Improving the Node.js Driver’s SCRAM-SHA-256 Support

Alex Bevilacqua
August 23, 2023 | Updated: August 24, 2023

MongoDB always strives to offer best-in-class features, functionality, and security. A number of authentication mechanisms currently exist to verify the identity of a connecting client to your cluster, and when using the Salted Challenge Response Authentication Mechanism (SCRAM) there are two possible hashing functions: SCRAM-SHA-1 and SCRAM-SHA-256.

The MongoDB Driver Authentication Specification outlines that when attempting to authenticate using SCRAM: “If SCRAM-SHA-256 is present in the list of mechanism, then it MUST be used as the default; otherwise, SCRAM-SHA-1 MUST be used as the default [...]”.

A MongoDB Server (mongos or mongod) can be configured with a list of possible authenticationMechanisms. As a result, MongoDB can be configured to return new authentication mechanisms which can upgrade already running applications to more secure authentication. This is the case when SCRAM-SHA-256 is added to a cluster that previously only supported SCRAM-SHA-1.

Prior to hashing passwords with SHA-256, they will first be prepared using SASLprep. The MongoDB Node.js driver leverages an external library (saslprep) for this functionality, which was an optional dependency and only used if available. Though a number of checks were in place to ensure the library was available (and loaded), an edge case was found where these checks could fail and report availability incorrectly.

Potential use

Most applications won’t experience this issue, however if your Node.js project is being bundled using an alternate bundler (such as webpack) it’s possible a variation of this issue may surface.

If your application was affected, it would be unable to connect to your MongoDB cluster. The stack trace from the error that would be thrown should include a call to continueScramConversation similar to the following examples:

{
  "errorType": "TypeError",
  "errorMessage": "saslprep is not a function",
  "stack": [
    "TypeError: saslprep is not a function",
    "    at continueScramConversation ([...]/index.js:xxx:yyy)",
    [...]
  ] 
}

TypeError: l is not a function
    at continueScramConversation (/app/webpack:[...]/mongodb/lib/core/auth/scram.js:xxx:yy)

Note that Mongoose applications can also be affected, as Mongoose wraps the Node.js driver:

TypeError: (0 , o.saslprep) is not a function
    at continueScramConversation (/app/webpack:[...]/mongoose/node_modules/mongodb/lib/cmap/auth/scram.js:xxx:yy)

Next steps

The underlying issue was addressed in versions 5.7.0, 4.17.0 and 3.7.4 of the MongoDB Node.js driver, so depending on the version of the driver being used by your application a minor version update will address this.

Upgrading your application’s libraries and deploying to production may not always be possible in a timely fashion. If this is the case and you happen to hit the issue described above a workaround would be to append the authMechanism option to your connection string with a value of SCRAM-SHA-1 as follows:

 mongodb+srv://xyz.mongodb.net/test?authMechanism=SCRAM-SHA-1

This will force the driver to attempt authorization using the SCRAM-SHA-1 hashing algorithm. Note that connection string changes would still require the application to be restarted for those changes to take effect.

