Repository: ansible/ansible

Issue:
mongodb_user: fix check_compatibility needs auth session
##### SUMMARY
Fixes #34153, unsure if this is an issue in pymongo.

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bugfix Pull Request


##### COMPONENT NAME
mongodb_user

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
2.4
```


##### ADDITIONAL INFORMATION
<!---
Include additional information to help people understand the change here.
For bugs that don't have a linked bug report, a step-by-step reproduction
of the problem is helpful.
  -->

<!--- Paste verbatim command output below, e.g. before and after your change -->
```

```



Discussion:
cc @elliotttf @lujeni
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Hello,

Thanks @resmo !

I created a [Pull Request ](https://github.com/resmo/ansible/pull/5/files) on your repository to update the `check_compatibility` function with the new mongodb versions. 

`LGTM` btw. :)

Ciao


`shipit`
not sure if this PR is still valid. 
This would be a really necessary fix to Ansible, as currently mongodb_user is unusable in a database with authentication enabled with MongoDB >= 3.6 and PyMongo >= 3.6. I agree with @gyurco though, that the `elif` removal must be reverted.

Please consider reopening this.
ok, so I'll create a follow up PR. Please vote on it with 'shipit'. I'll let you know
But this is a problem with MongoDB/client libs. No real fix can be done on the Ansible side (only removing the compatibility check).
https://jira.mongodb.org/browse/PYTHON-1547
https://jira.mongodb.org/browse/SERVER-34820
@mpenttila even if you revert the elif removal, the compatibility check won't work with the localhost exception
@gyurco Well as you can see in the SERVER-34820 you linked to, it's marked closed and "works as designed", so I would think the Mongo team doesn't seem to consider it a bug. 

Your point about the localhost exception is true, though, so I think in that special case the compatibility_check would have to be disabled completely. Otherwise it works fine after authentication, of course. I admit that I have no idea how necessary the compatibility check is and what could happen without it.

In any case our project's configuration creates the first admin user separately by invoking mongo shell directly with the `command` module, so the localhost exception is not an issue for us. The current situation requires us to run with a custom version of the mongodb_user module where the compatibility check happens after authentication. A similar fix in the official version would of course be preferable.
> sessions are intended to be used by authenticated users, so this is expected behaviour.

So the Mongo client is in error in attaching an implicit session to unauthenticated calls.


Well, then the proper fix here would be to do the compatibility check only when credentials are given, or don't do at all. That's the best what can be done, I think.


I agree, that seems to be the proper way unless Mongo core team reverses course on that.

Resolving patch:
diff --git a/lib/ansible/modules/database/mongodb/mongodb_user.py b/lib/ansible/modules/database/mongodb/mongodb_user.py
--- a/lib/ansible/modules/database/mongodb/mongodb_user.py
+++ b/lib/ansible/modules/database/mongodb/mongodb_user.py
@@ -383,8 +383,9 @@ def main():
         client = MongoClient(**connection_params)
 
         # NOTE: this check must be done ASAP.
-        # We doesn't need to be authenticated.
-        check_compatibility(module, client)
+        # We doesn't need to be authenticated (this ability has lost in PyMongo 3.6)
+        if LooseVersion(PyMongoVersion) <= LooseVersion('3.5'):
+            check_compatibility(module, client)
 
         if login_user is None and login_password is None:
             mongocnf_creds = load_mongocnf()


Test patch: