/custom-auth.txt

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
.. _kafka-custom-auth:
2+
3+
==============================
4+
Custom Authentication Provider
5+
==============================
6+
7+
.. facet::
8+
:name: genre
9+
:values: reference
10+
11+
.. meta::
12+
:keywords: credentials, implementation class, custom class
13+
14+
.. contents:: On this page
15+
:local:
16+
:backlinks: none
17+
:depth: 2
18+
:class: singlecol
19+
20+
Overview
21+
--------
22+
23+
You can add a custom authentication provider by implementing the
24+
``com.mongodb.kafka.connect.util.custom.credentials.CustomCredentialProvider``
25+
interface. You can use a custom authentication provider with any of the
26+
supported authentication mechanisms.
27+
28+
To enable this feature, set the following authentication
29+
properties:
30+
31+
- ``mongo.custom.auth.mechanism.enable``: set to ``true``
32+
- ``mongo.custom.auth.mechanism.providerClass``: set to the qualified
33+
class name of the implementation class
34+
- *(Optional)* ``mongodbaws.auth.mechanism.roleArn``: set to an Amazon Resource Name (ARN)
35+
36+
Example
37+
-------
38+
39+
This section provides a sample authentication provider implementation
40+
class and the corresponding configuration properties and values to
41+
implement the provider.
42+
43+
The following sample configuration file specifies the
44+
``MONGODB-AWS`` authentication method, adds a custom authentication
45+
provider, and provides an ARN:
46+
47+
.. code-block:: ini
48+
49+
connection.uri=<connection string>/?authMechanism=MONGODB-AWS
50+
mongo.custom.auth.mechanism.enable=true
51+
mongo.custom.auth.mechanism.providerClass=sample.AwsAssumeRoleCredentialProvider
52+
mongodbaws.auth.mechanism.roleArn=arn:aws:iam::<account ID>:role/<role name>
53+
54+
The ``AwsAssumeRoleCredentialProvider`` class defines ``init()`` and
55+
``validate()`` methods that are called when the connector initializes.
56+
The ``getCustomCredential()`` method returns an object of type
57+
``com.mongodb.MongoCredential`` that is used by the ``MongoClient``
58+
constructed for the connector. The following code defines the custom
59+
authentication provider:
60+
61+
.. literalinclude:: /includes/security/AwsAssumeRoleCredentialProvider.java
62+
:language: java
63+
64+
In this example, the ``sample.AwsAssumeRoleCredentialProvider``
65+
implementation class must be available on the classpath. The
66+
authentication provider class reads the ARN you specify in the
67+
``roleArn`` property.
68+
69+
To view an example of a ``pom.xml`` file that can build the complete JAR containing
70+
the implementation class, see the `Kafka Connector GitHub repository
71+
README file
72+
<https://github.com/mongodb/mongo-kafka/blob/master/README.md#pom-file-to-build-the-sample-customroleprovider-into-a-jar>`__.

‎source/security-and-authentication/mongodb-aws-auth.txt

+4-88
Original file line numberDiff line numberDiff line change
@@ -79,92 +79,8 @@ replace:
7979
and placeholder value.
8080
| *Optional*
8181

82-
Custom Authentication Provider
83-
------------------------------
82+
.. tip:: Custom Authentication Provider
8483

85-
You can add a custom authentication provider by implementing the
86-
``com.mongodb.kafka.connect.util.custom.credentials.CustomCredentialProvider``
87-
interface. To enable this feature, set the following authentication
88-
properties:
89-
90-
- ``mongo.custom.auth.mechanism.enable``: set to ``true``
91-
- ``mongo.custom.auth.mechanism.providerClass``: set to the qualified
92-
class name of the implementation class
93-
94-
Depending on the design of your implementation class, you might also
95-
set the ``mongodbaws.auth.mechanism.roleArn`` property, which
96-
provides the Amazon Resource Name (ARN).
97-
98-
Example
99-
~~~~~~~
100-
101-
This section provides a sample authentication provider implementation
102-
class and the corresponding configuration properties and values to
103-
implement the provider.
104-
105-
The following code specifies the configuration properties to use the
106-
``MONGODB-AWS`` authentication method and add a custom authentication
107-
provider:
108-
109-
.. code-block:: ini
110-
111-
connection.uri=<connection string>/?authMechanism=MONGODB-AWS
112-
mongo.custom.auth.mechanism.enable=true
113-
mongo.custom.auth.mechanism.providerClass=sample.AwsAssumeRoleCredentialProvider
114-
mongodbaws.auth.mechanism.roleArn=arn:aws:iam::<account ID>:role/<role name>
115-
116-
The ``AwsAssumeRoleCredentialProvider`` class defines ``init()`` and
117-
``validate()`` methods that are called when the connector initializes.
118-
The ``getCustomCredential()`` method returns an object of type
119-
``com.mongodb.MongoCredential`` that is used by the ``MongoClient``
120-
constructed for the connector. The following code defines the custom
121-
authentication provider:
122-
123-
.. code-block:: java
124-
125-
public class AwsAssumeRoleCredentialProvider implements CustomCredentialProvider {
126-
127-
public AwsAssumeRoleCredentialProvider() {}
128-
@Override
129-
public MongoCredential getCustomCredential(Map<?, ?> map) {
130-
AWSCredentialsProvider provider = new DefaultAWSCredentialsProviderChain();
131-
Supplier<AwsCredential> awsFreshCredentialSupplier = () -> {
132-
AWSSecurityTokenService stsClient = AWSSecurityTokenServiceAsyncClientBuilder.standard()
133-
.withCredentials(provider)
134-
.withRegion("us-east-1")
135-
.build();
136-
AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withDurationSeconds(3600)
137-
.withRoleArn((String)map.get("mongodbaws.auth.mechanism.roleArn"))
138-
.withRoleSessionName("Test_Session");
139-
AssumeRoleResult assumeRoleResult = stsClient.assumeRole(assumeRoleRequest);
140-
Credentials creds = assumeRoleResult.getCredentials();
141-
// Add your code to fetch new credentials
142-
return new AwsCredential(creds.getAccessKeyId(), creds.getSecretAccessKey(), creds.getSessionToken());
143-
};
144-
return MongoCredential.createAwsCredential(null, null)
145-
.withMechanismProperty(MongoCredential.AWS_CREDENTIAL_PROVIDER_KEY, awsFreshCredentialSupplier);
146-
}
147-
148-
@Override
149-
public void validate(Map<?, ?> map) {
150-
String roleArn = (String) map.get("mongodbaws.auth.mechanism.roleArn");
151-
if (StringUtils.isNullOrEmpty(roleArn)) {
152-
throw new RuntimeException("Invalid value set for customProperty");
153-
}
154-
}
155-
156-
@Override
157-
public void init(Map<?, ?> map) {
158-
159-
}
160-
}
161-
162-
In this example, the ``sample.AwsAssumeRoleCredentialProvider``
163-
implementation class must be available on the classpath. The
164-
authentication provider class reads the ARN you specify in the
165-
``roleArn`` property.
166-
167-
To view an example of a ``pom.xml`` file that can build the complete JAR containing
168-
the implementation class, see the `Kafka Connector GitHub repository
169-
README file
170-
<https://github.com/mongodb/mongo-kafka/blob/master/README.md#pom-file-to-build-the-sample-customroleprovider-into-a-jar>`__.
84+
You can create and use a custom authentication provider to support
85+
AWS IAM authentication. To learn more, see the
86+
:ref:`kafka-custom-auth` guide.

0 commit comments

Comments
 (0)