agentic-community / agentic-community/mcp-gateway-registry
Upgrade AWS DocumentDB authentication to SCRAM-SHA-256
- 主要语言
- Python
- 星标
- 912
- 派生
- 234
- 平均合并
- 1 天 11 小时
- 30 天内合并 PR
- 62
描述
## Background
AWS DocumentDB v5.0 currently only supports SCRAM-SHA-1 and MONGODB-AWS authentication mechanisms. SCRAM-SHA-256 is the more secure and modern authentication method introduced in MongoDB 4.0+.
## Current Implementation
As implemented in PR #335 (related to #334), we have:
- ✅ MongoDB Community Edition 8.2+: Using SCRAM-SHA-256
- ⚠️ AWS DocumentDB v5.0: Using SCRAM-SHA-1 (current limitation)
The system uses conditional authentication based on the `STORAGE_BACKEND` environment variable:
- `STORAGE_BACKEND=mongodb-ce` → SCRAM-SHA-256
- `STORAGE_BACKEND=documentdb` → SCRAM-SHA-1
## Security Concern
SCRAM-SHA-1 is considered less secure than SCRAM-SHA-256:
- SHA-1 has known weaknesses and is deprecated in many security contexts
- SCRAM-SHA-256 provides stronger cryptographic guarantees
- Industry best practice is to use SHA-256 or stronger hashing algorithms
## Proposed Solution
Upgrade AWS DocumentDB authentication to SCRAM-SHA-256 when one of the following becomes available:
1. **Option A**: AWS DocumentDB adds native SCRAM-SHA-256 support
- Monitor AWS DocumentDB release notes for SCRAM-SHA-256 support
- Update authentication mechanism when available
2. **Option B**: Upgrade to AWS DocumentDB v6.0+ (when released)
- Verify if newer versions support SCRAM-SHA-256
- Plan migration to newer DocumentDB version
3. **Option C**: Consider alternative authentication
- Evaluate MONGODB-AWS authentication mechanism (already supported by DocumentDB)
- Assess if IAM-based authentication meets security requirements
## Implementation Tasks
When DocumentDB SCRAM-SHA-256 becomes available:
- [ ] Update `registry/repositories/documentdb/client.py` to use SCRAM-SHA-256 for DocumentDB
- [ ] Remove conditional SCRAM logic (use SCRAM-SHA-256 for all backends)
- [ ] Update all initialization and utility scripts
- [ ] Test authentication with DocumentDB using SCRAM-SHA-256
- [ ] Update documentation
## References
- Original issue: #334
- Implementation PR: #335
- AWS DocumentDB supported authentication: https://docs.aws.amazon.com/documentdb/latest/developerguide/security-authentication.html
- MongoDB SCRAM documentation: https://www.mongodb.com/docs/manual/core/security-scram/
## Priority
This is a security improvement that should be implemented when technically feasible. Current SCRAM-SHA-1 implementation is functional but uses a weaker hashing algorithm than industry best practice recommends.
贡献指南
评估
这个 Issue 还没有评估数据。