Skip to content

Commit 24caa6e

Browse files
outcomes-winter-rakhulsprakashoutcomes-winter-rakhulsprakash
committed
feat: Update Database User
add oidcAuthType
1 parent 25ac09f commit 24caa6e

7 files changed

Lines changed: 175 additions & 2 deletions

File tree

‎cfn-resources/database-user/cmd/resource/model.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cfn-resources/database-user/cmd/resource/resource.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ func Read(req handler.Request, prevModel *Model, currentModel *Model) (handler.P
110110
currentModel.LdapAuthType = databaseUser.LdapAuthType
111111
currentModel.AWSIAMType = databaseUser.AwsIAMType
112112
currentModel.X509Type = databaseUser.X509Type
113+
currentModel.OIDCAuthType = databaseUser.OidcAuthType
113114
currentModel.Username = &databaseUser.Username
114115
var roles []RoleDefinition
115116

@@ -252,7 +253,9 @@ func List(req handler.Request, prevModel *Model, currentModel *Model) (handler.P
252253
DatabaseName: &databaseUser.DatabaseName,
253254
Description: databaseUser.Description,
254255
LdapAuthType: databaseUser.LdapAuthType,
256+
AWSIAMType: databaseUser.AwsIAMType,
255257
X509Type: databaseUser.X509Type,
258+
OIDCAuthType: databaseUser.OidcAuthType,
256259
Username: &databaseUser.Username,
257260
ProjectId: currentModel.ProjectId,
258261
}
@@ -341,10 +344,13 @@ func setModel(currentModel *Model) (*admin.CloudDatabaseUser, error) {
341344
if currentModel.X509Type == nil {
342345
currentModel.X509Type = &none
343346
}
347+
if currentModel.OIDCAuthType == nil {
348+
currentModel.OIDCAuthType = &none
349+
}
344350

345351
if currentModel.Password == nil {
346-
if (*currentModel.LdapAuthType == none) && (*currentModel.AWSIAMType == none) && (*currentModel.X509Type == none) {
347-
err := fmt.Errorf("password cannot be empty if not LDAP or IAM or X509 is not provided")
352+
if (*currentModel.LdapAuthType == none) && (*currentModel.AWSIAMType == none) && (*currentModel.X509Type == none) && (*currentModel.OIDCAuthType == none) {
353+
err := fmt.Errorf("password cannot be empty if not LDAP or IAM or X509 or OIDC is not provided")
348354
return nil, err
349355
}
350356
currentModel.Password = aws.String("")
@@ -364,6 +370,7 @@ func setModel(currentModel *Model) (*admin.CloudDatabaseUser, error) {
364370
LdapAuthType: currentModel.LdapAuthType,
365371
AwsIAMType: currentModel.AWSIAMType,
366372
X509Type: currentModel.X509Type,
373+
OidcAuthType: currentModel.OIDCAuthType,
367374
DeleteAfterDate: util.StringPtrToTimePtr(currentModel.DeleteAfterDate),
368375
Description: currentModel.Description,
369376
}

‎cfn-resources/database-user/docs/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ To declare this entity in your AWS CloudFormation template, use the following sy
1919
"<a href="#labels" title="Labels">Labels</a>" : <i>[ <a href="labeldefinition.md">labelDefinition</a>, ... ]</i>,
2020
"<a href="#ldapauthtype" title="LdapAuthType">LdapAuthType</a>" : <i>String</i>,
2121
"<a href="#x509type" title="X509Type">X509Type</a>" : <i>String</i>,
22+
"<a href="#oidcauthtype" title="OIDCAuthType">OIDCAuthType</a>" : <i>String</i>,
2223
"<a href="#password" title="Password">Password</a>" : <i>String</i>,
2324
"<a href="#projectid" title="ProjectId">ProjectId</a>" : <i>String</i>,
2425
"<a href="#roles" title="Roles">Roles</a>" : <i>[ <a href="roledefinition.md">roleDefinition</a>, ... ]</i>,
@@ -42,6 +43,7 @@ Properties:
4243
- <a href="labeldefinition.md">labelDefinition</a></i>
4344
<a href="#ldapauthtype" title="LdapAuthType">LdapAuthType</a>: <i>String</i>
4445
<a href="#x509type" title="X509Type">X509Type</a>: <i>String</i>
46+
<a href="#oidcauthtype" title="OIDCAuthType">OIDCAuthType</a>: <i>String</i>
4547
<a href="#password" title="Password">Password</a>: <i>String</i>
4648
<a href="#projectid" title="ProjectId">ProjectId</a>: <i>String</i>
4749
<a href="#roles" title="Roles">Roles</a>: <i>
@@ -130,6 +132,18 @@ _Allowed Values_: <code>NONE</code> | <code>MANAGED</code> | <code>CUSTOMER</cod
130132

131133
_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
132134

135+
#### OIDCAuthType
136+
137+
Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field. Default value is `NONE`.
138+
139+
_Required_: No
140+
141+
_Type_: String
142+
143+
_Allowed Values_: <code>NONE</code> | <code>USER</code> | <code>IDP_GROUP</code>
144+
145+
_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
146+
133147
#### Password
134148

