Docs Menu

Docs HomeMongoDB Cloud Manager

Configure MongoDB Authentication and Authorization

On this page

  • Considerations
  • Access Control Mechanisms
  • Edit Host Credentials

Your MongoDB deployments can use the access control mechanisms described on this page. You specify the authentication settings when adding the deployment. You can edit the security settings after adding a deployment.

If a deployment uses access control, the MongoDB Agent must authenticate to the deployment as MongoDB users with appropriate access. Enable and configure authentication through the Cloud Manager.

With access control enabled, you must create MongoDB users so that clients can access your databases.

Cloud Manager automatically creates a user for the MongoDB Agent when you enable access control. The MongoDB Agent can administrate and manage other users. As such, the first user you create can have any role.

When you select an Authentication Mechanism for your Cloud Manager group, this enables access control for all the deployments in your Cloud Manager group.

Note

Recommendation

To avoid inconsistencies, use the Cloud Manager interface to manage users and roles for MongoDB deployments.

Tip

See also:

To learn more about MongoDB access control, see the Authentication and Authorization pages in the MongoDB manual.

MongoDB supports the following implementations of challenge-response mechanisms for authenticating users with passwords.

In the following table, the default authentication mechanism for the release series is marked with and acceptable authentication mechanisms are marked with .

MongoDB Release Series
5.x.x
4.4.x
4.2.x
4.0.x
3.6.x
3.4.x

To enable SCRAM-SHA-1 or SCRAM-SHA-256 for your Cloud Manager project, complete the following tasks:

  1. Enable Username and Password Authentication for your Cloud Manager Project.

  2. Configure MongoDB Agent for Authentication.

MongoDB Enterprise supports proxy authentication of users. This allows administrators to configure a MongoDB cluster to authenticate users by proxying authentication requests to a specified LDAP service.

To enable LDAP for your Cloud Manager project, complete the following tasks:

  1. Enable LDAP Authentication for your Cloud Manager Project.

  2. Configure MongoDB Agent for LDAP.

MongoDB Enterprise allows authentication using OIDC. To authenticate with OIDC, you must first register your OIDC or OAuth application with an IdP that supports OIDC standard, such as as Azure AD, Okta, and Ping Identity.

To enable OIDC for your Cloud Manager project, Enable OIDC Authentication for your Cloud Manager Project.

MongoDB Enterprise supports authentication using a Kerberos service. Kerberos is an IETF (RFC 4120) standard authentication protocol for large client/server systems.

To use MongoDB with Kerberos, you must have a properly configured Kerberos deployment, configure Kerberos service principals for MongoDB, and add the Kerberos user principal.

To enable Kerberos for your Cloud Manager project, complete the following tasks:

  1. Enable Kerberos Authentication for your Cloud Manager Project

  2. Configure the MongoDB Agent for Kerberos.

Specify Kerberos as the MongoDB process's authentication mechanism when adding or editing the deployment.

MongoDB supports X.509 certificate authentication for use with a secure TLS connection. The X.509 client authentication allows clients to authenticate to servers with certificates rather than with a username and password.

To enable X.509 authentication for your Cloud Manager project, complete the following tasks:

  1. Enable x.509 Authentication for your Cloud Manager Project.

  2. Configure the MongoDB Agent for X.509 Authentication.

You can also use X.509 certificates for membership authentication for the processes that Cloud Manager monitors.

You can configure the deployment to use the authentication mechanism from the Cloud Manager interface. The Manage MongoDB Users and Roles tutorials describe how to configure an existing deployment to use each authentication mechanism.

←  Enable Authentication for a Cloud Manager ProjectEnable Username and Password Authentication for your Cloud Manager Project →