Compatible Authentication Mechanism

The following authentication mechanisms are compatible with MongoDB LDAP authorization:

• LDAP Proxy Authentication
• Kerberos Authentication
• x.509

User Management

With LDAP authorization, user creation and management occurs on the LDAP server. MongoDB requires creation of roles on the admin database, with the name of each role exactly matching a LDAP group Distinguished Name (DN). This is in contrast to MongoDB managed authorization, which requires creating users on the $external database.

To manage roles on the MongoDB server, authenticate as a user whose group membership corresponds to a admin database role with role administration privileges, such as those provided by userAdmin. Create or update roles corresponding to LDAP group DNs such that users with membership in that group receive the appropriate roles and privileges.

For example, an LDAP group for database administrators might have a role with administrative roles and privileges. An LDAP group for marketing or analytics users may have a role with only have read privileges on certain databases.

If no role with role administration privileges exists AND no non-$external user with these privileges exists, you effectively cannot perform user management, as no new or existing roles can be altered to reflect additions or changes to groups or group membership on the LDAP server.

To remedy a scenario where you cannot manage roles on the MongoDB server, perform the following procedure:

1. Restart the MongoDB server without authentication and LDAP authorization
2. Create a role on the admin database whose name corresponds to the appropriate LDAP group Distinguished Name. When choosing a group DN, consider which group is most appropriate for database administration.
3. Restart the MongoDB server with authentication and LDAP authorization
4. Authenticate as a user with membership in the group corresponding to the created administrative role.

Existing Users

A MongoDB server using LDAP for authorization makes any existing users on the $external database inaccessible. If there are existing users in $external database, you must meet the following requirements for each user on the $external database to ensure continued access:

• User has a corresponding user object on the LDAP server
• User object has membership in the appropriate LDAP groups
• MongoDB has roles on the admin database named for the user’s LDAP groups, such that the granted roles and privileges are identical to those granted to the non-$external user.

If you want to continue allowing access by users not on the $external database, ensure the authenticationMechanisms parameter includes SCRAM-SHA-1. Alternatively, apply the requirements listed above for transitioning those users to LDAP authorization.

Replica Sets

For replica sets, configure LDAP authorization on the secondary and arbiter members first before configuring the primary. This also applies to shard replica sets, or config server replica sets. Configure one replica set member at a time to maintain a majority of members for write availability.

Sharded Clusters

In sharded clusters, you must configure LDAP authorization on the config servers for cluster-level users. You can optionally configure LDAP authorization on each shard for shard-local users.