Downloaded 14 times
![Authentication
www.objectrocket.com
10
db.getSiblingDB("$external").createUser({user : 'jason', roles: [ {role : "readWrite", db: 'prod'} ] });
db.getSiblingDB("$external").auth({mechanism: "PLAIN", "user": "jason", "pwd": ”secret", "digestPassword": false });
HelloWorld.py
from pymongo import MongoClient
# MongoDB Connection URI and Establish Connection
uri = "mongodb://jason:terpko@localhost:27018/prod?authMechanism=PLAIN&authSource=$external”
client = MongoClient(uri)
…](https://image.slidesharecdn.com/mongodb-externalauthentication-180421132926/85/MongoDB-External-Authentication-10-320.jpg)
![Mongod Configuration (security.)
www.objectrocket.com
17
security:
authorization: enabled
keyFile: /etc/mongo.key
ldap:
authz:
queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER}))
bind:
method: simple
queryPassword: <secret>
queryUser: bind@data.com
servers: ldap.data.com:636
transportSecurity: tls
userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]'
setParameter:
authenticationMechanisms: GSSAPI
/etc/mongod.conf](https://image.slidesharecdn.com/mongodb-externalauthentication-180421132926/85/MongoDB-External-Authentication-17-320.jpg)
![Mongod Configuration (security.)
www.objectrocket.com
18
security:
authorization: enabled
keyFile: /etc/mongo.key
ldap:
authz:
queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER}))
bind:
method: simple
queryPassword: <secret>
queryUser: bind@data.com
servers: ldap.data.com:636
transportSecurity: tls
userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]'
setParameter:
authenticationMechanisms: GSSAPI
/etc/mongod.conf](https://image.slidesharecdn.com/mongodb-externalauthentication-180421132926/85/MongoDB-External-Authentication-18-320.jpg)
![Mongod Configuration (security.)
www.objectrocket.com
19
security:
authorization: enabled
keyFile: /etc/mongo.key
ldap:
authz:
queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER}))
bind:
method: simple
queryPassword: <secret>
queryUser: bind@data.com
servers: ldap.data.com:636
transportSecurity: tls
userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]'
setParameter:
authenticationMechanisms: GSSAPI
/etc/mongod.conf](https://image.slidesharecdn.com/mongodb-externalauthentication-180421132926/85/MongoDB-External-Authentication-19-320.jpg)
![Client Authentication
www.objectrocket.com
21
db.getSiblingDB("admin").createRole( { role: "CN=dba,DC=data,DC=com", privileges: [], roles: [
"userAdminAnyDatabase", "readWriteAnyDatabase", "dbAdminAnyDatabase", "clusterAdmin" ] });
db.getSiblingDB("$external").auth({mechanism: "GSSAPI", "user": "jason@DATA.COM" });
HelloWorld.py
from pymongo import MongoClient
# MongoDB Connection URI and Establish Connection
uri="mongodb://jason%40DATA.COM@server1.data.com:27017,.../?replicaSet=rs1&authMechanism=GSSAPI&ssl=true”
client=MongoClient(uri)
…](https://image.slidesharecdn.com/mongodb-externalauthentication-180421132926/85/MongoDB-External-Authentication-21-320.jpg)
More Related Content
Similar to MongoDB - External Authentication
MongoDB - External Authentication
- 1. External Authentication withPercona Server for MongoDB and MongoDB Enterprise Jason Terpko DBA @ Rackspace/ObjectRocket linkedin.com/in/jterpko 1
- 2.
- 3. Overview www.objectrocket.com 3 o Percona ServerFor MongoDB o MongoDB Enterprise o SASL and LDAP o Kerberos and Active Directory o Ops Manager
- 4. Percona Server ForMongoDB www.objectrocket.com 4 An enhanced free open source replacement for MongoDB Community Server + SASL Authentication + More Engine Options + Hot Backup + Auditing All MongoDB 3.4 Community Features
- 5.
