Skip to content

Commit

Permalink
PYTHON-3601 OIDC: Fix documentation example and remove EKS section (#…
Browse files Browse the repository at this point in the history
  • Loading branch information
blink1073 authored Apr 24, 2024
1 parent b5e54aa commit b6f0081
Showing 1 changed file with 1 addition and 28 deletions.
29 changes: 1 addition & 28 deletions doc/examples/authentication.rst
Original file line number Diff line number Diff line change
Expand Up @@ -455,32 +455,6 @@ Custom Callbacks
For environments that are not directly supported by the driver, you can use :class:`~pymongo.auth_oidc.OIDCCallback`.
Some examples are given below.

AWS EKS
^^^^^^^

For an EKS Cluster with a configured `IAM OIDC provider`_, the token can be read from a path given by
the ``AWS_WEB_IDENTITY_TOKEN_FILE`` environment variable.

.. code-block:: python
import os
from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
class MyCallback(OIDCCallback):
def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
with open(os.environ["AWS_WEB_IDENTITY_TOKEN_FILE"]) as fid:
token = fid.read()
return OIDCCallbackResult(access_token=token)
uri = os.environ["MONGODB_URI"]
props = {"OIDC_CALLBACK": MyCallback()}
c = MongoClient(uri, authMechanism="MONGODB-OIDC", authMechanismProperties=props)
c.test.test.insert_one({})
c.close()
Other Azure Environments
^^^^^^^^^^^^^^^^^^^^^^^^

Expand Down Expand Up @@ -510,7 +484,7 @@ managed identity.
props = {"OIDC_CALLBACK": MyCallback()}
c = MongoClient(uri, authMechanismProperties=props)
c = MongoClient(uri, authMechanism="MONGODB-OIDC", authMechanismProperties=props)
c.test.test.insert_one({})
c.close()
Expand Down Expand Up @@ -543,6 +517,5 @@ service account token file location.
.. _Azure Internal Metadata Service: https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service
.. _configured on your MongoDB deployment: https://www.mongodb.com/docs/manual/reference/parameters/#mongodb-parameter-param.oidcIdentityProviders
.. _GCP Internal Metadata Service: https://cloud.google.com/compute/docs/metadata/querying-metadata
.. _IAM OIDC provider: https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
.. _azure-identity package: https://pypi.org/project/azure-identity/
.. _configured service account: https://cloud.google.com/kubernetes-engine/docs/how-to/service-accounts

0 comments on commit b6f0081

Please sign in to comment.