search

pharo-nosql / mongotalk

A Pharo driver for MongoDB
MIT License
19 stars 13 forks source link

Mongo should use SCRAM authentication by default #84

Closed tinchodias closed 3 years ago

tinchodias commented 3 years ago

Hello, mongo doc states that SCRAM is the default mechanism in 4.0. (Source: https://docs.mongodb.com/v4.0/core/authentication/#authentication-mechanisms).

Also, our current default mechanism (MONGODB-CR) was removed in 4.0:

Important

Starting in version 4.0, MongoDB removes support for the deprecated MongoDB Challenge-Response (MONGODB-CR) authentication mechanism.

If you have user credentials stored in MONGODB-CR, you must upgrade to Salted Challenge Response Authentication Mechanism (SCRAM) before you upgrade to version 4.0.

Source: https://docs.mongodb.com/v4.0/release-notes/3.0-scram/

We can still keep support for MONGODB-CR, but our Mongo shouldn't have such option as the default. To use SCRAM as default, the method Mongo class>>#defaultAuthMechanismClass should answer SCRAMSHA1AuthMechanism instead of MONGODBCRAuthMechanism.