feat(mongo): Add MongoDB connection support for Boundary CLI

[enbiyagoral]

This PR adds MongoDB connection support to the Boundary CLI. Users can now securely and easily connect to MongoDB targets using the boundary connect mongo command.

What's Added?

• boundary connect mongo command
• Credential and target support for MongoDB
• Required tests and documentation updates

Testing

• All tests passed successfully
• MongoDB connection tests were performed
• End-to-end testing with Docker containers

Notes

This PR follows the same architecture and UX as the existing helper commands for PostgreSQL and MySQL.

[johanbrandhorst]

This looks great to me, I'll wait for Ryan or Bharath to approve :)

[johanbrandhorst]

We'll probably need an update to enos/modules/test_e2e_docker/test.sh, similar to what's happening in here: https://github.com/hashicorp/boundary/pull/6001/files. Something to install a mongoDB client in the runtime environment of the tests. You can test the commands to use by creating a golang:1.25 container and running them.

[enbiyagoral]

I’ve added the MongoDB client (mongosh) to the e2e Docker test runtime. It installs via the MongoDB APT key and repo, and I verified it inside a golang:1.25 container (mongosh --version). @johanbrandhorst

I also removed the explicit Boundary DB/server startup from the Mongo test since the E2E infrastructure already starts Boundary. @Balaji2198

[johanbrandhorst]

LGTM. I think the easiest way for us to run the e2e tests would be to have one of our engineers push a commit to your branch, so I might go ahead and push something.

[bgajjala8]

@enbiyagoral This is very cool! Did you get a chance to run the tests locally (and if so, which CLI did you use)? Would you mind sharing your output? Getting some conflicting errors my end as I am trying to verify with mongosh

[johanbrandhorst]

Hm, pushing did not seem to run CI for us, we might have to recreate the PR altogether.

[enbiyagoral]

@enbiyagoral This is very cool! Did you get a chance to run the tests locally (and if so, which CLI did you use)? Would you mind sharing your output? Getting some conflicting errors my end as I am trying to verify with mongosh

=== RUN   TestCliTcpTargetConnectMongo
    docker.go:360: Starting MongoDB database...
    target_tcp_connect_mongo_test.go:49: MongoDB info: user=e2eboundary, db=e2eboundarydb, host=e2emongo, port=27017, password-set:true                                                                                                                 
    scope.go:85: Created Org Id: o_QvSmw9z2Zl
    scope.go:127: Created Project Id: p_Vb1IrSSwgC
    target.go:181: Created Target: ttcp_9Q6sXr0cHM
    credential.go:131: Created Credential Store: csst_0IOLRTZI6f
    credential.go:237: Created Username/Password Credentials: credup_PzzE0vYNwx
    target_tcp_connect_mongo_test.go:123: MongoDB session output: show collections
        db.getName()
        exit
        Current Mongosh Log ID: 68bf4b5702f307c5e7debacd
        Connecting to:          mongodb://<credentials>@127.0.0.1:62838/e2eboundarydb?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+2.5.6                                                                                         
        MongoServerSelectionError: connection <monitor> to 127.0.0.1:62838 closed
    target_tcp_connect_mongo_test.go:126: Successfully connected to MongoDB target
--- PASS: TestCliTcpTargetConnectMongo (11.39s)
PASS
ok      github.com/hashicorp/boundary/testing/internal/e2e/tests/base   11.786s

oh sorry, what I did:

• Added mongosh installation to the test runtime (enos/modules/test_e2e_docker/test.sh)
• Found the real issue: the boundary connect mongo command was looking for the old mongo client, not mongosh
• Solution: Updated the CLI – it now uses mongosh as the default client (internal/cmd/commands/connect/mongo.go)

The test passes, and mongosh successfully connects to the MongoDB target through Boundary! @bgajjala8

[bgajjala8]

The test seems to pass at first glance, but I noticed an authentication error in the output. Do you know what might be causing this, and are you seeing the same issue locally? I’m seeing this issue on my end as well.

=== RUN   TestCliTcpTargetConnectMongo
    docker.go:360: Starting MongoDB database...
    target_tcp_connect_mongo_test.go:49: MongoDB info: user=e2eboundary, db=e2eboundarydb, host=e2emongo, port=27017, password-set:true
    scope.go:85: Created Org Id: o_fL7DsvUv8y
    scope.go:127: Created Project Id: p_py6otAgOhc
    target.go:181: Created Target: ttcp_VXlOMvWNo1
    credential.go:131: Created Credential Store: csst_uVs9ljikKc
    credential.go:237: Created Username/Password Credentials: credup_VT4JTl6n7P
    target_tcp_connect_mongo_test.go:123: MongoDB session output: show collections
        db.getName()
        exit
        Current Mongosh Log ID:	68c04935c0a6eed831ce5f46
        Connecting to:		mongodb://<credentials>@127.0.0.1:33913/e2eboundarydb?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+2.5.8
        **MongoServerError: Authentication failed.**
    target_tcp_connect_mongo_test.go:126: Successfully connected to MongoDB target
--- PASS: TestCliTcpTargetConnectMongo (27.19s)

[enbiyagoral]

Hi folks(@johanbrandhorst, @bgajjala8), after a few intense weeks working with Terraform and Terragrunt, I’m happy to share an update. At my first availability, I set up the test environment with Enos and ran my test.