← Previous

How to Enhance Inventory Management with Real-Time Data Strategies

In the competitive retail landscape, having the right stock in the right place at the right time is crucial. However, the retail industry faces significant challenges in achieving this goal. In 2022, unsold stock in the US surged by a staggering $78 billion, reaching approximately $740 billion—a shocking 12 percent increase . Without a single view of inventory, retailers struggle to compete with new market disruptors offering customers omnichannel experiences. Retailers who get stock management right can move to distributed supply chains, leveraging stock across online and in-store platforms to distribute inventory quickly and react to shifting buying patterns. With effective access to the data, retailers speed up workforce efficiency and allow for automation. In this blog, we will explore how inventory management affects customer experiences, effective stock management for accurate demand forecasting, and workforce productivity. Building a single view of inventory to enhance customer experience Modern retail consumers expect seamless omnichannel experiences, like the ability to view product availability online and pick it up at a nearby store the next day. They will gravitate toward retailers that prioritize their need for convenience and speed. The difficulty in delivering these features often stems from the lack of a centralized inventory hub, i.e. operating with separate inventories for online and in-store. Combining data from diverse sources, including vendor solutions, RDBMS databases, and files, becomes a complex task that hampers the ability to achieve an accurate real-time view of stock availability. It also extends the time to market for new features, requiring redundant and customized development efforts across different channels. This lack of adaptability impacts the retailer's ability to offer customer-centric features, putting them at a disadvantage compared to their competitors. To track inventory in real-time and improve visibility and consistency across multiple channels and locations, MongoDB’s document data model is a powerful choice. Using the document model, data types can be combined easily, making it more flexible for handling diverse product data. Its intuitive design enables developers to iterate on the data model at the same pace as the rest of the code base, without downtime for schema changes. This agility accelerates the implementation of new features and functionalities that can be built on top of a single view of inventory, like real-time stock availability, and buying online and picking up in-store the next day. Figure 1: Enabling buy online and pick up in-store through single-view inventory By leveraging a single view of inventory, retailers can accelerate the development of superior customer experiences, securing a competitive edge in the retail industry. Effective stock management with real-time analytics Now that the retailer can see and understand inventory levels across their organization in one place, they can begin to manage stock more effectively. This enables retailers to move to a more complex distributed supply chain and activate the use of real-time analytics or AI. In a traditional retailer without a centralized inventory management system, the complexity of mixing stock between channels was too difficult in a segmented data landscape, leading to waste through dead stock in stores while others or online channels have an insufficient supply of the same item. With a single view of inventory, items can be moved around in a way that makes sense for the business. Online orders destined for in-store pick-up might be packed using in-store items. Dead stock on a shelf might be available online. Stores can move stock between themselves in an intelligent manner. The added complexity does come with more complex decision-making. It's vital to be able to ask difficult questions about the inventory management system and get answers in real-time. Rather than move data to a different analytical platform and get answers a day later, retailers are looking to do real-time analysis to make important stock allocation decisions in real-time. Next, retailers tackle demand forecasting and bring intelligence into stock allocation. This is where a translytical data platform comes in. Its distributed architecture means analytical workloads can run on a real-time analytics node. This approach eliminates the need for additional systems such as separate analytics platforms and reduces the lag associated with transferring data. The aggregation framework, MongoDB’s advanced processing pipeline can then be used to ask complex analytical questions and get results back to the user in real-time. For example, retailers can easily see which products are the most popular or the most likely to run out of stock soon or understand when a product rapidly sells out in one store if this is a trend or tied to a specific event like a sports game. This insight can guide smart decisions on redistributing products to get them in front of the customer who is most likely to buy. Figure 2: Inventory real-time analytics This architecture could also be leveraged to feed AI or machine learning models. The more complex the supply chain becomes, the more retailers are turning to cutting-edge technology to gain further insight. Demand forecasting is a great use case for AI as there can be a vast amount of possible factors and results. With MongoDB, retailers are integrating AI systems so they can access real-time data, enhancing their accuracy and responsiveness. This synergy enables businesses to streamline their supply chains. Boost workforce efficiency through an event-driven solution A successful inventory management strategy also contributes to improving workforce efficiency. The lack of real-time updates brings on inefficient inventory tracking procedures that result in errors, such as excess or unavailable goods, and hinder customer orders, leading to dissatisfaction among staff and customers alike. As the business grows and sales volume increases, the ability to process large amounts of real-time data becomes increasingly important. A future-proof, scalable, and flexible architecture supporting the tools that empower your workforce, can make a difference when retailers face a peak in demand or decide to expand their business. The central question retailers face is, "How can businesses enhance workforce efficiency in their inventory operations? The key lies in using event-driven architectures for managing inventory systems. MongoDB is a great fit for this approach, offering features like Change Streams , Triggers , and the Kafka Connector . Take for example the scenario seen in Figure 3; a customer purchases a t-shirt in-store. The Point of Sale device then instantly updates the product stock. If stock runs low, this change is instantly sent to the store manager app through Change Streams to alert the store manager. To automate the re-ordering process, MongoDB Triggers can be set up to trigger a function that would perform complex actions in response to the event, like automatically reordering products. Figure 3: Event-driven architecture for inventory management Today, when an influencer mentions a particular item, it can fly off the shelves at an unforeseen pace. Thanks to automation enabled by event-driven architectures, such situations become opportunities, not challenges. As soon as that item goes unexpectedly out of stock, the system triggers an automatic reorder, ensuring that your shelves are replenished in real-time. This rapid response eliminates the need for manual intervention, freeing up your store manager to focus on more value-add activities. Instead of spending hours every day reordering items, they can now dive into more engaging tasks, like interacting with customers, providing personalized recommendations, and exploring innovative stock decisions. This isn't just a theoretical advantage. A prime example comes from MongoDB’s work with 7-Eleven . By implementing a custom inventory management app, 7-Eleven streamlined its operations across 10,000 stores in the U.S. and Canada. With event-driven functionality, 7-Eleven store employees can now seamlessly manage transactions, sales, and inventory through mobile devices, eradicating the need for manual updates and improving overall workforce efficiency. Closing the loop for a future-proof inventory management strategy Effective inventory management strategies are vital in the evolving retail landscape. By providing a consistent single-view inventory, retailers can enhance customer experiences and gain a competitive edge. With efficient stock management capabilities, they can optimize their inventory levels, reducing costs and improving profitability. And by embracing event-driven solutions, retailers can boost workforce efficiency, enabling data-driven decision-making and streamlining processes through automation. If you want to get hands-on, follow our step-by-step tutorial on how to Build an Inventory Management System using MongoDB Atlas . Access our GitHub repo for code samples, video guide, and more!

