Enable LDAP Authentication for your Ops Manager Group

On this page

Ops Manager enables you to configure the Authentication Mechanisms that all clients, including the Ops Manager Agents, use to connect to your MongoDB deployments. You can enable multiple authentication mechanisms for each of your groups, but you must choose only one mechanism for the Agents.

MongoDB Enterprise supports proxying authentication requests to a Lightweight Directory Access Protocol (LDAP) service.

LDAP is only available on MongoDB Enterprise builds. If you have existing deployments running on a MongoDB Community build, you must upgrade them to MongoDB Enterprise before you can enable LDAP for your Ops Manager group.


MongoDB Enterprise supports simple and SASL binding to Lightweight Directory Access Protocol (LDAP) servers via saslauthd and operating system libraries:

  • MongoDB Enterprise for Linux can bind to an LDAP server either via saslauthd or starting in MongoDB 3.4, via the operating system libraries.
  • Starting in MongoDB version 3.4, MongoDB Enterprise for Windows can bind to an LDAP server via the operating system libraries.

The LDAP Proxy Authentication and LDAP Authorization sections in the MongoDB manual provide more information about LDAP and MongoDB. Setting up LDAP and SASL is beyond the scope of this document.


This procedure describes how to configure and enable LDAP authentication when using Automation. If your Monitoring or Backup agents are not managed by Ops Manager, you must manually configure them to use LDAP. See: Configure Monitoring Agent for LDAP and Configure Backup Agent for LDAP Authentication for instructions.


If Ops Manager is not managing any MongoDB deployment, you can reset Authentication and SSL settings for your group.

To remove all authentication and security settings as well as the users and roles you created using Ops Manager, click Clear Settings in the Authentication & SSL Settings dialog box .

See Clear Security Settings for more information.

To unmanage MongoDB deployments, see Remove a Process from Management or Monitoring.


Select LDAP.

  1. Check LDAP.

  2. Select the appropriate type of LDAP authentication.


    If you are using LDAP Authorization, you must select Native LDAP Authentication.

  3. Click Next.


Configure the LDAP Authorization Settings. (Optional)


Using LDAP Authorization, MongoDB 3.4 allows authenticating users via LDAP, Kerberos, or X.509 certificates without requiring local user documents in the $external database. When such a user successfully authenticates, MongoDB performs a query against the LDAP server to retrieve all groups which that LDAP user possesses and transforms those groups into their equivalent MongoDB roles.

This feature is available only for MongoDB 3.4 or later.

If you do not use LDAP Authorization, you can click Skip.

If you use LDAP Authorization, complete the following steps.

  1. Enter values for the following fields:

    Setting Value
    Authorization Query Template Specify a template for an LDAP query URL to retrieve the list of LDAP groups for an LDAP user.
    User to Distinguished Name Mapping Specify an array of JSON documents that provide the ordered transformation(s) MongoDB performs on the authenticated MongoDB usernames. MongoDB then matches the transformed username against the LDAP DNs.
  2. Click Use LDAP Authorization.

  3. Provide the following values:

    Setting Value
    Servers Specify the hostname:port combination of one or more LDAP servers.
    Transport Security Select TLS to encrypt your LDAP queries. If you do not need to encrypt the LDAP queries, select None.
    Timeout (ms) Specify how long an authentication request should wait before timing out.
    Bind Method

    Select either Simple or SASL.


    If you choose the Simple bind method, select TLS from the Transport Security because the Simple bind method passes the password in plain text.

    SASL Mechanisms Specify which SASL authentication service MongoDB uses with the LDAP server.
    Query User Specify the LDAP Distinguished Name to which MongoDB binds when connecting to the LDAP server.
    Query Password Specify the password with which MongoDB binds when connecting to an LDAP server.
    LDAP User Cache Invalidation Interval (s) Specify how long MongoDB waits to flush the LDAP user cache. Defaults to 30 seconds.
  4. Click Next.


Configure SSL if desired.

  1. Toggle the Enable SSL slider to Yes.
  2. Click Next


See Enable SSL for a Deployment for SSL setup instructions.

SSL is not required for use with LDAP authentication.


Configure the Agents to use LDAP (PLAIN) to connect to your MongoDB deployment.


Ops Manager limits Agents to using one mechanism per deployment.

  1. Select LDAP (PLAIN) from the Agent Auth Mechanism drop-down menu.

  2. For each Agent, provide:

    Setting Value
    <Agent> LDAP Username Enter the LDAP username.
    <Agent> LDAP Password Enter the password for Agent’s LDAP Username.
    <Agent> LDAP Group DN

    Enter the Distinguished Name for the Agent’s LDAP Group.


    Provide the Agent’s LDAP Group DN only if you use LDAP Authorization. Each Agent should have and use its own LDAP Group DN.

  3. Click Save.

Only configure the Agents you installed.


If you did not install the Backup Agent, do not configure the Backup agent.


Click Review & Deploy to review your changes.


Review and approve your changes.

Ops Manager displays your proposed changes.

  1. If you are satisfied, click Confirm & Deploy.
  2. Otherwise, click Cancel and you can make additional changes.

Create MongoDB Roles for LDAP Groups. (Optional)

After enabling LDAP Authorization, you need to create custom MongoDB roles for each LDAP Group you specified for LDAP Authorization.