CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

kevinAlbs · 2025-10-31T15:31:53Z

Summary

Support ENVIRONMENT:azure for MONGODB-OIDC.

Extend mcd-azure.h to support Azure IMDS requests for OIDC. This internal header previously only supported Azure IMDS requests to Azure Key Vault for In-Use Encryption.
Add a percent encoding utility to encode the token resource string.

Patch build: https://spruce.mongodb.com/version/6904afbc379d3a0007e1ac83

Testing

Evergreen testing is described in the drivers-evergreen-tools README.md. Testing follows a similar pattern to the testazurekms-task: build test-libmongoc on an Evergreen host, create a remote Azure VM with a matching OS, copy the binary, run the test.

oidc-compile-azure.sh includes a temporary workaround to install UV (as was done in #2163).

Support a custom token resource, optional timeout, and optional client_id.

And move check that both env+user callbacks are not set from auth to cache (to simplify).

The tasks already define their `run_on`.

eramongodb · 2025-10-31T20:12:30Z

.evergreen/scripts/oidc-azure-compile.sh

+cmake \
+  -DENABLE_SASL=OFF \
+  -DENABLE_SNAPPY=OFF \
+  -DENABLE_ZSTD=OFF \
+  -DENABLE_ZLIB=OFF \
+  -DENABLE_SRV=OFF \
+  -DENABLE_CLIENT_SIDE_ENCRYPTION=OFF \
+  -DENABLE_EXAMPLES=OFF \
+  -DENABLE_SRV=OFF \
+  -S. -Bcmake-build


Suggested change

cmake \

-DENABLE_SASL=OFF \

-DENABLE_SNAPPY=OFF \

-DENABLE_ZSTD=OFF \

-DENABLE_ZLIB=OFF \

-DENABLE_SRV=OFF \

-DENABLE_CLIENT_SIDE_ENCRYPTION=OFF \

-DENABLE_EXAMPLES=OFF \

-DENABLE_SRV=OFF \

-S. -Bcmake-build

cmake_flags=(

-DENABLE_SASL=OFF

-DENABLE_SNAPPY=OFF

-DENABLE_ZSTD=OFF

-DENABLE_ZLIB=OFF

-DENABLE_SRV=OFF

-DENABLE_CLIENT_SIDE_ENCRYPTION=OFF

-DENABLE_EXAMPLES=OFF

-DENABLE_SRV=OFF

)

cmake "${cmake_flags[@]}" -Bcmake-build

Avoid awkward backslashes + redundant -S for current working directory as source.

eramongodb · 2025-10-31T20:12:55Z

.evergreen/scripts/oidc-azure-compile.sh

+  -DENABLE_EXAMPLES=OFF \
+  -DENABLE_SRV=OFF \
+  -S. -Bcmake-build
+cmake --build cmake-build --target test-libmongoc --parallel


Suggested change

cmake --build cmake-build --target test-libmongoc --parallel

cmake --build cmake-build --target test-libmongoc

Ninja generator already uses max parallelism by default.

eramongodb · 2025-10-31T20:15:28Z

.evergreen/scripts/oidc-azure-compile.sh

+# shellcheck source=.evergreen/scripts/use-tools.sh
+. "$(dirname "${BASH_SOURCE[0]}")/use-tools.sh" paths # Sets MONGOC_DIR
+
+cd "$MONGOC_DIR"


Working directory is already set to mongoc via the EVG task definition:

bash_exec( working_dir="mongoc", add_expansions_to_env=True, command_type=EvgCommandType.TEST, script='.evergreen/scripts/oidc-azure-compile.sh', ),

Removed unnecessary cd and include of use-tools.sh.

eramongodb · 2025-10-31T20:16:26Z

.evergreen/scripts/oidc-azure-compile.sh

+tar -czf test-libmongoc.tar.gz \
+  .evergreen/scripts/oidc-azure-test.sh \
+  ./cmake-build/src/libmongoc/test-libmongoc \
+  src/libmongoc/tests/json \
+  src/libbson/tests/json


