PYTHON-5921 Validate OIDC allowed hosts before authenticator reuse (#2801)

Co-authored-by: Steven Silvester <steve.silvester@mongodb.com>

Author: NguyenCong2k

pymongo/asynchronous/auth_oidc.py

@@ -51,9 +51,6 @@
 def _get_authenticator(
     credentials: MongoCredential, address: tuple[str, int]
 ) -> _OIDCAuthenticator:
-    if credentials.cache.data:
-        return credentials.cache.data
-
     # Extract values.
     principal_name = credentials.username
     properties = credentials.mechanism_properties
@@ -72,6 +69,9 @@ def _get_authenticator(
                 f"Refusing to connect to {address[0]}, which is not in authOIDCAllowedHosts: {allowed_hosts}"
             )
 
+    if credentials.cache.data:
+        return credentials.cache.data
+
     # Get or create the cache data.
     credentials.cache.data = _OIDCAuthenticator(username=principal_name, properties=properties)
     return credentials.cache.data

pymongo/synchronous/auth_oidc.py

@@ -51,9 +51,6 @@
 def _get_authenticator(
     credentials: MongoCredential, address: tuple[str, int]
 ) -> _OIDCAuthenticator:
-    if credentials.cache.data:
-        return credentials.cache.data
-
     # Extract values.
     principal_name = credentials.username
     properties = credentials.mechanism_properties
@@ -72,6 +69,9 @@ def _get_authenticator(
                 f"Refusing to connect to {address[0]}, which is not in authOIDCAllowedHosts: {allowed_hosts}"
             )
 
+    if credentials.cache.data:
+        return credentials.cache.data
+
     # Get or create the cache data.
     credentials.cache.data = _OIDCAuthenticator(username=principal_name, properties=properties)
     return credentials.cache.data

test/asynchronous/test_auth_oidc.py

@@ -117,6 +117,26 @@ async def fail_point(self, command_args):
             await client.close()
 
 
+class TestOIDCAllowedHostsCache(unittest.TestCase):
+    class HumanCallback(OIDCCallback):
+        def fetch(self, context):
+            return OIDCCallbackResult(access_token="token")
+
+    def test_allowed_hosts_checked_before_cached_authenticator_reuse(self):
+        props = {
+            "OIDC_HUMAN_CALLBACK": self.HumanCallback(),
+            "ALLOWED_HOSTS": ["good.example.com"],
+        }
+        extra = {"authmechanismproperties": props}
+        credentials = _build_credentials_tuple("MONGODB-OIDC", None, "user", None, extra, "test")
+
+        authenticator = _get_authenticator(credentials, ("good.example.com", 27017))
+        self.assertIs(authenticator, credentials.cache.data)
+
+        with self.assertRaisesRegex(ConfigurationError, "evil.example.com"):
+            _get_authenticator(credentials, ("evil.example.com", 27017))
+
+
 class TestAuthOIDCHuman(OIDCTestBase):
     uri: str
 

test/test_auth_oidc.py

@@ -117,6 +117,26 @@ def fail_point(self, command_args):
             client.close()
 
 
+class TestOIDCAllowedHostsCache(unittest.TestCase):
+    class HumanCallback(OIDCCallback):
+        def fetch(self, context):
+            return OIDCCallbackResult(access_token="token")
+
+    def test_allowed_hosts_checked_before_cached_authenticator_reuse(self):
+        props = {
+            "OIDC_HUMAN_CALLBACK": self.HumanCallback(),
+            "ALLOWED_HOSTS": ["good.example.com"],
+        }
+        extra = {"authmechanismproperties": props}
+        credentials = _build_credentials_tuple("MONGODB-OIDC", None, "user", None, extra, "test")
+
+        authenticator = _get_authenticator(credentials, ("good.example.com", 27017))
+        self.assertIs(authenticator, credentials.cache.data)
+
+        with self.assertRaisesRegex(ConfigurationError, "evil.example.com"):
+            _get_authenticator(credentials, ("evil.example.com", 27017))
+
+
 class TestAuthOIDCHuman(OIDCTestBase):
     uri: str