First Commit

node_modules/mongodb/lib/core/auth/auth_provider.js

@@ -0,0 +1,158 @@
+'use strict';
+
+const MongoError = require('../error').MongoError;
+
+/**
+ * Creates a new AuthProvider, which dictates how to authenticate for a given
+ * mechanism.
+ * @class
+ */
+class AuthProvider {
+  constructor(bson) {
+    this.bson = bson;
+    this.authStore = [];
+  }
+
+  /**
+   * Authenticate
+   * @method
+   * @param {SendAuthCommand} sendAuthCommand Writes an auth command directly to a specific connection
+   * @param {Connection[]} connections Connections to authenticate using this authenticator
+   * @param {MongoCredentials} credentials Authentication credentials
+   * @param {authResultCallback} callback The callback to return the result from the authentication
+   */
+  auth(sendAuthCommand, connections, credentials, callback) {
+    // Total connections
+    let count = connections.length;
+
+    if (count === 0) {
+      callback(null, null);
+      return;
+    }
+
+    // Valid connections
+    let numberOfValidConnections = 0;
+    let errorObject = null;
+
+    const execute = connection => {
+      this._authenticateSingleConnection(sendAuthCommand, connection, credentials, (err, r) => {
+        // Adjust count
+        count = count - 1;
+
+        // If we have an error
+        if (err) {
+          errorObject = new MongoError(err);
+        } else if (r && (r.$err || r.errmsg)) {
+          errorObject = new MongoError(r);
+        } else {
+          numberOfValidConnections = numberOfValidConnections + 1;
+        }
+
+        // Still authenticating against other connections.
+        if (count !== 0) {
+          return;
+        }
+
+        // We have authenticated all connections
+        if (numberOfValidConnections > 0) {
+          // Store the auth details
+          this.addCredentials(credentials);
+          // Return correct authentication
+          callback(null, true);
+        } else {
+          if (errorObject == null) {
+            errorObject = new MongoError(`failed to authenticate using ${credentials.mechanism}`);
+          }
+          callback(errorObject, false);
+        }
+      });
+    };
+
+    const executeInNextTick = _connection => process.nextTick(() => execute(_connection));
+
+    // For each connection we need to authenticate
+    while (connections.length > 0) {
+      executeInNextTick(connections.shift());
+    }
+  }
+
+  /**
+   * Implementation of a single connection authenticating. Is meant to be overridden.
+   * Will error if called directly
+   * @ignore
+   */
+  _authenticateSingleConnection(/*sendAuthCommand, connection, credentials, callback*/) {
+    throw new Error('_authenticateSingleConnection must be overridden');
+  }
+
+  /**
+   * Adds credentials to store only if it does not exist
+   * @param {MongoCredentials} credentials credentials to add to store
+   */
+  addCredentials(credentials) {
+    const found = this.authStore.some(cred => cred.equals(credentials));
+
+    if (!found) {
+      this.authStore.push(credentials);
+    }
+  }
+
+  /**
+   * Re authenticate pool
+   * @method
+   * @param {SendAuthCommand} sendAuthCommand Writes an auth command directly to a specific connection
+   * @param {Connection[]} connections Connections to authenticate using this authenticator
+   * @param {authResultCallback} callback The callback to return the result from the authentication
+   */
+  reauthenticate(sendAuthCommand, connections, callback) {
+    const authStore = this.authStore.slice(0);
+    let count = authStore.length;
+    if (count === 0) {
+      return callback(null, null);
+    }
+
+    for (let i = 0; i < authStore.length; i++) {
+      this.auth(sendAuthCommand, connections, authStore[i], function(err) {
+        count = count - 1;
+        if (count === 0) {
+          callback(err, null);
+        }
+      });
+    }
+  }
+
+  /**
+   * Remove credentials that have been previously stored in the auth provider
+   * @method
+   * @param {string} source Name of database we are removing authStore details about
+   * @return {object}
+   */
+  logout(source) {
+    this.authStore = this.authStore.filter(credentials => credentials.source !== source);
+  }
+}
+
+/**
+ * A function that writes authentication commands to a specific connection
+ * @callback SendAuthCommand
+ * @param {Connection} connection The connection to write to
+ * @param {Command} command A command with a toBin method that can be written to a connection
+ * @param {AuthWriteCallback} callback Callback called when command response is received
+ */
+
+/**
+ * A callback for a specific auth command
+ * @callback AuthWriteCallback
+ * @param {Error} err If command failed, an error from the server
+ * @param {object} r The response from the server
+ */
+
+/**
+ * This is a result from an authentication strategy
+ *
+ * @callback authResultCallback
+ * @param {error} error An error object. Set to null if no error present
+ * @param {boolean} result The result of the authentication process
+ */
+
+module.exports = { AuthProvider };

