Set up Workforce Identity Federation with OIDC

Register a new application for Cloud Manager.

Select public client/native application as the client type.

Set the Redirect URL value to http://localhost:27097/redirect.

(Conditional) Add or enable a groups claim if you authenticate with groups.

For groups, this step ensures that your access tokens contain the group membership information of the user authenticating. MongoDB uses the values sent in a groups claim for authorization.

(Optional) Allow refresh tokens if you want MongoDB clients to refresh the tokens for a better user experience.

(Optional) Configure the access token lifetime (exp claim) to align with your database connection session time.

Register an application.

1. Navigate to App registrations.

   1. In your Azure portal account, search and click Microsoft Entra ID.

   2. In the Manage section of the left navigation, click App registrations.

2. Click New registration.

3. Apply the following values.

   Field	Value
   Name	Cloud Manager Database - Workforce
   Supported Account Types	Accounts in this organizational directory only (single tenant)
   Redirect URI	- Public client/native (mobile & desktop) - http://localhost:27097/redirect

4. Click Register.

To learn more about registering an application, see Azure Documentation.

Add a group claim.

1. Navigate to Token Configuration.

   In the Manage section of the left navigation, click Token Configuration.

2. Click Add groups claim.

3. In the Edit groups claim modal, select Security.

   What groups you select depend on the type of groups you configured in your Azure environment. You may need to select a different type of group to send the appropriate group information.

4. In the Customize token properties by type section, only select Group ID.

5. Click Add.

To learn more about adding a group claim, see Azure Documentation.

Add a user identifier claim to the access token.

1. Click Add optional claim.

2. In the Add optional claim modal, select Access.

3. Select a claim that carries a user identifier that you can refer to in MongoDB access logs such as an email.

   You can use the UPN claim to identify users with their email address.

4. Click Add.

5. In the Microsoft Graph Permissions note, check the box, and click Add.

To learn more, see Azure Documentation.

Update the manifest.

1. In the Manage section of the left navigation, click Manifest.

2. Update the accessTokenAcceptedVersion from null to 2.

   The number 2 represents Version 2 of Microsoft's access tokens. Other applications can use this as a signed attestation of the Active Directory-managed user's identity. Version 2 ensures that the token is a JSON Web Token that MongoDB understands.

3. Click Save.

To learn more about adding an optional claim, see Azure Documentation.

Remember metadata.

1. In the left navigation, click Overview.

   Copy the Application (client) ID value.

2. In the top navigation, click Endpoints.

   Copy the OpenID Connect metadata document value without the /.well-known/openid-configuration part.

   You can also get this value by copying the value for issuer in the OpenID Connect metadata document URL.

The following table shows what these Microsoft Entra ID UI values map to in our MongoDB Atlas Configuration Properties:

Navigate to the MongoDB Roles tab for your deployment.

1. Select the organization that contains your project from the Organizations menu in the navigation bar.

2. Select your project from the Projects menu in the navigation bar.

3. Click Deployment in the sidebar.

4. Click the Security tab.

5. Click the MongoDB Roles tab.

Click Add New Role.

Create the OIDC role.

1. Enter the following fields:

   Field	Necessity	Description
   Identifier	Required	In the Database box, enter admin. In the Name box, enter your OIDC IdP configuration name and the group name from your external identity provider, separated by a slash /: {configuration_name}/{group_name}
   Inherits From	Optional	A list of role name and database pairs. The format for these pairs are roleName@dbName.
   Authentication Restrictions	Optional	A list of IP addresses or CIDR notations that you want to restrict from your IdP.
   Privilege Actions by Resource	Optional	Actions permitted on the resource. To learn more, see Privilege Actions.

2. Click Add Role.

Navigate to the MongoDB Users tab for your deployment.

1. Select the organization that contains your project from the Organizations menu in the navigation bar.

2. Select your project from the Projects menu in the navigation bar.

3. Click Deployment in the sidebar.

4. Click the Security tab.

5. Click the MongoDB Users tab.

Click Add New User.

Add the OIDC user.

1. Complete the user account fields:

   Field	Description
   Identifier	In the first field, enter the $external database. In the second field, enter a username using your OIDC IdP configuration name and the user principal claim from your configuration separated by a slash /: {configuration_name}/{user_principal_claim}
   Roles	Enter any available user-defined roles and built-in roles into this box. The combo box provides a list of existing roles when you click in it.
   Authentication Restrictions	Click Add Entry. Add one or more IP addresses and/or CIDR blocks in either the Client Source or Server Address boxes. Separate multiple addresses or blocks with commas. Client Source restricts which addresses this user can authenticate and use the given roles. Server Address restricts the addresses this user can authenticate and has the given roles. Click Save. To add another entry, click Add Entry.

2. Click Add User.

Click Review & Deploy to review your changes.

Click Confirm & Deploy to deploy your changes.

Otherwise, click Cancel and you can make additional changes.