August 23, 2023

Next →

MongoDB Database Observability: Integrating with Monitoring Tools

This post is the final in a three-part series on leveraging database observability. Welcome back to our series on Leveraging Database Observability! Our previous post showcased a real-world use case highlighting how MongoDB Atlas’s observability tools effectively tackle database performance challenges. Whether you’re a developer, DBA, or DevOps engineer, our mission is to empower you to harness the full potential of your data through our observability suite . Integrating Atlas metrics with your central enterprise observability tools can simplify your operations. By seamlessly working with popular observability tools, our approach helps teams streamline workflows and enhance visibility across systems. Integrating MongoDB Atlas with third-party monitoring tools MongoDB’s developer data platform combines all essential data services for building modern applications within a unified experience. Our purpose-built observability tools for Atlas environments offer automatic monitoring and optimization, guiding diagnostics tailored specifically for MongoDB. Additionally, we extend Atlas metrics into your existing enterprise observability stack, enabling seamless integration without replacing your current tools. This creates a consolidated, single-pane view that unifies Atlas telemetry with other tech and application metrics, ensuring comprehensive visibility into both database and full-stack performance. This integration empowers you to monitor, receive alerts, and make data-driven decisions within your existing workflows, driving greater efficiency. Below is a quick guide to modifying integration settings through the Atlas UI and the popular integrations we support: Navigate to the Project Integrations page in Atlas. Choose the organization and project you want to configure from the navigation bar. On the Project Integrations page, select the third-party services you’d like to integrate. Configure the chosen services with the required API keys and regions. Critical integrations for your observability platform With Atlas’s Datadog and Prometheus integrations, you can send critical MongoDB metrics to these platforms, empowering detailed, real-time monitoring. Through Datadog , you can track database operation counts, query efficiency, and resource usage, ideal for pinpointing bottlenecks and managing resources. Similarly, Prometheus enables you to monitor essential metrics like query times, connection rates, and memory usage, supporting flexible tracking of database health and performance. Both integrations facilitate proactive detection of issues, alert configuration for resource thresholds, and a cohesive view of Atlas data when visualized in Grafana. Atlas’s integration with PagerDuty streamlines incident management by sending metrics like performance alerts, billing anomalies, and security events directly to PagerDuty. This integration records incidents automatically, notifies teams upon alerts, and supports two-way syncing, ensuring resolved alerts in Atlas are reflected in PagerDuty. It enables efficient incident response and resource allocation to maintain system stability. With Atlas integrations for Microsoft Teams and Slack, you can route key metrics—such as query latency, disk usage, and throughput—to these channels for timely updates. Teams can use these insights for real-time performance monitoring, incident response, and collaboration. Notifications through these platforms ensure your team stays informed on database performance, storage health, and user activity changes as they occur. Use case: Centralized observability with MongoDB Atlas, Datadog, and Slack Let’s walk through a hypothetical scenario for ShopSmart, an e-commerce company that leverages MongoDB Atlas to manage its product catalog and customer data. As traffic surges, the DevOps team faces challenges in monitoring application performance and database health effectively. To tackle these challenges, the team leverages MongoDB Atlas’ integration with Datadog and Slack, creating a powerful observability ecosystem. Integrating MongoDB Atlas with Datadog: The team pushes key MongoDB Atlas metrics into Datadog, such as query performance, connection counts, and Atlas Vector Search metrics. With Datadog, they can visualize these metrics and correlate overall MongoDB performance with their other applications. Out-of-the-box monitors and dedicated dashboards allow the team to track metrics like throughput, average read/write latency, and current connections. This visibility helps pinpoint bottlenecks in real time, ensuring optimal database performance and improving overall application responsiveness. Setting up alerts in Datadog: The team configures alerts for critical metrics like high query latency and increased error rates. When thresholds are breached, Datadog instantly notifies the team. This proactive approach allows the team to address potential performance issues before they impact customers. Integrating Datadog with Slack: To ensure fast communication, alerts are sent directly to the dedicated Slack channel, “ShopSmart-Alerts.” This integration fosters seamless collaboration, enabling the team to discuss and resolve issues in real-time. With these integrations, ShopSmart’s engineering team can monitor performance quickly and address issues efficiently. The unified observability approach enhances operational efficiency, improves the customer experience, and supports ShopSmart’s competitive edge in the e-commerce industry. By leveraging MongoDB Atlas, Datadog, and Slack, the team ensures scalable performance and drives continuous innovation. Conclusion MongoDB Atlas empowers developers and organizations to achieve unparalleled observability and control over their database environments. By seamlessly integrating with central enterprise observability tools, Atlas enhances your ability to monitor performance metrics and ensures you can do so within your existing workflows. This means you can focus on building modern applications confidently, knowing you have the insights and alerts necessary to maintain optimal performance. Embrace the power of MongoDB Atlas and transform your approach to database management—because your applications can thrive when your data is observable. And that wraps up our Leveraging Database Observability series! We hope you learned something new and found value in these discussions. Sign up for MongoDB Atlas , our cloud database service, to see database observability in action. To dive deeper and expand your knowledge, check out this learning byte for more insights on the MongoDB observability suite and how it can enhance your database performance.

November 14, 2024