sarjarapu

// rules for automation encryption
var schemaMap = {
  "health_care_app.patients": {
    "bsonType": "object",
    "properties": {
      "medRecNum": {
        "bsonType": "int"
      },
      "firstName": {
        "bsonType": "string"

sarjarapu

// So let's drop all the information in patients collection
plainDB.getCollection("patients").remove({"_id": 3});
// define server-side JSON and retry the insert
var patientsJSONSchema = {
  "bsonType": "object",
  "properties": {
    "ssn": {
      "encrypt": {
        "bsonType": "string",
        "algorithm": SSN_ENCRYPTION_ALGORITHM,

sarjarapu

// Insert another document from plainDB object with plain text.
// Remember the previous inserts were on csfleDB object (with Field-Level encryption options)
plainDB.getCollection("patients").insert({
  "_id": 3,
  "medRecNum": 3,
  "firstName": "Jason",
  "lastName": "Doe",
  "ssn": "333-33-3333",
  "mobile": "333-333-3333",
  "comment": "Jason Doe SSN/Phone should have been encrypted, but the app/dev forgot to do so."

sarjarapu

// NOTE: In the explicit encryption method all insert/update/find operations should ship encrypted data.
// Let's explore an MongoDB Enterprise that helps automatically encryption / decryption data for you. But first,
// define a JSON schema mapping for our patients collection via the Field-Level option.
const healthCareAppSchema = {
  "health_care_app.patients": {
    "bsonType": "object",
    "properties": {
      "medRecNum": {
        "bsonType": "int"
      },

sarjarapu

// Deterministic algorithm: Always outputs the same encrypted value for a given combo of plain text and an encryption key. When you need to search on encrypted text match you must be using the Deterministic algorithms.
const SSN_ENCRYPTION_ALGORITHM = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
// Random algorithm: Always outputs different encrypted value for a given combo of plain text and an encryption key. Although the encrypted value is different, decrypting always yields the same plain text. Because the encrypted text is random, you should not be using them on searchable fields
const MOBILE_ENCRYPTION_ALGORITHM = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";

// Create a patient document on csfleDB object. Manually encrypt the texts and insert into DB
// Notice that encrypt method is called once per each field, but insert operation is done as a whole
csfleDB.getCollection("patients").insert({
  "_id": 1,
  "medRecNum": 1,

sarjarapu

// Create a mongo clients for plain text operations and another with client-side Field-Level encryption options
var csfleOptions = {
  "keyVaultNamespace" : "encryption.__dataKeys",
  "kmsProviders" : {
    "local" : {
      "key" : BinData(0, LOCAL_KEY)
    }
  },
  "schemaMap" : {}
};

sarjarapu

# Generate 96 char local key. save it don't loose it
LOCAL_KEY=$(openssl rand -hex 50 | head -c 96 | base64 | tr -d '\n')
echo $LOCAL_KEY
# YzRiY2Y3ZGUzNDgxYzQwNzliMGEzMDI2YjU0ODkwMjQ5ZTNmMWFkZDdiZGUzMDc5ZTVlMWYxNjBlMDM5MGJmMjhmOWIyODdlMjU3MjA1M2ZmZjdiZDViYWE1Y2Q1OTRi

# Start the v4.2 client. Note that you are not connecting to server yet
${MONGO_BIN}/mongo --shell --nodb --eval "var LOCAL_KEY = '$LOCAL_KEY' "

sarjarapu

# TODO: Update the BASE_DIR to your favorite directory
BASE_DIR=/Users/shyam/code/personal/mdb/fle/build
VERSION="4.2.2"

# TODO: Change the binaries to your OS flavor
# Download and extract the v4.2 enterprise binaries
cd ${BASE_DIR}
curl -OL "https://downloads.mongodb.com/osx/mongodb-macos-x86_64-enterprise-${VERSION}.tgz"
tar -xzf mongodb-macos-x86_64-enterprise-${VERSION}.tgz
rm -f mongodb-macos-x86_64-enterprise-${VERSION}.tgz

sarjarapu

# Login into the Kerberos as bob
kinit -p bob
# Password for bob@MDBKRB5.NET:

klist
# Ticket cache: KEYRING:persistent:1000:1000
# Default principal: bob@MDBKRB5.NET
# Valid starting       Expires              Service principal
# 10/04/2018 16:58:49  10/05/2018 16:58:48  krbtgt/MDBKRB5.NET@MDBKRB5.NET

sarjarapu

sudo tee /etc/yum.repos.d/mongodb-enterprise.repo << EOF
[mongodb-enterprise]
name=MongoDB Enterprise Repository
baseurl=https://repo.mongodb.com/yum/redhat/\$releasever/mongodb-enterprise/4.0/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
EOF

# Install the mongodb enterprise dependencies and mongodb shell