Skip to content

Commit 45f46c2

Browse files
amithkk-workamithkk-work
committed
Add X.509 authn/authz support and tests, update environment.js and README
1 parent 4f0f972 commit 45f46c2

File tree

8 files changed

+257
-5566
lines changed

8 files changed

+257
-5566
lines changed

‎.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# IDE Specific folders
2+
.idea
3+
.vscode
4+
5+
# Key Storage
6+
.secrets

‎README.md

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,25 @@ If you have configured a standalone installation of mongodb, follow [these instr
2222

2323
### Configuration
2424

25-
| Environment Variable | Default | Description |
26-
|------------------------------|------------------|---------------------------------------------------------------------------------|
27-
| LOG_LEVEL | `info` | The verbosity of the logging |
28-
| PORT | `3000` | Port on which the gateway listens |
29-
| MONGO_URI | - | A mongodb uri string. If this is specified, all other mongo args are overridden |
30-
| MONGO_HOST | `mongodb` | The host on which mongodb is available |
31-
| MONGO_PORT | `27017` | Port on which mongodb's native driver api is available |
32-
| MONGO_PASS | `pass` | Password for mongo host |
33-
| MONGO_REPLICA_SET_NAME | `` | Name of the mongo replicaset. Only required if connecting to an rs mongo |
34-
| CHANNEL_DB | `primary` | The database used as the channel collection |
35-
| AUDIT_POSTFIX | `_audit` | The postfix added to the audit channel for any given channel |
36-
| PERSIST_PATH | `./persist` | Path where the service can store the resume token over restarts |
25+
| Environment Variable | Default | Description |
26+
|--------------------------------|------------------------------|----------------------------------------------------------------------------------------------------------------|
27+
| LOG_LEVEL | `info` | The verbosity of the logging |
28+
| MONGO_URI | - | A mongodb uri string. If this is specified, all other mongo args are overridden |
29+
| MONGO_HOST | `mongodb` | The host on which mongodb is available |
30+
| MONGO_PORT | `27017` | Port on which mongodb's native driver api is available |
31+
| MONGO_PASS | `pass` | Password for mongo host |
32+
| MONGO_REPLICA_SET_NAME | `` | Name of the mongo replicaset. Only required if connecting to an rs mongo |
33+
| MONGO_TLS_MODE_ENABLED | `0` | If set to 1, enable TLS mongodb connections and present a client certificate for authorization |
34+
| MONGO_TLS_CLIENT_CERT_PATH | `` | Path to client certificate as .PEM encoded file. Relative to launch directory. Required if TLS mode is enabled |
35+
| MONGO_TLS_CA_CERT_PATH | `` | Path to CAs certificate as a .PEM encoded file. Relative to launch directory. Required if TLS mode is enabled |
36+
| MONGO_TLS_CLIENT_CERT_PASS_KEY | `MONGO_TLS_CLIENT_CERT_PASS` | Environment variable key for client certificate password. |
37+
| MONGO_TLS_CLIENT_CERT_PASS | `` | Key to decrypt client certificate. Required if client certificate is protected with a passphrase |
38+
| MONGO_TLS_ALLOW_INVALID_HOST | `0` | Allow use of server TLS certificates which do not have matching hostnames |
39+
| MONGO_SERVER_SELECTION_TIMEOUT | `3000` | Timeout for mongodb server selection. In milliseconds |
40+
| MONGO_CONNECTION_TIMEOUT | `3000` | Timeout for mongodb connection establishment. In milliseconds |
41+
| CHANNEL_DB | `primary` | The database used as the channel collection |
42+
| AUDIT_POSTFIX | `_audit` | The postfix added to the audit channel for any given channel |
43+
| PERSIST_PATH | `./persist` | Path where the service can store the resume token over restarts |
3744

3845
## Helm Deployment
3946

‎src/app.js

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -14,51 +14,44 @@
1414
* limitations under the License.
1515
*/
1616

17-
const mongoDB = require('mongodb');
18-
const log = require('winston');
19-
const persistence = require('./utils/persistence');
20-
const logging = require('./utils/logging');
21-
const env = require('./utils/environment');
22-
const watcher = require('./controller/watcher');
23-
const { logFatalError } = require('./utils/logging');
17+
const log = require('winston')
18+
const persistence = require('./utils/persistence')
19+
const logging = require('./utils/logging')
20+
const env = require('./utils/environment')
21+
const watcher = require('./controller/watcher')
22+
const {logFatalError} = require('./utils/logging')
2423

