class Mongo::Auth::X509::Conversation

Defines behavior around a single X.509 conversation between the client and server.

@since 2.0.0 @api private

Constants

LOGIN

The login message.

@since 2.0.0

Public Instance Methods

speculative_auth_document() click to toggle source

Returns the hash to provide to the server in the handshake as value of the speculativeAuthenticate key.

If the auth mechanism does not support speculative authentication, this method returns nil.

@return [ Hash | nil ] Speculative authentication document.

# File lib/mongo/auth/x509/conversation.rb, line 74
def speculative_auth_document
  client_first_document
end
start(connection) click to toggle source

Start the X.509 conversation. This returns the first message that needs to be sent to the server.

@param [ Server::Connection ] connection The connection being

authenticated.

@return [ Protocol::Query ] The first X.509 conversation message.

@since 2.0.0

# File lib/mongo/auth/x509/conversation.rb, line 40
def start(connection)
  login = client_first_document
  if connection && connection.features.op_msg_enabled?
    selector = login
    # The only valid database for X.509 authentication is $external.
    if user.auth_source != '$external'
      user_name_msg = if user.name
        " #{user.name}"
      else
        ''
      end
      raise Auth::InvalidConfiguration, "User#{user_name_msg} specifies auth source '#{user.auth_source}', but the only valid auth source for X.509 is '$external'"
    end
    selector[Protocol::Msg::DATABASE_IDENTIFIER] = '$external'
    cluster_time = connection.mongos? && connection.cluster_time
    selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
    Protocol::Msg.new([], {}, selector)
  else
    Protocol::Query.new(
      Auth::EXTERNAL,
      Database::COMMAND,
      login,
      limit: -1
    )
  end
end

Private Instance Methods

client_first_document() click to toggle source
# File lib/mongo/auth/x509/conversation.rb, line 80
def client_first_document
  LOGIN.dup.tap do |payload|
    payload[:user] = user.name if user.name
  end
end