agentic-community / agentic-community/mcp-gateway-registry

Upgrade AWS DocumentDB authentication to SCRAM-SHA-256

未关闭
#336 0 条评论 0 个 reaction 已指派 1 人 已被 @aarora79 认领 在 GitHub 查看
authentication security technical-debt
主要语言
Python
星标
912
派生
234
平均合并
1 天 11 小时
30 天内合并 PR
62

描述

## Background

AWS DocumentDB v5.0 currently only supports SCRAM-SHA-1 and MONGODB-AWS authentication mechanisms. SCRAM-SHA-256 is the more secure and modern authentication method introduced in MongoDB 4.0+.

## Current Implementation

As implemented in PR #335 (related to #334), we have:
- ✅ MongoDB Community Edition 8.2+: Using SCRAM-SHA-256
- ⚠️ AWS DocumentDB v5.0: Using SCRAM-SHA-1 (current limitation)

The system uses conditional authentication based on the `STORAGE_BACKEND` environment variable:
- `STORAGE_BACKEND=mongodb-ce` → SCRAM-SHA-256
- `STORAGE_BACKEND=documentdb` → SCRAM-SHA-1

## Security Concern

SCRAM-SHA-1 is considered less secure than SCRAM-SHA-256:
- SHA-1 has known weaknesses and is deprecated in many security contexts
- SCRAM-SHA-256 provides stronger cryptographic guarantees
- Industry best practice is to use SHA-256 or stronger hashing algorithms

## Proposed Solution

Upgrade AWS DocumentDB authentication to SCRAM-SHA-256 when one of the following becomes available:

1. **Option A**: AWS DocumentDB adds native SCRAM-SHA-256 support
- Monitor AWS DocumentDB release notes for SCRAM-SHA-256 support
- Update authentication mechanism when available

2. **Option B**: Upgrade to AWS DocumentDB v6.0+ (when released)
- Verify if newer versions support SCRAM-SHA-256
- Plan migration to newer DocumentDB version

3. **Option C**: Consider alternative authentication
- Evaluate MONGODB-AWS authentication mechanism (already supported by DocumentDB)
- Assess if IAM-based authentication meets security requirements

## Implementation Tasks

When DocumentDB SCRAM-SHA-256 becomes available:
- [ ] Update `registry/repositories/documentdb/client.py` to use SCRAM-SHA-256 for DocumentDB
- [ ] Remove conditional SCRAM logic (use SCRAM-SHA-256 for all backends)
- [ ] Update all initialization and utility scripts
- [ ] Test authentication with DocumentDB using SCRAM-SHA-256
- [ ] Update documentation

## References

- Original issue: #334
- Implementation PR: #335
- AWS DocumentDB supported authentication: https://docs.aws.amazon.com/documentdb/latest/developerguide/security-authentication.html
- MongoDB SCRAM documentation: https://www.mongodb.com/docs/manual/core/security-scram/

## Priority

This is a security improvement that should be implemented when technically feasible. Current SCRAM-SHA-1 implementation is functional but uses a weaker hashing algorithm than industry best practice recommends.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。