135149
The user’s password. This field is not included in the entity returned from the server.

‎cfn-resources/database-user/mongodb-atlas-databaseuser.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,11 @@
120120
],
121121
"type": "string"
122122
},
123+
"OIDCAuthType": {
124+
"description": "Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field. Default value is `NONE`.",
125+
"enum": ["NONE", "USER", "IDP_GROUP"],
126+
"type": "string"
127+
},
123128
"Password": {
124129
"description": "The user’s password. This field is not included in the entity returned from the server.",
125130
"type": "string"

‎cfn-resources/database-user/test/inputs_3_create.template.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"Username": "DataUser3",
3+
"Password": "MongoDB12345%",
4+
"ProjectId": "${MONGODB_ATLAS_PROJECT_ID}",
5+
"Profile": "${MONGODB_ATLAS_PROFILE}",
6+
"DatabaseName": "admin",
7+
"Description": "User with Labels to test OIDCAuthType field",
8+
"OIDCAuthType": "NONE",
9+
"Roles": [
10+
{
11+
"RoleName": "readWrite",
12+
"DatabaseName": "testdb",
13+
"CollectionName": "col1"
14+
}
15+
],
16+
"Scopes": [
17+
{
18+
"Type": "CLUSTER",
19+
"Name": "testdb"
20+
}
21+
],
22+
"Labels": [
23+
{
24+
"Key": "testType",
25+
"Value": "oidc-field-validation"
26+
}
27+
]
28+
}

‎cfn-resources/database-user/test/inputs_3_update.template.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"Username": "DataUser3",
3+
"Password": "MongoDB12345%",
4+
"ProjectId": "${MONGODB_ATLAS_PROJECT_ID}",
5+
"Profile": "${MONGODB_ATLAS_PROFILE}",
6+
"DatabaseName": "admin",
7+
"Description": "Updated user with modified Labels",
8+
"OIDCAuthType": "NONE",
9+
"Roles": [
10+
{
11+
"RoleName": "readWriteAnyDatabase",
12+
"DatabaseName": "admin"
13+
}
14+
],
15+
"Scopes": [
16+
{
17+
"Type": "CLUSTER",
18+
"Name": "testdb2"
19+
}
20+
],
21+
"Labels": [
22+
{
23+
"Key": "testType",
24+
"Value": "oidc-field-validation"
25+
},
26+
{
27+
"Key": "updated",
28+
"Value": "true"
29+
}
30+
]
31+
}

‎examples/database-user/oidcUser.json‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Description": "This template creates a database user with OIDC (OpenID Connect) federated authentication. OIDC authentication requires federation settings to be configured in your MongoDB Atlas organization. OIDCAuthType supports USER (individual users) and IDP_GROUP (identity provider groups).",
4+
"Parameters": {
5+
"ProjectId": {
6+
"Type": "String",
7+
"Description": "Unique 24-hexadecimal digit string that identifies your project"
8+
},
9+
"Profile": {
10+
"Type": "String",
11+
"Description": "Secret Manager Profile that contains the Atlas Programmatic keys",
12+
"ConstraintDescription": "",
13+
"Default": "default"
14+
},
15+
"DatabaseName": {
16+
"Type": "String",
17+
"Description": "Database against which the database user authenticates. For OIDC authentication, this must be $external",
18+
"Default": "$external"
19+
},
20+
"Username": {
21+
"Type": "String",
22+
"Description": "Username for OIDC authentication. Format: <federation_settings_id>/<username> (e.g., 6489e4f0bebcb4b0dbd8e7b3/john.doe). The federation_settings_id can be found in your Atlas organization's federation settings."
23+
},
24+
"Description": {
25+
"Type": "String",
26+
"Description": "Description of this database user.",
27+
"Default": "OIDC federated authentication user"
28+
}
29+
},
30+
"Mappings": {},
31+
"Resources": {
32+
"OidcUser": {
33+
"Type": "MongoDB::Atlas::DatabaseUser",
34+
"Metadata": {
35+
"Comment": "Remember to update the \"Roles\" field with a list of roles that you want to assign to the user. OIDC authentication requires federation settings to be configured in your Atlas organization. The username must follow the format: <federation_settings_id>/<username>. For group-based authentication, use OIDCAuthType: IDP_GROUP and format: <federation_settings_id>/<group_name>"
36+
},
37+
"Properties": {
38+
"Username": {
39+
"Ref": "Username"
40+
},
41+
"OIDCAuthType": "USER",
42+
"ProjectId": {
43+
"Ref": "ProjectId"
44+
},
45+
"DatabaseName": {
46+
"Ref": "DatabaseName"
47+
},
48+
"Profile": {
49+
"Ref": "Profile"
50+
},
51+
"Description": {
52+
"Ref": "Description"
53+
},
54+
"Roles": [
55+
{
56+
"RoleName": "readWriteAnyDatabase",
57+
"DatabaseName": "admin"
58+
}
59+
],
60+
"Labels": [
61+
{
62+
"Key": "authType",
63+
"Value": "oidc"
64+
},
65+
{
66+
"Key": "environment",
67+
"Value": "production"
68+
}
69+
]
70+
}
71+
}
72+
},
73+
"Outputs": {
74+
"MongoDBOidcUsername": {
75+
"Description": "Unique identifier for the OIDC database user",
76+
"Value": {
77+
"Fn::GetAtt": ["OidcUser", "UserCFNIdentifier"]
78+
}
79+
},
80+
"Username": {
81+
"Description": "Username of the OIDC database user",
82+
"Value": {
83+
"Ref": "Username"
84+
}
85+
}
86+
}
87+
}

0 commit comments

Comments
 (0)