The results look promising:

go test -v github.com/hashicorp/boundary/testing/internal/e2e/tests/base -run '^TestCliTcpTargetConnectMongo$'
=== RUN   TestCliTcpTargetConnectMongo
    docker.go:360: Starting MongoDB database...
    target_tcp_connect_mongo_test.go:49: MongoDB info: user=e2eboundary, db=e2eboundarydb, host=e2emongo, port=27017, password-set:true
    scope.go:85: Created Org Id: o_RMrIEGAlIt
    scope.go:127: Created Project Id: p_y2VApgOQEf
    target.go:181: Created Target: ttcp_K1Bg2RNGVY
    credential.go:131: Created Credential Store: csst_KCOQA7nKIf
    credential.go:237: Created Username/Password Credentials: credup_4OKae79q0Z
    target_tcp_connect_mongo_test.go:130: MongoDB session output: db.runCommand('ping')
        db.getName()
        exit
        Current Mongosh Log ID: 68deb8ef19bf8c12a1da7d0d
        Connecting to:          mongodb://<credentials>@127.0.0.1:65109/e2eboundarydb?authSource=admin&directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+2.5.8
        Using MongoDB:          7.0.24
        Using Mongosh:          2.5.8
        
        For mongosh info see: https://www.mongodb.com/docs/mongodb-shell/
        
------
           The server generated these startup warnings when booting
           2025-10-02T17:39:57.297+00:00: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine. See http://dochub.mongodb.org/core/prodnotes-filesystem
           2025-10-02T17:39:57.833+00:00: vm.max_map_count is too low
        ------
        
e2eboundarydb> 
        db.runCommand('ping')
        { ok: 1 }
        
    target_tcp_connect_mongo_test.go:136: Successfully connected to MongoDB target
--- PASS: TestCliTcpTargetConnectMongo (7.60s)
PASS
ok      github.com/hashicorp/boundary/testing/internal/e2e/tests/base   7.966s

[bgajjala8]

Great job on the tests. They are looking good on enos and locally. I have a few comments which would make the code a bit cleaner and follow some of our existing patterns.

[bgajjala8]

@enbiyagoral (Question): Was there a specific reason to use connection strings rather than building using mongosh flags? I looked at the help menu and noticed there are options to use flags.

➜  boundary git:(pr/enbiyagoral/6033) ✗ mongosh --help

  $ mongosh [options] [db address] [file names (ending in .js or .mongodb)]

  Options:

    -h, --help                                 Show this usage information
    -f, --file [arg]                           Load the specified mongosh script
        --host [arg]                           Server to connect to
        --port [arg]                           Port to connect to
        --build-info                           Show build information
        --version                              Show version information
        --quiet                                Silence output from the shell during the connection process
        --shell                                Run the shell after executing files
        --nodb                                 Don't connect to mongod on startup - no 'db address' [arg] expected
        --norc                                 Will not run the '.mongoshrc.js' file on start up
        --eval [arg]                           Evaluate javascript
        --json[=canonical|relaxed]             Print result of --eval as Extended JSON, including errors
        --retryWrites[=true|false]             Automatically retry write operations upon transient network errors (Default: true)

  Authentication Options:

    -u, --username [arg]                       Username for authentication
    -p, --password [arg]                       Password for authentication
        --authenticationDatabase [arg]         User source (defaults to dbname)
        --authenticationMechanism [arg]        Authentication mechanism
        --awsIamSessionToken [arg]             AWS IAM Temporary Session Token ID
        --gssapiServiceName [arg]              Service name to use when authenticating using GSSAPI/Kerberos
        --sspiHostnameCanonicalization [arg]   Specify the SSPI hostname canonicalization (none or forward, available on Windows)
        --sspiRealmOverride [arg]              Specify the SSPI server realm (available on Windows)

[bgajjala8]

If we use flag we can probably make it look similar to postgres impl. Could look something like...

args = append(args, "--host", ip)

if port != "" {
    args = append(args, "--port", port)
}

switch {
case username != "":
    args = append(args, "-u", username)
case c.flagUsername != "":
    args = append(args, "-u", c.flagUsername)
}

if password != "" {
    args = append(args, "-p", password)
    if c.flagDbname == "" {
        c.UI.Warn("Credentials are being brokered but no -dbname parameter provided.......")
    }
}

if c.flagAuthSource != "" {
    args = append(args, "--authenticationDatabase", c.flagAuthSource)
}

if c.flagDbname != "" {
    args = append(args, c.flagDbname)
}