node_modules/mongodb/lib/core/auth/defaultAuthProviders.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const MongoCR = require('./mongocr');
+const X509 = require('./x509');
+const Plain = require('./plain');
+const GSSAPI = require('./gssapi');
+const SSPI = require('./sspi');
+const ScramSHA1 = require('./scram').ScramSHA1;
+const ScramSHA256 = require('./scram').ScramSHA256;
+
+/**
+ * Returns the default authentication providers.
+ *
+ * @param {BSON} bson Bson definition
+ * @returns {Object} a mapping of auth names to auth types
+ */
+function defaultAuthProviders(bson) {
+  return {
+    mongocr: new MongoCR(bson),
+    x509: new X509(bson),
+    plain: new Plain(bson),
+    gssapi: new GSSAPI(bson),
+    sspi: new SSPI(bson),
+    'scram-sha-1': new ScramSHA1(bson),
+    'scram-sha-256': new ScramSHA256(bson)
+  };
+}
+
+module.exports = { defaultAuthProviders };

node_modules/mongodb/lib/core/auth/gssapi.js

@@ -0,0 +1,241 @@
+'use strict';
+
+const AuthProvider = require('./auth_provider').AuthProvider;
+const retrieveKerberos = require('../utils').retrieveKerberos;
+let kerberos;
+
+/**
+ * Creates a new GSSAPI authentication mechanism
+ * @class
+ * @extends AuthProvider
+ */
+class GSSAPI extends AuthProvider {
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    const source = credentials.source;
+    const username = credentials.username;
+    const password = credentials.password;
+    const mechanismProperties = credentials.mechanismProperties;
+    const gssapiServiceName =
+      mechanismProperties['gssapiservicename'] ||
+      mechanismProperties['gssapiServiceName'] ||
+      'mongodb';
+
+    GSSAPIInitialize(
+      this,
+      kerberos.processes.MongoAuthProcess,
+      source,
+      username,
+      password,
+      source,
+      gssapiServiceName,
+      sendAuthCommand,
+      connection,
+      mechanismProperties,
+      callback
+    );
+  }
+
+  /**
+   * Authenticate
+   * @override
+   * @method
+   */
+  auth(sendAuthCommand, connections, credentials, callback) {
+    if (kerberos == null) {
+      try {
+        kerberos = retrieveKerberos();
+      } catch (e) {
+        return callback(e, null);
+      }
+    }
+
+    super.auth(sendAuthCommand, connections, credentials, callback);
+  }
+}
+
+//
+// Initialize step
+var GSSAPIInitialize = function(
+  self,
+  MongoAuthProcess,
+  db,
+  username,
+  password,
+  authdb,
+  gssapiServiceName,
+  sendAuthCommand,
+  connection,
+  options,
+  callback
+) {
+  // Create authenticator
+  var mongo_auth_process = new MongoAuthProcess(
+    connection.host,
+    connection.port,
+    gssapiServiceName,
+    options
+  );
+
+  // Perform initialization
+  mongo_auth_process.init(username, password, function(err) {
+    if (err) return callback(err, false);
+
+    // Perform the first step
+    mongo_auth_process.transition('', function(err, payload) {
+      if (err) return callback(err, false);
+
+      // Call the next db step
+      MongoDBGSSAPIFirstStep(
+        self,
+        mongo_auth_process,
+        payload,
+        db,