Suggested change

tar -czf test-libmongoc.tar.gz \

.evergreen/scripts/oidc-azure-test.sh \

./cmake-build/src/libmongoc/test-libmongoc \

src/libmongoc/tests/json \

src/libbson/tests/json

files=(

.evergreen/scripts/oidc-azure-test.sh

cmake-build/src/libmongoc/test-libmongoc

src/libmongoc/tests/json

src/libbson/tests/json

)

tar -czf test-libmongoc.tar.gz "${files[@]}"

Avoid awkward backslashes.

eramongodb · 2025-10-31T20:17:24Z

.evergreen/scripts/oidc-azure-test.sh

+# Install required OpenSSL runtime library.
+sudo apt install -y libssl-dev
+
+./cmake-build/src/libmongoc/test-libmongoc -d --match '/auth/unified/*' --match '/oidc/*'


Should this include -f/--no-fork?

Aside: I think most scripts use the shorter -l instead of --match.

I left it out --no-fork for now. Leaving out --no-fork has the benefit of reporting all failing tests, but I expect is slower. In this case, it is likely a small difference since the forked tests take 3 seconds only. Another comment notes "ASAN does not play well with spawned processes", but this task does not currently use ASAN.

Updated to use -l for consistency with run-tests.sh.

eramongodb · 2025-10-31T21:24:59Z

src/libmongoc/src/mongoc/mcd-azure.h

                                 const char *const opt_imds_host,
                                 int opt_port,
                                 const char *opt_extra_headers,
+                                 int opt_timeout_ms,


Suggested change

int opt_timeout_ms,

int32_t opt_timeout_ms,

We really need to address CDRIVER-1329 and CDRIVER-4589 sometime soon so that new API does not continue to be burdened by int32_t compatibility issues. 🫠

Switched to mlib_duration for the timeout parameter. Submitted #2168 to replace the (now redundant) mcd-time.h with mlib utilities.

eramongodb · 2025-11-10T15:43:54Z

src/libmongoc/src/mongoc/mongoc-oidc-env.c

+   if (timeout_us) {
+      int64_t remaining_ms = (*timeout_us - bson_get_monotonic_time()) / 1000;
+      if (remaining_ms <= 0) {
+         // No time remaining. Immediately fail.
+         mongoc_oidc_callback_params_cancel_with_timeout(params);
+         goto fail;
+      }
+      if (mlib_narrow(&max_duration_ms, remaining_ms)) {
+         // Requested timeout too large to fit. Cap at INT_MAX.
+         max_duration_ms = mlib_maxof(int);
+      }
+   }


Suggested change

if (timeout_us) {

int64_t remaining_ms = (*timeout_us - bson_get_monotonic_time()) / 1000;

if (remaining_ms <= 0) {

// No time remaining. Immediately fail.

mongoc_oidc_callback_params_cancel_with_timeout(params);

goto fail;

}

if (mlib_narrow(&max_duration_ms, remaining_ms)) {

// Requested timeout too large to fit. Cap at INT_MAX.

max_duration_ms = mlib_maxof(int);

}

}

if (timeout_us) {

const mlib_timer timer = {.expires_at = mlib_duration(*timeout_us, us)};

if (mlib_timer_is_expired(timer, NULL)) {

// No time remaining. Immediately fail.

mongoc_oidc_callback_params_cancel_with_timeout(params);

goto fail;

}

if (mlib_narrow(&max_duration_ms, mlib_milliseconds_count(mlib_timer_remaining(timer)))) {

// Requested timeout too large to fit. Cap at INT_MAX.

max_duration_ms = mlib_maxof(int);

}

}

Suggest implementing new timer/expiry/duration code in terms of mlib utilities when able.

Implemented with slight tweak (.expires_at is a mlib_time_point, not a mlib_duration).

eramongodb · 2025-11-10T16:05:13Z

src/libmongoc/src/mongoc/mcd-azure.c

+   int timeout_ms = 3 * 1000; // Default 3 second timeout
+   if (opt_timeout_ms > 0) {
+      timeout_ms = opt_timeout_ms;
+   }


Suggested change

int timeout_ms = 3 * 1000; // Default 3 second timeout

if (opt_timeout_ms > 0) {

timeout_ms = opt_timeout_ms;

}

const mlib_time_point now = mlib_now();

mlib_timer timer = mlib_expires_at(mlib_time_add(now, (3, s))); // Default 3 second timeout.