- 6. Centralized Authentication www.objectrocket.com 6 LDAP (LightweightDirectory Access Protocol) and Microsoft Active Directory # extended LDIF ... dn: uid=jason,ou=dba,dc=data,dc=com ... cn: jasonuid: jason uidNumber: 9999 gidNumber: 100 ... userPassword:: <secret> # extended LDIF ... dn: CN=Jason,OU=Users,DC=data,DC=com ... cn: Jason memberOf: CN=dba,OU=Mongo,DC=data,DC=com ... sAMAccountName: jason userPrincipalName: jason@data.com OpenLDAP Active Directory
- 7. SASL Authentication www.objectrocket.com 7 PLAIN Auth InitSASL SASL Auth Yes/No Yes/No YesYes OK
- 8. Mongos / ServerConfiguration www.objectrocket.com 8 /etc/sysconfig/saslauthd SOCKETDIR=/run/saslauthd MECH=ldap FLAGS="-O /etc/saslauthd.conf" /etc/mongos.conf security: keyFile: /etc/mongo.key setParameter: authenticationMechanisms: PLAIN,SCRAM-SHA-1 *LDAP Already Configured
- 9. Mongos / ServerConfiguration www.objectrocket.com 9 /etc/saslauthd.conf ldap_servers: ldap://127.0.0.1:389 ldap_search_base: dc=data,dc=com ldap_filter: (uid=%u) ldap_bind_dn: uid=bind,ou=People,dc=data,dc=com ldap_password: <secret> /etc/sasl2/mongodb.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux log_level: 1 mech_list: plain *LDAP Already Configured
- 10. Authentication www.objectrocket.com 10 db.getSiblingDB("$external").createUser({user : 'jason',roles: [ {role : "readWrite", db: 'prod'} ] }); db.getSiblingDB("$external").auth({mechanism: "PLAIN", "user": "jason", "pwd": ”secret", "digestPassword": false }); HelloWorld.py from pymongo import MongoClient # MongoDB Connection URI and Establish Connection uri = "mongodb://jason:terpko@localhost:27018/prod?authMechanism=PLAIN&authSource=$external” client = MongoClient(uri) …
- 11. MongoDB Enterprise www.objectrocket.com 11 o Kerberos oAuthentication o Authorization o Ops Manager
- 12. MongoDB Enterprise Advance www.objectrocket.com 12 Anenterprise replacement for MongoDB Community Server All MongoDB 3.4 Community Features + Ops Manager + Optional Engines + Enhanced Security + Additional Software
- 13. Enterprise Authentication and Authorization www.objectrocket.com 13 o KerberosAuthentication o LDAP Authorization
- 14.
- 15. Kerberos www.objectrocket.com 15 A session ticketthat authenticates a client to Kerberos enabled host and services. # klist krb5cc_12345 Ticket cache: FILE:krb5cc_12345 Default principal: jason@DATA.COM Valid starting Expires Service principal 01/01/2017 05:28:34 01/01/2017 17:28:34 krbtgt/DATA.COM@DATA.COM renew until 01/08/2017 05:28:34 User Ticket Cache: *Active Directory Configured **Client Kerberos Configured
- 16. Service Principle www.objectrocket.com 16 env KRB5_KTNAME=<pathto keytab file> mongod -f /etc/mongod.conf Starting MongoD with Kerberos Service Principle # klist Ticket cache: FILE:krb5cc_0 … Valid starting Expires Service principal 01/01/2017 05:28:34 01/01/2017 17:28:34 mongodb/server1.data.com@DATA.COM renew until 01/08/2017 05:28:34
- 17. Mongod Configuration (security.) www.objectrocket.com 17 security: authorization:enabled keyFile: /etc/mongo.key ldap: authz: queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER})) bind: method: simple queryPassword: <secret> queryUser: bind@data.com servers: ldap.data.com:636 transportSecurity: tls userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]' setParameter: authenticationMechanisms: GSSAPI /etc/mongod.conf
- 18. Mongod Configuration (security.) www.objectrocket.com 18 security: authorization:enabled keyFile: /etc/mongo.key ldap: authz: queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER})) bind: method: simple queryPassword: <secret> queryUser: bind@data.com servers: ldap.data.com:636 transportSecurity: tls userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]' setParameter: authenticationMechanisms: GSSAPI /etc/mongod.conf
- 19. Mongod Configuration (security.) www.objectrocket.com 19 security: authorization:enabled keyFile: /etc/mongo.key ldap: authz: queryTemplate: DC=DATA,DC=COM??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER})) bind: method: simple queryPassword: <secret> queryUser: bind@data.com servers: ldap.data.com:636 transportSecurity: tls userToDNMapping: '[{match : "(.+)",ldapQuery:"DC=DATA,DC=COM??sub?(userPrincipalName={0})"}]' setParameter: authenticationMechanisms: GSSAPI /etc/mongod.conf
- 20. LDAP Authorization www.objectrocket.com 20 Cache Authz request LDAPQuery memberOf Authorized
- 21. Client Authentication www.objectrocket.com 21 db.getSiblingDB("admin").createRole( {role: "CN=dba,DC=data,DC=com", privileges: [], roles: [ "userAdminAnyDatabase", "readWriteAnyDatabase", "dbAdminAnyDatabase", "clusterAdmin" ] }); db.getSiblingDB("$external").auth({mechanism: "GSSAPI", "user": "jason@DATA.COM" }); HelloWorld.py from pymongo import MongoClient # MongoDB Connection URI and Establish Connection uri="mongodb://jason%40DATA.COM@server1.data.com:27017,.../?replicaSet=rs1&authMechanism=GSSAPI&ssl=true” client=MongoClient(uri) …
- 22. Ops Manager www.objectrocket.com 22 Alternatively manageyour deployment with Ops Manager.
- 23.
- 24. www.objectrocket.com 24 We’re Hiring! Looking tojoin a dynamic & innovative team? https://www.objectrocket.com/careers Reach out to us directly at careers@objectrocket.com
- 25. Thank you! Address: 100 CongressAve Suite 400 Austin, TX 78701 Support: 1-800-961-4454 Sales: 1-888-440-3242 www.objectrocket.com 25