+        username,
+        password,
+        authdb,
+        sendAuthCommand,
+        connection,
+        callback
+      );
+    });
+  });
+};
+
+//
+// Perform first step against mongodb
+var MongoDBGSSAPIFirstStep = function(
+  self,
+  mongo_auth_process,
+  payload,
+  db,
+  username,
+  password,
+  authdb,
+  sendAuthCommand,
+  connection,
+  callback
+) {
+  // Build the sasl start command
+  var command = {
+    saslStart: 1,
+    mechanism: 'GSSAPI',
+    payload: payload,
+    autoAuthorize: 1
+  };
+
+  // Write the commmand on the connection
+  sendAuthCommand(connection, '$external.$cmd', command, (err, doc) => {
+    if (err) return callback(err, false);
+    // Execute mongodb transition
+    mongo_auth_process.transition(doc.payload, function(err, payload) {
+      if (err) return callback(err, false);
+
+      // MongoDB API Second Step
+      MongoDBGSSAPISecondStep(
+        self,
+        mongo_auth_process,
+        payload,
+        doc,
+        db,
+        username,
+        password,
+        authdb,
+        sendAuthCommand,
+        connection,
+        callback
+      );
+    });
+  });
+};
+
+//
+// Perform first step against mongodb
+var MongoDBGSSAPISecondStep = function(
+  self,
+  mongo_auth_process,
+  payload,
+  doc,
+  db,
+  username,
+  password,
+  authdb,
+  sendAuthCommand,
+  connection,
+  callback
+) {
+  // Build Authentication command to send to MongoDB
+  var command = {
+    saslContinue: 1,
+    conversationId: doc.conversationId,
+    payload: payload
+  };
+
+  // Execute the command
+  // Write the commmand on the connection
+  sendAuthCommand(connection, '$external.$cmd', command, (err, doc) => {
+    if (err) return callback(err, false);
+    // Call next transition for kerberos
+    mongo_auth_process.transition(doc.payload, function(err, payload) {
+      if (err) return callback(err, false);
+
+      // Call the last and third step
+      MongoDBGSSAPIThirdStep(
+        self,
+        mongo_auth_process,
+        payload,
+        doc,
+        db,
+        username,
+        password,
+        authdb,
+        sendAuthCommand,
+        connection,
+        callback
+      );
+    });
+  });
+};
+
+var MongoDBGSSAPIThirdStep = function(
+  self,
+  mongo_auth_process,
+  payload,
+  doc,
+  db,
+  username,
+  password,
+  authdb,
+  sendAuthCommand,
+  connection,
+  callback
+) {
+  // Build final command
+  var command = {
+    saslContinue: 1,
+    conversationId: doc.conversationId,
+    payload: payload
+  };
+
+  // Execute the command
+  sendAuthCommand(connection, '$external.$cmd', command, (err, r) => {
+    if (err) return callback(err, false);
+    mongo_auth_process.transition(null, function(err) {
+      if (err) return callback(err, null);
+      callback(null, r);
+    });
+  });
+};
+
+/**
+ * This is a result from a authentication strategy
+ *
+ * @callback authResultCallback
+ * @param {error} error An error object. Set to null if no error present
+ * @param {boolean} result The result of the authentication process
+ */
+
+module.exports = GSSAPI;