if (opt_timeout_ms > 0) {

timer = mlib_expires_at(mlib_time_add(now, (opt_timeout_ms, ms)));

}

Suggest implementing new timer/expiry/duration code in terms of mlib utilities when able.

eramongodb · 2025-11-10T16:30:11Z

src/libmongoc/src/mongoc/mongoc-oidc-env.c

+
+   ret = mongoc_oidc_credential_new_with_expires_in(token.access_token, mcd_get_microseconds(token.expires_in));
+   if (!ret) {
+      MONGOC_ERROR("Failed to process Azure OIDC access token");


Suggest providing more descriptive error messages for users when able, e.g.:

if (!ret) { MONGOC_ERROR("Failed to process Azure OIDC access token"); if (!token.access_token) { MONGOC_ERROR("missing Azure OIDC access token string"); } if (token.expires_in < 0) { MONGOC_ERROR("Azure OIDC access token expiration must not be a negative value"); } goto fail; }

eramongodb · 2025-11-10T16:44:20Z

src/libmongoc/src/mongoc/mongoc-oidc-cache.c

+         if (mongoc_oidc_callback_params_get_cancelled_with_timeout(params)) {
+            SET_ERROR("MONGODB-OIDC callback was cancelled due to timeout");
+            goto unlock_and_return;
+         }


Confirming: this will surface timeouts as an authentication error via mongoc_cluster_run_command_monitored or _mongoc_cluster_auth_node. Is this correct?

I think yes. I expect an error is appropriate since the callback failed to get an auth token. This is intended to give the reason rather than the more generic "MONGODB-OIDC callback failed" message.

To avoid backslashes with multi-line commands.

Ninja uses parallel by default.

Working directory is set by Evergreen task

Already set at the project level.

Saves a small amount of clean-up if topology creation fails before.

kevinAlbs added 10 commits October 30, 2025 15:54

add mcd_get_microseconds

73a9caa

add mongoc_percent_encode

a031652

extend mcd-azure.h

f848d34

Support a custom token resource, optional timeout, and optional client_id.

add (failing) prose tests 5.1 and 5.2

373d1d0

implement mongoc_oidc_env_fn_azure

95df9b4

apply OIDC environment callback

df70d96

And move check that both env+user callbacks are not set from auth to cache (to simplify).

test more bad configuration cases

435ec48

support unified tests with Azure OIDC

d525dfe

add Evergreen tests

7e7678c

remove unnecessary run_on

4499785

The tasks already define their `run_on`.

kevinAlbs requested review from eramongodb and mdb-ad October 31, 2025 17:27

kevinAlbs marked this pull request as ready for review October 31, 2025 17:27

kevinAlbs requested a review from a team as a code owner October 31, 2025 17:27

kevinAlbs requested review from connorsmacd and removed request for mdb-ad November 10, 2025 14:30

eramongodb requested changes Nov 10, 2025

View reviewed changes

kevinAlbs added 11 commits November 11, 2025 08:13

use bash arrays

465f6e8

To avoid backslashes with multi-line commands.

remove unnecessary --parallel

b5c446e

Ninja uses parallel by default.

remove unnecessary cd

f12e802

Working directory is set by Evergreen task

use -l for consistency with run-tests.sh

5c7edae

remove unnecessary 1 hour setup group timeout

90d62f8

Already set at the project level.

add BSON_UNUSED(use_pool_void);

dddaad4

remove unnecessary assertion

847a80f

apply URI to OIDC cache later

e90adf6

Saves a small amount of clean-up if topology creation fails before.

use const pointers

5059177

use tmp_bson to simplify test code

6f4867e

use mlib_duration for timeout argument

2e24796

kevinAlbs mentioned this pull request Nov 11, 2025

CDRIVER-6151 replaced mcd-time.h with mlib utilities #2168

Open

prefer mlib utilities

58fb40a

clarify cause of error when failing to get token

7382b6a

kevinAlbs requested a review from eramongodb November 12, 2025 16:05

	cmake --build cmake-build --target test-libmongoc --parallel
	cmake --build cmake-build --target test-libmongoc

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

Are you sure you want to change the base?

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

Conversation

kevinAlbs commented Oct 31, 2025

Summary

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166