Configure the MongoDB Agent for Kerberos

Configure KDC to Issue Tickets with Four-Hour Minimum Lifetime

Kerberos tickets can authenticate users for a limited time. You must configure the Kerberos Key Distribution Center (KDC) to issue tickets that are valid for four hours or longer. The MongoDB Agent periodically renews the ticket. The KDC service provides session tickets and temporary session keys to users and hosts.

Add Kerberos as Authentication Mechanism for Deployment

The MongoDB Agent interacts with the MongoDB databases in your deployment as a MongoDB user would. As a result, you must configure your MongoDB deployment and the MongoDB Agent to support authentication.

You can specify the deployment's authentication mechanisms when adding the deployment, or you can edit the settings for an existing deployment. At minimum, the deployment must enable the authentication mechanism you want the MongoDB Agent to use. The MongoDB Agent can use any supported authentication mechanism.

For the purposes of this tutorial, you must ensure the following:

• Your deployment supports Kerberos authentication and

• MongoDB Agent uses Kerberos authentication.

To learn how to enable Kerberos authentication, see Enable Kerberos Authentication for your Cloud Manager Project.

Configure MongoDB Agent Host to Use Kerberos

Two Kerberos-related files must be installed on any host running Monitoring or Backup:

• Create or configure the krb5.conf Kerberos configuration file.

  Platform	Default Path	Notes
  Linux	/etc/krb5.conf
  Windows	%WINDIR%\krb5.ini	This is the default path for non-Active Directory-based Kerberos implementations. Refer to the documentation for your Kerberos implemention for your version of Windows to find out where the Kerberos configuration file is stored.

• On Linux systems: ensure kinit binary is located at /usr/bin/kinit. kinit obtains or renews a Kerberos ticket-granting ticket, which authenticates the Agent using Kerberos.

Create Kerberos User Principal for the MongoDB Agent

Create a User and Assign Roles for the MongoDB Agent UPN

db.getSiblingDB("$external").createUser(
  {
    user : "<Kerberos Principal>",
    roles : [
      { role : "clusterAdmin", db : "admin" },
      { role : "readWriteAnyDatabase", db : "admin" },
      { role : "userAdminAnyDatabase", db : "admin" },
      { role : "dbAdminAnyDatabase", db : "admin" },
      { role : "backup", db : "admin" },
      { role : "restore", db : "admin" }
    ]
  }
)