0

We're introducing this new password management infrastructure that changes passwords every X days, but there're these existing implementations in place that use singleton repositories, so once a connection gets established, the object stays in memory and does not have to re-authenticate/open connection next time the database access is required.

My question is, would existing open connections for users get destroyed if their password get changed?

Drivers in question are .NET and Java.

I would be surprised if connections stayed open, but would also like to know how MongoDB does cleanup of unauthorized connections and how quick can this cleanup happen after the password change.

8
  • 2
    Doesn’t answer your question, but It’s really frowned upon these days to use the changing of passwords as some sort of security measure. Frowned upon ...
    – Philᵀᴹ
    Commented May 16, 2019 at 17:31
  • @Phil, I understand the benefits of such measures at certain places within organizations, but not holistically.. This has partly to do with GDRP and other privacy laws that lawmakers are pushing down...
    – Ostati
    Commented May 16, 2019 at 19:39
  • Hey @Ostati , do you get to know the answer for your question somewhere else ? Because I also wish to know if connection remains open or it closes immediately or later Commented Sep 23, 2020 at 13:41
  • @Saksham Khurana my approach is to not change password automatically. If you're changing passwords, then using singleton connections is not going to work.
    – Ostati
    Commented Sep 23, 2020 at 14:42
  • @Ostati, so the thing is I wish to use Hashicorp Vault to get my credentials for various containers (node servers) using mongoose... on first run I can simply ask for credentials from Vault and it will return with some given expiry.. the thing I want to solve is when the credentials expire what should I do.... or do you have an entirely different approach to handle this case? Thanks in advance :) Commented Sep 24, 2020 at 5:46

1 Answer 1

0

I'm going to stick my neck out and say I believe you can change the password for a user and any existing connections for that user will remain open, authenticated, and maybe even authorized.

First, inside MongoDB a Client is just any "thing" that needs to do something against the server. It can come from over the network, or be some internal MongoDB process.

All operations executed by the Client will take place on that Client’s associated thread serially over the network connection managed by the Session object that was passed into the Client’s constructor.

https://github.com/mongodb/mongo/blob/master/src/mongo/db/auth/README.md is perhaps the authoritative design document on Authentication and Authorization:

Clients are expected to authenticate at most one time on a connection. Attempting to reauthenticate as the currently authenticated user results in a warning being emitted to the global log, but the operation succeeds. Attempting to authenticate as a new user on an already authenticated connection is an error.

What this tells me, is that if you have a session already authenticated, and you try to authenticate with new credentials, the server performs a no-op.

What it also says, if you read closely, is that when you authenticate a connection you never need to authenticate it again.

You probably need to run something like killAllSessions if you want to close things down in an emergency.


All things being equal, if you're using Vault it's not an issue because you should rotate onto a new user before the current credentials expire.

You will probably need to start a new connection pool and drain existing connection pools.

1
  • Also, if I'm wrong I expect an answer to arrive ANY minute :D
    – Breedly
    Commented Jan 20, 2023 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.