- Security >
- Enable Authentication for an Ops Manager Group >
- Enable x.509 Authentication for your Ops Manager Group
Enable x.509 Authentication for your Ops Manager Group¶
On this page
Overview¶
Ops Manager enables you to configure the Authentication Mechanisms that all clients, including the Ops Manager Agents, use to connect to your MongoDB deployments. You can enable multiple authentication mechanisms for each of your groups, but you must choose only one mechanism for the Agents.
MongoDB supports x.509 client and member certificate authentication for use with a secure TLS/SSL connection. The x.509 authentication allows users and other members to authenticate to servers with certificates rather than with a username and password.
Note
As of Ops Manager 2.0, using x.509 certificates for membership authentication is supported.
Prerequisites¶
Important
A full description of Transport Layer Security, public key infrastructure, X.509 certificates, and Certificate Authorities is beyond the scope of this tutorial. This tutorial assumes prior knowledge of TLS/SSL and access to valid X.509 certificates.
Procedures¶
These procedures describe how to configure and enable x.509 authentication when using Automation. If Ops Manager does not manage your Monitoring or Backup agents, you must manually configure them to use x.509 authentication.
Note
See Configure the Monitoring Agent User for x.509 Client Certificate Authentication and Configure Backup Agent User for x.509 Client Certificate Authentication for instructions.
Prepare an Existing Deployment for x.509 Certificate Authentication¶
Important
X.509 Client Certificate authentication requires SSL. If Ops Manager manages one or more existing deployments, SSL must be enabled on each process in the MongoDB deployment before enabling x.509 authentication.
Note
If SSL is already enabled, you may skip this procedure.
Click Deployment, then click the Processes tab, and then the Topology view.¶
On the line listing the process, click Modify.¶
Expand the Advanced Options area.¶
Set the SSL startup options.¶
Click Add Option to add each option.
Option Value sslmode
Select requireSSL
.sslPemKeyFile
Provide the path to the client certificate. sslPemKeyPassword
If you encrypted the PEM key file, provide its password. When you have added the required settings, click Apply.
Configure an Existing Deployment for x.509 Member Certificate Authentication¶
Note
This procedure is optional. It enables members of a replica set or sharded cluster to also use x.509 certificates to authenticate each other. If it is not configured, replica set and sharded cluster members can still authenticate with each other using keyFile authentication.
Click Deployment, then click the Processes tab, and then the Topology view.¶
On the line listing the process, click Modify.¶
Expand the Advanced Options area.¶
Set the x.509 startup options.¶
Click Add Option to add each option.
Option Value clusterAuthMode
Select x509
.clusterFile
Provide the path to the member PEM Key file. When you have added the required settings, click Apply.
When you have configured the SSL options for each deployed process, you can proceed to enable x.509 authentication for your Ops Manager group.
Enable x.509 Client Certificate Authentication for your Ops Manager Group¶
Select X.509 Certificates.¶
- Select X.509 Client Certificate (MONGODB-X509).
- Click Next.
Configure the LDAP Authorization Settings. (Optional)¶
Important
Using LDAP Authorization, MongoDB 3.4 allows authenticating users via
LDAP, Kerberos, or X.509 certificates without requiring local user
documents in the $external
database. When such a user successfully
authenticates, MongoDB performs a query against the LDAP server to
retrieve all groups which that LDAP user possesses and transforms those
groups into their equivalent MongoDB roles.
This feature is available only for MongoDB 3.4 or later.
If you do not use LDAP Authorization, you can click Skip.
If you use LDAP Authorization, complete the following steps.
Enter values for the following fields:
Setting Value Authorization Query Template Specify a template for an LDAP query URL to retrieve the list of LDAP groups for an LDAP user. User to Distinguished Name Mapping Specify an array of JSON documents that provide the ordered transformation(s) MongoDB performs on the authenticated MongoDB usernames. MongoDB then matches the transformed username against the LDAP DNs. Click Use LDAP Authorization.
Provide the following values:
Setting Value Servers Specify the hostname:port
combination of one or more LDAP servers.Transport Security Select TLS
to encrypt your LDAP queries. If you do not need to encrypt the LDAP queries, selectNone
.Timeout (ms) Specify how long an authentication request should wait before timing out. Bind Method Select either
Simple
orSASL
.Important
If you choose the
Simple
bind method, selectTLS
from the Transport Security because theSimple
bind method passes the password in plain text.SASL Mechanisms Specify which SASL authentication service MongoDB uses with the LDAP server. Query User Specify the LDAP Distinguished Name to which MongoDB binds when connecting to the LDAP server. Query Password Specify the password with which MongoDB binds when connecting to an LDAP server. LDAP User Cache Invalidation Interval (s) Specify how long MongoDB waits to flush the LDAP user cache. Defaults to 30 seconds. Click Next.
Enable and configure SSL.¶
Provide the following settings:
Setting Action Enable SSL Click Yes. SSL CA File Path Provide the path on the server to the certificate authority PEM Key file. Client Certificate Mode Click REQUIRED. Click Next.
Configure X.509 Client Certificate (MONGODB-X509) for the Agents.¶
You can enable more than one authentication mechanism for your MongoDB deployment, but the Ops Manager Agents can only use one authentication mechanism. Select X.509 Client Certificate (MONGODB-X509) to connect to your MongoDB deployment.
Click X.509 Client Certificate (MONGODB-X509) in the Agent Auth Mechanism drop-down menu.
For each Agent, provide:
Setting Value <Agent> Username Enter the LDAPv3 distinguished name derived from the Agent’s PEM Key file. <Agent> PEM Key file Provide the path and filename for the Agent’s PEM Key file on the server on the line for the appropriate operating system. <Agent> PEM Key Password Provide the password to the PEM Key file if it was encrypted. <Agent> LDAP Group DN Enter the Distinguished Name for the Agent’s LDAP Group.
Note
You only need to provide the Agent’s LDAP Group DN if you use LDAP Authorization.
Click Save.
Only configure the Agents you installed.
Example
If you did not install the Backup Agent, do not configure the Backup agent.
Click Review & Deploy to review your changes.¶
Review and approve your changes.¶
Ops Manager displays your proposed changes.
- If you are satisfied, click Confirm & Deploy.
- Otherwise, click Cancel and you can make additional changes.
Create MongoDB Roles for LDAP Groups. (Optional)¶
After enabling LDAP Authorization, you need to create custom MongoDB roles for each LDAP Group you specified for LDAP Authorization.