node_modules/mongodb/lib/core/auth/mongo_credentials.js

@@ -0,0 +1,81 @@
+'use strict';
+
+// Resolves the default auth mechanism according to
+// https://github.com/mongodb/specifications/blob/master/source/auth/auth.rst
+function getDefaultAuthMechanism(ismaster) {
+  if (ismaster) {
+    // If ismaster contains saslSupportedMechs, use scram-sha-256
+    // if it is available, else scram-sha-1
+    if (Array.isArray(ismaster.saslSupportedMechs)) {
+      return ismaster.saslSupportedMechs.indexOf('SCRAM-SHA-256') >= 0
+        ? 'scram-sha-256'
+        : 'scram-sha-1';
+    }
+
+    // Fallback to legacy selection method. If wire version >= 3, use scram-sha-1
+    if (ismaster.maxWireVersion >= 3) {
+      return 'scram-sha-1';
+    }
+  }
+
+  // Default for wireprotocol < 3
+  return 'mongocr';
+}
+
+/**
+ * A representation of the credentials used by MongoDB
+ * @class
+ * @property {string} mechanism The method used to authenticate
+ * @property {string} [username] The username used for authentication
+ * @property {string} [password] The password used for authentication
+ * @property {string} [source] The database that the user should authenticate against
+ * @property {object} [mechanismProperties] Special properties used by some types of auth mechanisms
+ */
+class MongoCredentials {
+  /**
+   * Creates a new MongoCredentials object
+   * @param {object} [options]
+   * @param {string} [options.username] The username used for authentication
+   * @param {string} [options.password] The password used for authentication
+   * @param {string} [options.source] The database that the user should authenticate against
+   * @param {string} [options.mechanism] The method used to authenticate
+   * @param {object} [options.mechanismProperties] Special properties used by some types of auth mechanisms
+   */
+  constructor(options) {
+    options = options || {};
+    this.username = options.username;
+    this.password = options.password;
+    this.source = options.source || options.db;
+    this.mechanism = options.mechanism || 'default';
+    this.mechanismProperties = options.mechanismProperties;
+  }
+
+  /**
+   * Determines if two MongoCredentials objects are equivalent
+   * @param {MongoCredentials} other another MongoCredentials object
+   * @returns {boolean} true if the two objects are equal.
+   */
+  equals(other) {
+    return (
+      this.mechanism === other.mechanism &&
+      this.username === other.username &&
+      this.password === other.password &&
+      this.source === other.source
+    );
+  }
+
+  /**
+   * If the authentication mechanism is set to "default", resolves the authMechanism
+   * based on the server version and server supported sasl mechanisms.
+   *
+   * @param {Object} [ismaster] An ismaster response from the server
+   */
+  resolveAuthMechanism(ismaster) {
+    // If the mechanism is not "default", then it does not need to be resolved
+    if (this.mechanism.toLowerCase() === 'default') {
+      this.mechanism = getDefaultAuthMechanism(ismaster);
+    }
+  }
+}
+
+module.exports = { MongoCredentials };

node_modules/mongodb/lib/core/auth/mongocr.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const crypto = require('crypto');
+const AuthProvider = require('./auth_provider').AuthProvider;
+
+/**
+ * Creates a new MongoCR authentication mechanism
+ *
+ * @extends AuthProvider
+ */
+class MongoCR extends AuthProvider {
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    const username = credentials.username;
+    const password = credentials.password;
+    const source = credentials.source;
+
+    sendAuthCommand(connection, `${source}.$cmd`, { getnonce: 1 }, (err, r) => {
+      let nonce = null;
+      let key = null;
+
+      // Get nonce
+      if (err == null) {
+        nonce = r.nonce;
+        // Use node md5 generator
+        let md5 = crypto.createHash('md5');
+        // Generate keys used for authentication
+        md5.update(username + ':mongo:' + password, 'utf8');
+        const hash_password = md5.digest('hex');
+        // Final key
+        md5 = crypto.createHash('md5');
+        md5.update(nonce + username + hash_password, 'utf8');
+        key = md5.digest('hex');
+      }
+
+      const authenticateCommand = {
+        authenticate: 1,
+        user: username,
+        nonce,
+        key
+      };
+
+      sendAuthCommand(connection, `${source}.$cmd`, authenticateCommand, callback);
+    });
+  }
+}
+
+module.exports = MongoCR;

node_modules/mongodb/lib/core/auth/plain.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const retrieveBSON = require('../connection/utils').retrieveBSON;
+const AuthProvider = require('./auth_provider').AuthProvider;
+
+// TODO: can we get the Binary type from this.bson instead?
+const BSON = retrieveBSON();
+const Binary = BSON.Binary;
+
+/**
+ * Creates a new Plain authentication mechanism
+ *
+ * @extends AuthProvider
+ */
+class Plain extends AuthProvider {
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    const username = credentials.username;
+    const password = credentials.password;
+    const payload = new Binary(`\x00${username}\x00${password}`);
+    const command = {
+      saslStart: 1,
+      mechanism: 'PLAIN',
+      payload: payload,
+      autoAuthorize: 1
+    };
+
+    sendAuthCommand(connection, '$external.$cmd', command, callback);
+  }
+}
+
+module.exports = Plain;

