Navigation
This version of the documentation is archived and no longer supported. To learn how to upgrade your version of MongoDB Ops Manager, refer to the upgrade documentation.
You were redirected from a different version of the documentation. Click here to go back.

Enable Kerberos Authentication for your Ops Manager Group

On this page

Overview

Ops Manager enables you to configure the Authentication Mechanisms that the Ops Manager Agents use to connect to your MongoDB deployments from within the Ops Manager interface. You can enable multiple authentication mechanisms for your group, but you must choose a single mechanism for the Agents to use to authenticate to your deployment.

MongoDB Enterprise supports authentication using a Kerberos service. Kerberos is an industry standard authentication protocol for large client/server systems.

To use MongoDB with Kerberos, you must have a properly configured Kerberos deployment, configure Kerberos service principals for MongoDB, and add the Kerberos user principal. The Kerberos Authentication section of the MongoDB Manual provides more detail about using MongoDB with Kerberos.

Considerations

Kerberos (GSSAPI) is only available on MongoDB Enterprise builds. If you have existing deployments running on a MongoDB Community build, you must upgrade them to MongoDB Enterprise before you can enable Kerberos (GSSAPI) for your Ops Manager group.

This tutorial describes how to enable Kerberos for your Ops Manager group, and how to configure your Ops Manager Agents to connect to your Kerberized deployment.

Setting up and configuring a Kerberos deployment is beyond the scope of this document. This tutorial assumes you have configured a Kerberos service principal for each Agent and you have a valid keytab file for each Agent.

Note

If Ops Manager is not managing any MongoDB deployment, you can reset Authentication and SSL settings for your group.

To remove all authentication and security settings as well as the users and roles you created using Ops Manager, click Clear Settings in the Authentication & SSL Settings dialog box .

See Clear Security Settings for more information.

To unmanage MongoDB deployments, see Remove a Process from Management or Monitoring.

Procedures

This procedure describes how to configure and enable Kerberos authentication when using Automation. If your Monitoring or Backup agents are not managed by Ops Manager, you must manually configure them to use Kerberos. See: Configure the Monitoring Agent for Kerberos and Configure the Backup Agent for Kerberos for instructions.

Configure an Existing Deployment for Kerberos-based Authentication

If you have one or more existing deployments managed by Ops Manager, the MongoDB deployment must be configured for Kerberos authentication before you can enable Kerberos authentication for your group.

1

Click the Deployment tab, then click the Deployment page.

2

Select the process that you wish to modify.

  1. Click the first icon to the right of Processes to switch to that view.
  2. Click the process that you wish to edit.
  3. Click the wrench icon to the right of that process to modify it.
3

Expand the Advanced Options area.

4

Set the kerberosKeytab Startup option to point to the keytab file and click Apply.

If kerberosKeytab is not already set, use the Add Option button to add a new startup option, and select kerberosKeytab from the drop-down menu. Input the path to the keytab file as the value, and then click Apply.

When you have configured the Kerberos options for each deployment, you can proceed to enable Kerberos for your Ops Manager group.

Enable Kerberos for your Ops Manager Group

1

Click the Deployment tab, then click the Deployment page.

2
3

Check Kerberos (GSSAPI), then click Next.

4

Configure SSL if desired, and click Continue.

If desired, enable SSL for the group.

Note

See Enable SSL for a Deployment for SSL setup instructions.

SSL is not required for use with Kerberos (GSSAPI) authentication.

5

Configure the Authentication Mechanism for the Agents.

If you enable more than one authentication mechanism, you must specify which one of the authentication mechanisms the Ops Manager agents should use to connect to your deployment.

  1. Select Kerberos (GSSAPI) from the Agent Auth Mechanism drop-down menu.

  2. For each Agent, provide:

    Setting Value
    <Agent> Kerberos Principal Enter the Kerberos Principal.
    <Agent> Keytab path Provide the path and filename for the Agent’s Keytab.

  3. Click Save.

You do not need to configure all of the agents, only the ones you installed.

Example

If you did not install the Backup agent, you do not need to configure the Backup agent.

6

Click Review & Deploy to review your changes.

7

Review and approve your changes.

Ops Manager displays your proposed changes.

  1. If they are acceptable, click Confirm & Deploy.
  2. If they are unacceptable, click Cancel and you can make additional changes.

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.