CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

kevinAlbs · 2025-10-31T15:31:53Z

Summary

Support ENVIRONMENT:azure for MONGODB-OIDC.

Extend mcd-azure.h to support Azure IMDS requests for OIDC. This internal header previously only supported Azure IMDS requests to Azure Key Vault for In-Use Encryption.
Add a percent encoding utility to encode the token resource string.

Patch build: https://spruce.mongodb.com/version/6904afbc379d3a0007e1ac83

Testing

Evergreen testing is described in the drivers-evergreen-tools README.md. Testing follows a similar pattern to the testazurekms-task: build test-libmongoc on an Evergreen host, create a remote Azure VM with a matching OS, copy the binary, run the test.

oidc-compile-azure.sh includes a temporary workaround to install UV (as was done in #2163).

Support a custom token resource, optional timeout, and optional client_id.

And move check that both env+user callbacks are not set from auth to cache (to simplify).

The tasks already define their `run_on`.

eramongodb · 2025-10-31T20:12:30Z

.evergreen/scripts/oidc-azure-compile.sh

+cmake \
+  -DENABLE_SASL=OFF \
+  -DENABLE_SNAPPY=OFF \
+  -DENABLE_ZSTD=OFF \
+  -DENABLE_ZLIB=OFF \
+  -DENABLE_SRV=OFF \
+  -DENABLE_CLIENT_SIDE_ENCRYPTION=OFF \
+  -DENABLE_EXAMPLES=OFF \
+  -DENABLE_SRV=OFF \
+  -S. -Bcmake-build


Suggested change

cmake \

-DENABLE_SASL=OFF \

-DENABLE_SNAPPY=OFF \

-DENABLE_ZSTD=OFF \

-DENABLE_ZLIB=OFF \

-DENABLE_SRV=OFF \

-DENABLE_CLIENT_SIDE_ENCRYPTION=OFF \

-DENABLE_EXAMPLES=OFF \

-DENABLE_SRV=OFF \

-S. -Bcmake-build

cmake_flags=(

-DENABLE_SASL=OFF

-DENABLE_SNAPPY=OFF

-DENABLE_ZSTD=OFF

-DENABLE_ZLIB=OFF

-DENABLE_SRV=OFF

-DENABLE_CLIENT_SIDE_ENCRYPTION=OFF

-DENABLE_EXAMPLES=OFF

-DENABLE_SRV=OFF

)

cmake "${cmake_flags[@]}" -Bcmake-build

Avoid awkward backslashes + redundant -S for current working directory as source.

eramongodb · 2025-10-31T20:12:55Z

.evergreen/scripts/oidc-azure-compile.sh

+  -DENABLE_EXAMPLES=OFF \
+  -DENABLE_SRV=OFF \
+  -S. -Bcmake-build
+cmake --build cmake-build --target test-libmongoc --parallel


Suggested change

cmake --build cmake-build --target test-libmongoc --parallel

cmake --build cmake-build --target test-libmongoc

Ninja generator already uses max parallelism by default.

eramongodb · 2025-10-31T20:15:28Z

.evergreen/scripts/oidc-azure-compile.sh

+# shellcheck source=.evergreen/scripts/use-tools.sh
+. "$(dirname "${BASH_SOURCE[0]}")/use-tools.sh" paths # Sets MONGOC_DIR
+
+cd "$MONGOC_DIR"


Working directory is already set to mongoc via the EVG task definition:

bash_exec( working_dir="mongoc", add_expansions_to_env=True, command_type=EvgCommandType.TEST, script='.evergreen/scripts/oidc-azure-compile.sh', ),

eramongodb · 2025-10-31T20:16:26Z

.evergreen/scripts/oidc-azure-compile.sh

+tar -czf test-libmongoc.tar.gz \
+  .evergreen/scripts/oidc-azure-test.sh \
+  ./cmake-build/src/libmongoc/test-libmongoc \
+  src/libmongoc/tests/json \
+  src/libbson/tests/json


Suggested change

tar -czf test-libmongoc.tar.gz \

.evergreen/scripts/oidc-azure-test.sh \

./cmake-build/src/libmongoc/test-libmongoc \

src/libmongoc/tests/json \

src/libbson/tests/json

files=(

.evergreen/scripts/oidc-azure-test.sh

cmake-build/src/libmongoc/test-libmongoc

src/libmongoc/tests/json

src/libbson/tests/json

)

tar -czf test-libmongoc.tar.gz "${files[@]}"

Avoid awkward backslashes.

eramongodb · 2025-10-31T20:17:24Z

.evergreen/scripts/oidc-azure-test.sh

+# Install required OpenSSL runtime library.
+sudo apt install -y libssl-dev
+
+./cmake-build/src/libmongoc/test-libmongoc -d --match '/auth/unified/*' --match '/oidc/*'


Should this include -f/--no-fork?