node_modules/mongodb/lib/core/auth/scram.js

@@ -0,0 +1,293 @@
+'use strict';
+
+const crypto = require('crypto');
+const Buffer = require('safe-buffer').Buffer;
+const retrieveBSON = require('../connection/utils').retrieveBSON;
+const MongoError = require('../error').MongoError;
+const AuthProvider = require('./auth_provider').AuthProvider;
+
+const BSON = retrieveBSON();
+const Binary = BSON.Binary;
+
+let saslprep;
+try {
+  saslprep = require('saslprep');
+} catch (e) {
+  // don't do anything;
+}
+
+var parsePayload = function(payload) {
+  var dict = {};
+  var parts = payload.split(',');
+
+  for (var i = 0; i < parts.length; i++) {
+    var valueParts = parts[i].split('=');
+    dict[valueParts[0]] = valueParts[1];
+  }
+
+  return dict;
+};
+
+var passwordDigest = function(username, password) {
+  if (typeof username !== 'string') throw new MongoError('username must be a string');
+  if (typeof password !== 'string') throw new MongoError('password must be a string');
+  if (password.length === 0) throw new MongoError('password cannot be empty');
+  // Use node md5 generator
+  var md5 = crypto.createHash('md5');
+  // Generate keys used for authentication
+  md5.update(username + ':mongo:' + password, 'utf8');
+  return md5.digest('hex');
+};
+
+// XOR two buffers
+function xor(a, b) {
+  if (!Buffer.isBuffer(a)) a = Buffer.from(a);
+  if (!Buffer.isBuffer(b)) b = Buffer.from(b);
+  const length = Math.max(a.length, b.length);
+  const res = [];
+
+  for (let i = 0; i < length; i += 1) {
+    res.push(a[i] ^ b[i]);
+  }
+
+  return Buffer.from(res).toString('base64');
+}
+
+function H(method, text) {
+  return crypto
+    .createHash(method)
+    .update(text)
+    .digest();
+}
+
+function HMAC(method, key, text) {
+  return crypto
+    .createHmac(method, key)
+    .update(text)
+    .digest();
+}
+
+var _hiCache = {};
+var _hiCacheCount = 0;
+var _hiCachePurge = function() {
+  _hiCache = {};
+  _hiCacheCount = 0;
+};
+
+const hiLengthMap = {
+  sha256: 32,
+  sha1: 20
+};
+
+function HI(data, salt, iterations, cryptoMethod) {
+  // omit the work if already generated
+  const key = [data, salt.toString('base64'), iterations].join('_');
+  if (_hiCache[key] !== undefined) {
+    return _hiCache[key];
+  }
+
+  // generate the salt
+  const saltedData = crypto.pbkdf2Sync(
+    data,
+    salt,
+    iterations,
+    hiLengthMap[cryptoMethod],
+    cryptoMethod
+  );
+
+  // cache a copy to speed up the next lookup, but prevent unbounded cache growth
+  if (_hiCacheCount >= 200) {
+    _hiCachePurge();
+  }
+
+  _hiCache[key] = saltedData;
+  _hiCacheCount += 1;
+  return saltedData;
+}
+
+/**
+ * Creates a new ScramSHA authentication mechanism
+ * @class
+ * @extends AuthProvider
+ */
+class ScramSHA extends AuthProvider {
+  constructor(bson, cryptoMethod) {
+    super(bson);
+    this.cryptoMethod = cryptoMethod || 'sha1';
+  }
+
+  static _getError(err, r) {
+    if (err) {
+      return err;
+    }
+
+    if (r.$err || r.errmsg) {
+      return new MongoError(r);
+    }
+  }
+
+  /**
+   * @ignore
+   */
+  _executeScram(sendAuthCommand, connection, credentials, nonce, callback) {
+    let username = credentials.username;
+    const password = credentials.password;
+    const db = credentials.source;
+
+    const cryptoMethod = this.cryptoMethod;
+    let mechanism = 'SCRAM-SHA-1';
+    let processedPassword;
+
+    if (cryptoMethod === 'sha256') {
+      mechanism = 'SCRAM-SHA-256';
+
+      processedPassword = saslprep ? saslprep(password) : password;
+    } else {
+      try {
+        processedPassword = passwordDigest(username, password);
+      } catch (e) {
+        return callback(e);
+      }
+    }
+
+    // Clean up the user
+    username = username.replace('=', '=3D').replace(',', '=2C');
+
