We would like to suggest a feature improvement where connection parameters can be dynamically changed so that no restart of client application infrastructure is needed.

Currently, when changing connection configuration, this usually requires the restart of a considerable number of pods or containers with the unavoidable consequence of a sudden surge in connection attempts.

Our request specifically would be to provide a way for drivers to read both connection string and connection parameters information from a source that can be easily managed and that's not necessarily embedded in the code, and

Drivers should also detect when this configuration has changed and gradually refresh connections to reflect the new configuration. Ideally there would be ways of forcing the driver to be more aggressive or more gradual, which should accommodate for emergency situations or tuning scenarios that are not urgent. This is the part that would avoid any client infrastructure restart, and avoid sudden surges in connection attempts.

Note: This post was inspired by my attempts to find a direct download for the MongoDB Java driver, but I've left the category as "Unspecified" because it could apply to any driver download for which the official sites say to "Just use Maven/etc"

Right now the documentation for the MongoDB Java driver (https://mongodb.github.io/mongo-java-driver/4.2/driver/getting-started/installation/) indicates that "The recommended way to get started using one of the drivers in your project is with a dependency management system." However, as far as I could tell from my own research, the official MongoDB sites have no official direct download link for the driver/dependency jar files - only the Maven groupId/artifactId are provided. If for some reason a developer is restricted such that they cannot use a dependency manager for their project and must obtain the jar files as a direct download, they must find the official Apache Maven repository on their own, and download the files from there.

I understand that this seems like a problem that can be solved by saying "just suck it up and use Maven", but please understand that at its core, this actually constitutes a security issue, as it makes it difficult for developers to find a download that they know they can trust.

Consider the following situation: Due to some situation, a developer is unable to use a dependency manager for their project. They must use a direct download of the driver/dependency jar files for the MongoDB Java driver in order to do their job. The first thing they will likely do (rightfully so) is go to the official MongoDB sites to try and find a download. They will not find it, and will instead look elsewhere.

Performing a Google search for "mongodb java driver" returns first the official MongoDB sites, which the developer already knows will not help them, and then returns an unofficial Maven Repository browser (mvnrepository). I haven't looked into the validity of this site, and I'm usually one to assume the best of intentions, but the fact remains that it's run by a person who is not affiliated with Apache/Maven or MongoDB, from which the developer will likely download several unverified jar files and include them with their project. This is a big security risk, as theoretically speaking, for all we know this site could be malicious, but it remains the most convenient option for the developer, because the official MongoDB sites do not include one. The safest option for the developer is to use the official Maven repository at search.maven.org, but this site only appears at the very bottom of the first page of the Google results, and the developer may not even see this during their search.

I feel like this problem could be fully solved by creating a section on the "Downloads" page (https://www.mongodb.com/try/download) for drivers, and including the most recent normally-supported release of each driver, including its dependencies. This may not be the recommended method, and it could very well include prominent text encouraging developers to consider using a dependency manager if possible, but it would effectively remove the potential for developers to accidentally download a malicious jar file from an unverified source and include it with their project.

TL;DR: If you don't include a direct downloads for MongoDB drivers/dependencies, a malicious actor on the internet will.

Hi,

We are currently using a pattern where we use a find(query).limit(x) and a count(query) with $near to find x results and display the overall count. Using this pattern, we are able to pass the same query to find and count. However that count method was removed in SCALA-517 and replaced by estimatedDocumentCount and countDocuments. The problem is that countDocuments will not work with $near. There is a workaround to use $geowithin with $center/$centerSphere, however this doesn't return the results sorted as $near did. We would like to have the option to pass the same query to count as we do to our find, even if there are risks associated as there was with count, an estimatedDocumentCount or unSafeCount, if you will, that accepts the same filter as our query.

I was building the URI in a spring configuration file as
spring.data.mongodb.uri=${MONGODB_URI}/test?retryWrites=true&w=majority

where MONGODB_URI came from a kubernetes secret (as it contains user & password)

somehow a new-line had slipped into the kubernetes secret, so the query was effectively asking for "fpos-dev-pl-1.kqybg.mongodb.net\n"

Besides learning how to correctly configure secrets, I learned in the process that neither Spring nor mongo was validating that spring.data.mongodb.uri was a well-formed URI and the application failed to start with error messages relating to not finding DNS and not being able to resolve the TXT record. This was very confusing.

The driver should accept a URI parameter (instead of a String) and ensures that it is valid.

MongoDB drivers should provide support for rotating authentication credentials:

• The customer may opt to rotate a specific credential (a password, client keytab, or a re-issued client certificate - when your private key will be the old one or a new one and the certificate will always be updated), or both the username and its credential


• drivers must support authentication hooks/override methods to handle custom logic. For example: when an external vault processes the password change, it will have a delay before the SCRAM / PLAIN password gets changed in the MongoDB Server / LDAP server. The customer-provided code will take care of this.


• Once a MongoDB connection went through the authentication step, the driver no longer needs a credential. However, we must allow for customers to choose between two following scenarios: a) drain the existing connections ASAP and create a bunch of new ones using a new credential; b) keep the existing connections as long as needed, potentially until the next restart of the MongoDB Server instance or until the application code decides to re-authenticate using them.

Support for EKS Service Account Credentials in MONGODB-AWS

It would be great to be able to authenticate to MongoDB using EKS service accounts.

Currently, the order in which Drivers MUST search for credentials is:
Credentials passed through the URI
Environment variables
ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
EC2 endpoint
(https://pymongo.readthedocs.io/en/stable/examples/authentication.html#mongodb-aws)

It is possible use the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables injected into the pod by EKS to assume the service account role and get temporary security credentials, which could then be passed to the uri as described in AssumeRole (https://pymongo.readthedocs.io/en/stable/examples/authentication.html#assumerole).

The boto client for sts provides a assume_role_with_web_identity method that accepts role_arn and web_identity_token as parameter that can be used to obtain temporary credentials.

Rather than having to add extra boiler plate code to applications, is this something that could be supported natively by the drivers?

So the order the drivers would search for credentials might then look like the following:
Credentials passed through the URI
Environment variables
ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
Assume EKS Service acccount role to get temporary credentials if and only if AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE are set
EC2 endpoint

Automatic CSFLE - To generate and manage the Customer Master key, can we add more KMS providers like Hashicorp Vault. KMS providers currently supported are only: Amazon Web Services KMS and Locally Managed Keyfile.

To work with Hashicorp Vault, it seems, we need to choose Locally Managed Keyfile as the KMS provider. This means that the Master key will be fetched from Vault in memory and then used in the code to encrypt/decrypt the DEK (Data Encryption Key). Ideally, the decryption of DEK should happen in the vault itself as a best practice, and master key should not be brought out of Vault.

Using only AWS KMS is a limitation. Using Locally Managed Keyfile to read key from
another KMS and then use in application is not secure.

Can more KMS providers be supported in a more secure way?

Thanks