Aside: I think most scripts use the shorter -l instead of --match.

eramongodb · 2025-10-31T21:24:59Z

src/libmongoc/src/mongoc/mcd-azure.h

                                 const char *const opt_imds_host,
                                 int opt_port,
                                 const char *opt_extra_headers,
+                                 int opt_timeout_ms,


Suggested change

int opt_timeout_ms,

int32_t opt_timeout_ms,

We really need to address CDRIVER-1329 and CDRIVER-4589 sometime soon so that new API does not continue to be burdened by int32_t compatibility issues. 🫠

eramongodb · 2025-11-10T15:43:54Z

src/libmongoc/src/mongoc/mongoc-oidc-env.c

+   if (timeout_us) {
+      int64_t remaining_ms = (*timeout_us - bson_get_monotonic_time()) / 1000;
+      if (remaining_ms <= 0) {
+         // No time remaining. Immediately fail.
+         mongoc_oidc_callback_params_cancel_with_timeout(params);
+         goto fail;
+      }
+      if (mlib_narrow(&max_duration_ms, remaining_ms)) {
+         // Requested timeout too large to fit. Cap at INT_MAX.
+         max_duration_ms = mlib_maxof(int);
+      }
+   }


Suggested change

if (timeout_us) {

int64_t remaining_ms = (*timeout_us - bson_get_monotonic_time()) / 1000;

if (remaining_ms <= 0) {

// No time remaining. Immediately fail.

mongoc_oidc_callback_params_cancel_with_timeout(params);

goto fail;

}

if (mlib_narrow(&max_duration_ms, remaining_ms)) {

// Requested timeout too large to fit. Cap at INT_MAX.

max_duration_ms = mlib_maxof(int);

}

}

if (timeout_us) {

const mlib_timer timer = {.expires_at = mlib_duration(*timeout_us, us)};

if (mlib_timer_is_expired(timer, NULL)) {

// No time remaining. Immediately fail.

mongoc_oidc_callback_params_cancel_with_timeout(params);

goto fail;

}

if (mlib_narrow(&max_duration_ms, mlib_milliseconds_count(mlib_timer_remaining(timer)))) {

// Requested timeout too large to fit. Cap at INT_MAX.

max_duration_ms = mlib_maxof(int);

}

}

Suggest implementing new timer/expiry/duration code in terms of mlib utilities when able.

eramongodb · 2025-11-10T16:05:13Z

src/libmongoc/src/mongoc/mcd-azure.c

+   int timeout_ms = 3 * 1000; // Default 3 second timeout
+   if (opt_timeout_ms > 0) {
+      timeout_ms = opt_timeout_ms;
+   }


Suggested change

int timeout_ms = 3 * 1000; // Default 3 second timeout

if (opt_timeout_ms > 0) {

timeout_ms = opt_timeout_ms;

}

const mlib_time_point now = mlib_now();

mlib_timer timer = mlib_expires_at(mlib_time_add(now, (3, s))); // Default 3 second timeout.

if (opt_timeout_ms > 0) {

timer = mlib_expires_at(mlib_time_add(now, (opt_timeout_ms, ms)));

}

Suggest implementing new timer/expiry/duration code in terms of mlib utilities when able.

eramongodb · 2025-11-10T16:30:11Z

src/libmongoc/src/mongoc/mongoc-oidc-env.c

+
+   ret = mongoc_oidc_credential_new_with_expires_in(token.access_token, mcd_get_microseconds(token.expires_in));
+   if (!ret) {
+      MONGOC_ERROR("Failed to process Azure OIDC access token");


Suggest providing more descriptive error messages for users when able, e.g.:

if (!ret) { MONGOC_ERROR("Failed to process Azure OIDC access token"); if (!token.access_token) { MONGOC_ERROR("missing Azure OIDC access token string"); } if (token.expires_in < 0) { MONGOC_ERROR("Azure OIDC access token expiration must not be a negative value"); } goto fail; }

eramongodb · 2025-11-10T16:44:20Z

src/libmongoc/src/mongoc/mongoc-oidc-cache.c

+         if (mongoc_oidc_callback_params_get_cancelled_with_timeout(params)) {
+            SET_ERROR("MONGODB-OIDC callback was cancelled due to timeout");
+            goto unlock_and_return;
+         }


Confirming: this will surface timeouts as an authentication error via mongoc_cluster_run_command_monitored or _mongoc_cluster_auth_node. Is this correct?

kevinAlbs added 10 commits October 30, 2025 15:54

add mcd_get_microseconds

73a9caa

add mongoc_percent_encode

a031652

extend mcd-azure.h

f848d34

Support a custom token resource, optional timeout, and optional client_id.

add (failing) prose tests 5.1 and 5.2

373d1d0

implement mongoc_oidc_env_fn_azure

95df9b4

apply OIDC environment callback

df70d96

And move check that both env+user callbacks are not set from auth to cache (to simplify).

test more bad configuration cases

435ec48

support unified tests with Azure OIDC

d525dfe

add Evergreen tests

7e7678c

remove unnecessary run_on

4499785

The tasks already define their `run_on`.

kevinAlbs requested review from eramongodb and mdb-ad October 31, 2025 17:27

kevinAlbs marked this pull request as ready for review October 31, 2025 17:27

kevinAlbs requested a review from a team as a code owner October 31, 2025 17:27

kevinAlbs requested review from connorsmacd and removed request for mdb-ad November 10, 2025 14:30

eramongodb requested changes Nov 10, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

Uh oh!

kevinAlbs commented Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Oct 31, 2025

Uh oh!

eramongodb Nov 10, 2025

Uh oh!

eramongodb Nov 10, 2025

Uh oh!

eramongodb Nov 10, 2025

Uh oh!

eramongodb Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	cmake --build cmake-build --target test-libmongoc --parallel
	cmake --build cmake-build --target test-libmongoc

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

Are you sure you want to change the base?

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

Uh oh!

Conversation

kevinAlbs commented Oct 31, 2025

Summary

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166