+    // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
+    // Since the username is not sasl-prep-d, we need to do this here.
+    const firstBare = Buffer.concat([
+      Buffer.from('n=', 'utf8'),
+      Buffer.from(username, 'utf8'),
+      Buffer.from(',r=', 'utf8'),
+      Buffer.from(nonce, 'utf8')
+    ]);
+
+    // Build command structure
+    const saslStartCmd = {
+      saslStart: 1,
+      mechanism,
+      payload: new Binary(Buffer.concat([Buffer.from('n,,', 'utf8'), firstBare])),
+      autoAuthorize: 1
+    };
+
+    // Write the commmand on the connection
+    sendAuthCommand(connection, `${db}.$cmd`, saslStartCmd, (err, r) => {
+      let tmpError = ScramSHA._getError(err, r);
+      if (tmpError) {
+        return callback(tmpError, null);
+      }
+
+      const payload = Buffer.isBuffer(r.payload) ? new Binary(r.payload) : r.payload;
+      const dict = parsePayload(payload.value());
+      const iterations = parseInt(dict.i, 10);
+      const salt = dict.s;
+      const rnonce = dict.r;
+
+      // Set up start of proof
+      const withoutProof = `c=biws,r=${rnonce}`;
+      const saltedPassword = HI(
+        processedPassword,
+        Buffer.from(salt, 'base64'),
+        iterations,
+        cryptoMethod
+      );
+
+      if (iterations && iterations < 4096) {
+        const error = new MongoError(`Server returned an invalid iteration count ${iterations}`);
+        return callback(error, false);
+      }
+
+      const clientKey = HMAC(cryptoMethod, saltedPassword, 'Client Key');
+      const storedKey = H(cryptoMethod, clientKey);
+      const authMessage = [firstBare, payload.value().toString('base64'), withoutProof].join(',');
+
+      const clientSignature = HMAC(cryptoMethod, storedKey, authMessage);
+      const clientProof = `p=${xor(clientKey, clientSignature)}`;
+      const clientFinal = [withoutProof, clientProof].join(',');
+      const saslContinueCmd = {
+        saslContinue: 1,
+        conversationId: r.conversationId,
+        payload: new Binary(Buffer.from(clientFinal))
+      };
+
+      sendAuthCommand(connection, `${db}.$cmd`, saslContinueCmd, (err, r) => {
+        if (!r || r.done !== false) {
+          return callback(err, r);
+        }
+
+        const retrySaslContinueCmd = {
+          saslContinue: 1,
+          conversationId: r.conversationId,
+          payload: Buffer.alloc(0)
+        };
+
+        sendAuthCommand(connection, `${db}.$cmd`, retrySaslContinueCmd, callback);
+      });
+    });
+  }
+
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    // Create a random nonce
+    crypto.randomBytes(24, (err, buff) => {
+      if (err) {
+        return callback(err, null);
+      }
+
+      return this._executeScram(
+        sendAuthCommand,
+        connection,
+        credentials,
+        buff.toString('base64'),
+        callback
+      );
+    });
+  }
+
+  /**
+   * Authenticate
+   * @override
+   * @method
+   */
+  auth(sendAuthCommand, connections, credentials, callback) {
+    this._checkSaslprep();
+    super.auth(sendAuthCommand, connections, credentials, callback);
+  }
+
+  _checkSaslprep() {
+    const cryptoMethod = this.cryptoMethod;
+
+    if (cryptoMethod === 'sha256') {
+      if (!saslprep) {
+        console.warn('Warning: no saslprep library specified. Passwords will not be sanitized');
+      }
+    }
+  }
+}
+
+/**
+ * Creates a new ScramSHA1 authentication mechanism
+ * @class
+ * @extends ScramSHA
+ */
+class ScramSHA1 extends ScramSHA {
+  constructor(bson) {
+    super(bson, 'sha1');
+  }
+}
+
+/**
+ * Creates a new ScramSHA256 authentication mechanism
+ * @class
+ * @extends ScramSHA
+ */
+class ScramSHA256 extends ScramSHA {
+  constructor(bson) {
+    super(bson, 'sha256');
+  }
+}
+
+module.exports = { ScramSHA1, ScramSHA256 };

