@@ -26,8 +26,8 @@ LDAP Authorization
26
26
The LDAP Authorization process is summarized below:
27
27
28
28
#. A client connects to MongoDB and performs authentication with any
29
- :ref:`authentication <authentication>` mechanism that
30
- :ref:`supports external authentication
29
+ :ref:`authentication <authentication>` mechanism that
30
+ :ref:`supports external authentication
31
31
<security-ldap-external-compatibility>`.
32
32
33
33
#. MongoDB binds to to the LDAP server specified with :setting:`security.ldap.servers`
@@ -38,10 +38,10 @@ The LDAP Authorization process is summarized below:
38
38
instead if configured in :setting:`security.ldap.bind.method` and
39
39
:setting:`security.ldap.bind.saslMechanisms`.
40
40
41
- #. MongoDB constructs an LDAP query using the
41
+ #. MongoDB constructs an LDAP query using the
42
42
:setting:`security.ldap.authz.queryTemplate` and queries the LDAP server for
43
43
the authenticated user's group membership.
44
-
44
+
45
45
MongoDB can use the :setting:`security.ldap.userToDNMapping` option to
46
46
transform the username for supporting the query template.
47
47
@@ -103,7 +103,7 @@ To manage roles on the MongoDB server, authenticate as a user whose group
103
103
membership corresponds to a ``admin`` database role with role administration
104
104
privileges, such as those provided by :authrole:`userAdmin`. Create or update
105
105
roles corresponding to LDAP group DNs such that users with membership in that
106
- group receive the appropriate roles and privileges.
106
+ group receive the appropriate roles and privileges.
107
107
108
108
For example, an LDAP group for database administrators might have a role with
109
109
administrative roles and privileges. An LDAP group for marketing or analytics
@@ -121,15 +121,15 @@ non-``$external`` user with these privileges exists, you effectively cannot
121
121
perform user management, as no new or existing roles can be altered to reflect
122
122
additions or changes to groups or group membership on the LDAP server.
123
123
124
- To remedy a scenario where you cannot manage roles on the MongoDB server,
124
+ To remedy a scenario where you cannot manage roles on the MongoDB server,
125
125
perform the following procedure:
126
126
127
127
#. Restart the MongoDB server without authentication and LDAP authorization
128
128
129
129
#. Create a role on the ``admin`` database whose name corresponds to the
130
130
appropriate LDAP group Distinguished Name. When choosing a group DN,
131
131
consider which group is most appropriate for database administration.
132
-
132
+
133
133
#. Restart the MongoDB server with authentication and LDAP authorization
134
134
135
135
#. Authenticate as a user with membership in the group corresponding to the
@@ -204,7 +204,7 @@ configuration file:
204
204
template executed by MongoDB to obtain the LDAP groups to
205
205
which the user belongs to. The query is relative to the host or hosts
206
206
specified in :setting:`~security.ldap.servers`.
207
-
207
+
208
208
Use the ``{USER}`` special placeholder to substitute the authenticated
209
209
username, or the :setting:`transformed <security.ldap.userToDNMapping>`
210
210
username, into the LDAP query.
@@ -272,7 +272,7 @@ configuration file:
272
272
273
273
- Depending on your :setting:`~security.ldap.queryTemplate`, the
274
274
authenticated client username may require transformation to support the
275
- the LDAP query URL. :setting:`~security.ldap.userToDNMapping` allows
275
+ LDAP query URL. :setting:`~security.ldap.userToDNMapping` allows
276
276
MongoDB to transform incoming usernames.
277
277
278
278
- **NO**, unless client usernames require transformation into LDAP DNs.
@@ -288,7 +288,7 @@ authenticated user's groups. If MongoDB transformed the username using
288
288
:setting:`~security.ldap.userToDNMapping`, MongoDB replaces the ``{USER}``
289
289
token with the transformed username when constructing the LDAP query URL.
290
290
291
- .. example::
291
+ .. example::
292
292
293
293
The following query template returns any groups listed in the
294
294
LDAP user object's ``memberOf`` attribute. This query assumes the ``memberOf``
@@ -359,19 +359,19 @@ shell must:
359
359
- set :option:`--authenticationDatabase` to ``$external``.
360
360
361
361
- set :option:`authenticationMechanism` to the appropriate authentication
362
- mechanism.
363
-
362
+ mechanism.
363
+
364
364
If using :ref:`LDAP authentication <security-ldap>`, set this to ``PLAIN``.
365
-
365
+
366
366
If using :ref:`Kerberos authentication <security-kerberos>`, set this to
367
367
``GSSAPI``.
368
-
368
+
369
369
If using :ref:`x.509 <security-auth-x509>`, set this to ``MONGODB-X.509``.
370
370
371
371
- set :option:`--username` to a username that respects the
372
372
:setting:`security.ldap.authz.queryTemplate`, or any configured
373
373
:setting:`security.ldap.userToDNMapping` template.
374
-
374
+
375
375
- set :option:`--password` to the appropriate password.
376
376
377
377
Include the :option:`--host` and :option:`--port` of the MongoDB server,
0 commit comments