Merge pull request pandas-dev#34 from manahl/bugfix/MDP-341-authorization-error-seen-in-prod-2

MDP-341 The connectionInfo document format changed in later mongods

Author: mildbyte

CHANGES.md

@@ -1,6 +1,11 @@
 
 ## Changelog
 
+### 1.8 (2015-09-29)
+
+  * Bugfix: compatibility with both 3.0 and pre-3.0 MongoDB for
+    querying current authentications
+
 ### 1.7 (2015-09-18)
 
   * Feature: Add support for reading a subset of a pandas DataFrame

arctic/arctic.py

@@ -326,6 +326,10 @@ def _parse_db_lib(clz, library):
             database_name = clz.DB_PREFIX
         return database_name, library
 
+    def _is_authenticated_to(self, db_name, auth_users_doc):
+        # First try userSource to find the database (mongo 2.4), then db (later mongos)
+        return any(r.get('userSource', r.get('db')) == db_name for r in auth_users_doc)
+
     def __init__(self, arctic, library):
         self.arctic = arctic
         database_name, library = self._parse_db_lib(library)
@@ -334,11 +338,11 @@ def __init__(self, arctic, library):
         self._db = self.arctic._conn[database_name]
         self._auth(self._db)
 
-        auth_users = self._db.command({'connectionStatus': 1})['authInfo']['authenticatedUsers']
-        if all((r['userSource'] != self._db.name for r in auth_users)):
+        auth_users_doc = self._db.command({'connectionStatus': 1})['authInfo']['authenticatedUsers']
+        if not self._is_authenticated_to(self._db.name, auth_users_doc):
             # We're not authenticated to the database,
             # ensure we are authed to admin so that we can at least read from it
-            if all((r['userSource'] != 'admin' for r in auth_users)):
+            if not self._is_authenticated_to('admin', auth_users_doc):
                 self._auth(self.arctic._adminDB)
 
         self._library_coll = self._db[library]

tests/unit/test_arctic.py

@@ -21,10 +21,14 @@ def test_arctic_lazy_init():
             store.list_libraries()
             assert mc.called
 
-mock_conn_info = {u'authInfo': 
+mock_conn_info_mongo2 = {u'authInfo':
                   {u'authenticatedUsers': [{u'user': u'research', u'userSource': u'admin'}]},
                   u'ok': 1.0}
 
+mock_conn_info_mongo3 = {u'authInfo':
+                  {u'authenticatedUsers': [{u'user': u'research', u'db': u'admin'}]},
+                  u'ok': 1.0}
+
 mock_conn_info_empty = {u'authInfo':
                   {u'authenticatedUsers': []},
                   u'ok': 1.0}
@@ -46,7 +50,7 @@ def test_arctic_auth():
                 with patch('arctic.arctic.ArcticLibraryBinding.get_library_type', return_value=None, autospec=True):
                     ga.return_value = Credential('db', 'user', 'pass')
                     store._conn['arctic_jblackburn'].name = 'arctic_jblackburn'
-                    store._conn['arctic_jblackburn'].command.return_value = mock_conn_info
+                    store._conn['arctic_jblackburn'].command.return_value = mock_conn_info_mongo2
                     store['jblackburn.library']
 
             # Creating the library will have attempted to auth against it
@@ -70,7 +74,7 @@ def test_arctic_auth_custom_app_name():
                 with patch('arctic.arctic.ArcticLibraryBinding.get_library_type', return_value=None, autospec=True):
                     ga.return_value = Credential('db', 'user', 'pass')
                     store._conn['arctic_jblackburn'].name = 'arctic_jblackburn'
-                    store._conn['arctic_jblackburn'].command.return_value = mock_conn_info
+                    store._conn['arctic_jblackburn'].command.return_value = mock_conn_info_mongo2
                     store['jblackburn.library']
 
             # Creating the library will have attempted to auth against it
@@ -102,6 +106,13 @@ def test_arctic_auth_admin_reauth():
                                          call('cluster', 'arctic', store._adminDB.name)]
 
 
+def test_arctic_is_authenticated_to():
+    self = create_autospec(ArcticLibraryBinding)
+    assert ArcticLibraryBinding._is_authenticated_to(self, 'admin', mock_conn_info_mongo2['authInfo']['authenticatedUsers'])
+    assert ArcticLibraryBinding._is_authenticated_to(self, 'admin', mock_conn_info_mongo3['authInfo']['authenticatedUsers'])
+    assert not ArcticLibraryBinding._is_authenticated_to(self, 'admin', mock_conn_info_empty['authInfo']['authenticatedUsers'])
+
+
 def test_arctic_connect_hostname():
     with patch('pymongo.MongoClient', return_value=MagicMock(), autospec=True) as mc, \
          patch('arctic.arctic.mongo_retry', autospec=True) as ar, \