node_modules/mongodb/lib/core/auth/sspi.js

@@ -0,0 +1,131 @@
+'use strict';
+
+const AuthProvider = require('./auth_provider').AuthProvider;
+const retrieveKerberos = require('../utils').retrieveKerberos;
+let kerberos;
+
+/**
+ * Creates a new SSPI authentication mechanism
+ * @class
+ * @extends AuthProvider
+ */
+class SSPI extends AuthProvider {
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    // TODO: Destructure this
+    const username = credentials.username;
+    const password = credentials.password;
+    const mechanismProperties = credentials.mechanismProperties;
+    const gssapiServiceName =
+      mechanismProperties['gssapiservicename'] ||
+      mechanismProperties['gssapiServiceName'] ||
+      'mongodb';
+
+    SSIPAuthenticate(
+      this,
+      kerberos.processes.MongoAuthProcess,
+      username,
+      password,
+      gssapiServiceName,
+      sendAuthCommand,
+      connection,
+      mechanismProperties,
+      callback
+    );
+  }
+
+  /**
+   * Authenticate
+   * @override
+   * @method
+   */
+  auth(sendAuthCommand, connections, credentials, callback) {
+    if (kerberos == null) {
+      try {
+        kerberos = retrieveKerberos();
+      } catch (e) {
+        return callback(e, null);
+      }
+    }
+
+    super.auth(sendAuthCommand, connections, credentials, callback);
+  }
+}
+
+function SSIPAuthenticate(
+  self,
+  MongoAuthProcess,
+  username,
+  password,
+  gssapiServiceName,
+  sendAuthCommand,
+  connection,
+  options,
+  callback
+) {
+  const authProcess = new MongoAuthProcess(
+    connection.host,
+    connection.port,
+    gssapiServiceName,
+    options
+  );
+
+  function authCommand(command, authCb) {
+    sendAuthCommand(connection, '$external.$cmd', command, authCb);
+  }
+
+  authProcess.init(username, password, err => {
+    if (err) return callback(err, false);
+
+    authProcess.transition('', (err, payload) => {
+      if (err) return callback(err, false);
+
+      const command = {
+        saslStart: 1,
+        mechanism: 'GSSAPI',
+        payload,
+        autoAuthorize: 1
+      };
+
+      authCommand(command, (err, doc) => {
+        if (err) return callback(err, false);
+
+        authProcess.transition(doc.payload, (err, payload) => {
+          if (err) return callback(err, false);
+          const command = {
+            saslContinue: 1,
+            conversationId: doc.conversationId,
+            payload
+          };
+
+          authCommand(command, (err, doc) => {
+            if (err) return callback(err, false);
+
+            authProcess.transition(doc.payload, (err, payload) => {
+              if (err) return callback(err, false);
+              const command = {
+                saslContinue: 1,
+                conversationId: doc.conversationId,
+                payload
+              };
+
+              authCommand(command, (err, response) => {
+                if (err) return callback(err, false);
+
+                authProcess.transition(null, err => {
+                  if (err) return callback(err, null);
+                  callback(null, response);
+                });
+              });
+            });
+          });
+        });
+      });
+    });
+  });
+}
+
+module.exports = SSPI;

node_modules/mongodb/lib/core/auth/x509.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const AuthProvider = require('./auth_provider').AuthProvider;
+
+/**
+ * Creates a new X509 authentication mechanism
+ * @class
+ * @extends AuthProvider
+ */
+class X509 extends AuthProvider {
+  /**
+   * Implementation of authentication for a single connection
+   * @override
+   */
+  _authenticateSingleConnection(sendAuthCommand, connection, credentials, callback) {
+    const username = credentials.username;
+    const command = { authenticate: 1, mechanism: 'MONGODB-X509' };
+    if (username) {
+      command.user = username;
+    }
+
+    sendAuthCommand(connection, '$external.$cmd', command, callback);
+  }
+}
+
+module.exports = X509;