MongoDB Security: Authentication Explained

What is MongoDB Authentication?

Authentication confirms the identity of a client connecting to MongoDB before granting access.

Without authentication, anyone can connect to the database and perform operations, which is a major security risk.

• Verifies user identity using credentials.
• Prevents unauthorized database access.
• Works together with authorization to control what authenticated users can do.

Authentication Mechanisms Supported by MongoDB

MongoDB supports several authentication methods to accommodate different security requirements and environments.

• SCRAM (Salted Challenge Response Authentication Mechanism): Default and most common method.
• LDAP (Lightweight Directory Access Protocol): Integrates with enterprise directory services.
• x.509 Certificate Authentication: Uses SSL/TLS certificates for client authentication.
• Kerberos: Supports authentication via Kerberos protocol in enterprise environments.

Managing Users and Roles for Authentication

MongoDB requires creating users with defined roles to control access.

Users must authenticate with credentials matching the configured authentication mechanism.

• Create users with specific roles to limit privileges.
• Use strong, complex passwords for SCRAM users.
• Regularly review and update user roles and credentials.
• Enable authentication enforcement in MongoDB configuration.

Example: Creating a User in MongoDB

Use the following command in the mongo shell to create a user with readWrite access on a database.