From 707a6c3a6358401ec0d354082af4bda397d013cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 24 Mar 2026 08:36:47 +0700
Subject: [PATCH] fix: MongoDB Atlas auth failure due to wrong authSource
 default (#438)

---
 CHANGELOG.md                                        | 5 +++++
 Plugins/MongoDBDriverPlugin/MongoDBConnection.swift | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c5b8a757..4fbd7202 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- MongoDB Atlas connections failing to authenticate (#438)
+- MongoDB TLS certificate verification skipped for SRV connections
+
 ## [0.23.1] - 2026-03-24
 
 ### Added
diff --git a/Plugins/MongoDBDriverPlugin/MongoDBConnection.swift b/Plugins/MongoDBDriverPlugin/MongoDBConnection.swift
index 69b7a00f..3aecdb39 100644
--- a/Plugins/MongoDBDriverPlugin/MongoDBConnection.swift
+++ b/Plugins/MongoDBDriverPlugin/MongoDBConnection.swift
@@ -190,6 +190,8 @@ final class MongoDBConnection: @unchecked Sendable {
         let effectiveAuthSource: String
         if let source = authSource, !source.isEmpty {
             effectiveAuthSource = source
+        } else if useSrv {
+            effectiveAuthSource = "admin"
         } else if !database.isEmpty {
             effectiveAuthSource = database
         } else {
@@ -206,8 +208,7 @@ final class MongoDBConnection: @unchecked Sendable {
         let sslEnabled = ["Preferred", "Required", "Verify CA", "Verify Identity"].contains(sslMode)
         if sslEnabled {
             params.append("tls=true")
-            let verifiesCert = sslMode == "Verify CA" || sslMode == "Verify Identity"
-            if !verifiesCert {
+            if sslMode == "Preferred" {
                 params.append("tlsAllowInvalidCertificates=true")
             }
             if !sslCACertPath.isEmpty {