Configure MongoDB Agent for Authentication
MongoDB supports the following authentication mechanisms depending on your MongoDB version:
MongoDB Version | Default Authentication Mechanism |
---|---|
4.0 or later | |
3.0 to 3.6 | SCRAM authentication mechanism
with``SHA-1`` hash function. |
2.6 or earlier | MongoDB Challenge and Response ( MONGODB-CR ). MONGODB-CR
is a challenge-response mechanism that authenticates users
through passwords. |
Prerequisites
Configure Deployments to Use Authentication
The MongoDB Agent interacts with the MongoDB databases in your deployment as a MongoDB user would. As a result, you must configure your MongoDB deployment and the MongoDB Agent to support authentication.
You can specify the deployment's authentication mechanisms when adding the deployment, or you can edit the settings for an existing deployment. At minimum, the deployment must enable the authentication mechanism you want the MongoDB Agent to use. The MongoDB Agent can use any supported authentication mechanism.
Configure the MongoDB Agent for Authentication
The MongoDB Agent can use SCRAM-SHA-1
or SCRAM-SHA-256
to authenticate to hosts that enforce access control.
Note
With Automation, Ops Manager manages MongoDB Agent authentication for you. To learn more about authentication, see Enable Username and Password Authentication for your Ops Manager Project.
When you install the MongoDB Agent with Automation, Ops Manager creates a
user to authenticate on the MongoDB database. Ops Manager create this
MongoDB user (mms-automation
) in the admin
database with
the correct privileges for each MongoDB Agent function.
Configure these credentials in Ops Manager.
Navigate to Deployment Security Settings
Continue through the modal until you see the Configure Ops Manager Agents page
Add the appropriate credentials:
SettingValueMongoDB Agent UsernameEnter the MongoDB Agent username.MongoDB Agent PasswordEnter the password for the MongoDB Agent username.
Each MongoDB Agent function uses a different set of
MongoDB shell (mongosh
) commands to configure a user with the
appropriate roles and privileges.
Create a User
To back up MongoDB instances, create a user in the admin
database. Assign this user the roles provided in the
following example.
Use the following mongosh
command to create the user:
db.getSiblingDB("admin").createUser( { user: "<username>", pwd: "<password>", roles: [ { role: "clusterAdmin", db: "admin" } ] } )
To learn more about the required access, see Required Access for MongoDB Agent Backup.
Configure Backup Credentials
After you create the user for the Backup function, add the credentials to the Backup Settings.
Navigate to Backup <backup-deployment> Edit Credentials.
Click Credentials.
Add the appropriate credentials:
SettingValueBackup UsernameEnter the Backup username.Backup PasswordEnter the password for the Backup username.
To monitor MongoDB instances that use SCRAM
authentication, add a user to the admin
database in
MongoDB. Assign this user the roles provided in the
following example.
db.getSiblingDB("admin").createUser( { user: "<username>", pwd: "<password>", roles: [ { role: "clusterMonitor", db: "admin" } ] } )
To learn what roles this function requires, see Monitoring settings.
Configure Monitoring Credentials
After you create the user for the Monitoring function, add the credentials to the Monitoring Settings.
Navigate to Deployment <deployment> Monitoring Settings.
Click Credentials.
Add the appropriate credentials:
SettingValueMonitoring UsernameEnter the Monitoring username.Monitoring PasswordEnter the password for the Monitoring username.