Configure the MongoDB Agent for X.509 Authentication

If you are using LDAP authorization in your MongoDB deployment, you must create an LDAP user and LDAP group for the MongoDB Agent on the LDAP server. After creating the LDAP user and group, map the LDAP group to a MongoDB role in your deployment's admin database.

For the MongoDB user representing the MongoDB Agent:

1. Create a new LDAP user on your LDAP server named that uses the subject value of your client certificate as the username.

2. Create an LDAP group whose name matches the MongoDB Agent's role.

3. Create the MongoDB Agent's role in your admin database with the appropriate permissions.

   Note

   When Automation is activated, Automation automatically creates a role for for the MongoDB Agent user for LDAP authentication.

4. Assign the LDAP user to the LDAP group.

If you are not using LDAP authorization, you must add the subject value of your client certificate as the username of the MongoDB Agent in the $external database of your MongoDB deployment. Without LDAP authorization, MongoDB uses the $external database to authenticate a user against X.509.

Use the following commands to create the users from mongosh:

db.getSiblingDB("$external").createUser(
  {
    user : "<x.509 subject>",
    roles : [
      { role : "clusterAdmin", db : "admin" },
      { role : "readWriteAnyDatabase", db : "admin" },
      { role : "userAdminAnyDatabase", db : "admin" },
      { role : "dbAdminAnyDatabase", db : "admin" },
      { role : "backup", db : "admin" },
      { role : "restore", db : "admin" }
    ]
  }
)

To learn what access is required, see Required Access for MongoDB Agent.

Each MongoDB user must have its own X.509 certificate.