25-
logging.setupLogs();
24+
logging.setupLogs()
2625

27-
const client = new mongoDB.MongoClient(env.getMongoURI(),
28-
{
29-
numberOfRetries: 100,
30-
useUnifiedTopology: true,
31-
useNewUrlParser: true,
32-
});
33-
34-
log.info(`MongoDB: Trying to connect to ${env.getMongoURI()}`);
26+
const client = watcher.makeClientFromEnv()
3527

3628
/**
3729
* Initiate the watcher after we connect to mongoDB
3830
* @param {MongoClient} connectedClient
3931
*/
4032
const watchAfterConnect = async (connectedClient) => {
41-
log.info('MongoDB Connected!');
42-
const db = connectedClient.db(env.getChannelDB());
33+
log.info('MongoDB Connected!')
34+
const db = connectedClient.db(env.getChannelDB())
4335

4436
// Get a resume token if there is one
45-
const resumeToken = await persistence.getResumeToken();
37+
const resumeToken = await persistence.getResumeToken()
4638

4739
if (resumeToken == null) {
48-
log.info('No resume token. Will start watching collections/channels from now');
40+
log.info('No resume token. Will start watching collections/channels from now')
4941
} else {
50-
log.info('A resume token was found. Attempting to resume from where I left off');
42+
log.info('A resume token was found. Attempting to resume from where I left off')
5143
}
5244

5345
watcher.initWatcher(db,
5446
resumeToken,
5547
watcher.makeChannelEventCommitter(db, env.getAuditCollectionPostfix()),
56-
logFatalError);
57-
};
48+
logFatalError)
49+
}
5850

59-
client.connect()
60-
.then(watchAfterConnect, logFatalError);
51+
log.info('Trying to connect to mongoDB using environment configuration')
52+
log.debug(`MongoDB: URI is ${env.getMongoURIFromEnv()}`)
53+
client.connect().then(watchAfterConnect, logFatalError)
6154

6255
module.exports = {
6356
watchAfterConnect,
64-
};
57+
}

‎src/controller/audit.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
* limitations under the License.
1515
*/
1616

17-
/** Handles the generation and commit for DBoM Audit Entries
17+
/**
18+
* Handles the generation and commit for DBoM Audit Entries
1819
* @module audit
1920
*/
2021

‎src/controller/watcher.js

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,49 @@
1414
* limitations under the License.
1515
*/
1616

17-
/** Handles watching and acting on mongo change events
17+
/**
18+
* Handles watching and acting on mongo change events
1819
* @module watcher
1920
*/
2021

2122
const log = require('winston');
23+
const mongodb = require('mongodb');
2224
const persistence = require('../utils/persistence');
25+
const env = require('../utils/environment');
2326
const audit = require('./audit');
2427

28+
/**
29+
* Creates an instance of the mongoDB client based on environment variables
30+
* @func
31+
* @return {MongoClient} - Client that is ready to connect to
32+
*/
33+
const makeClientFromEnv = () => {
34+
let mongoClient;
35+
const tlsParams = env.getTLSParams();
36+
const defaultOptions = {
37+
numberOfRetries: 5,
38+
useNewUrlParser: true,
39+
useUnifiedTopology: true,
40+
connectTimeoutMS: env.getMongoConnectionTimeout(),
41+
serverSelectionTimeoutMS: env.getMongoServerSelectionTimeout(),
42+
};
43+
if (tlsParams.enabled) {
44+
log.info('Using mutual TLS authentication and X509 authorization');
45+
mongoClient = new mongodb.MongoClient(env.getMongoURIFromEnv(),
46+
{
47+
...tlsParams.mongoOptions,
48+
...defaultOptions,
49+
tls: true,
50+
});
51+
} else {
52+
mongoClient = new mongodb.MongoClient(env.getMongoURIFromEnv(),
53+
{
54+
...defaultOptions,
55+
});
56+
}
57+
return mongoClient;
58+
};
59+
2560
/**
2661
* Takes a mongoDB change event and commits it to the audit channel
2762
* @param db
@@ -106,5 +141,5 @@ module.exports = {
106141
initWatcher,
107142
makeChannelEventCommitter,
108143
commitChannelEventToDB,
109-
144+
makeClientFromEnv
110145
};

0 commit comments

Comments
 (0)