Database Manual / Self-Managed Deployments / Security / Authentication / OIDC/OAuth 2.0 / Workforce (Humans)

Configure MongoDB with Workforce Identity Federation使用劳动力身份联合配置MongoDB

Configure MongoDB with Workforce Identity Federation to authenticate users across different platforms using a single set of credentials. This enhances security and simplifies user management.使用Workforce Identity Federation配置MongoDB，以使用一组凭据跨不同平台对用户进行身份验证。这增强了安全性并简化了用户管理。

Important

OpenID Connect (OIDC) is only supported on Linux.OpenID Connect(OIDC)仅在Linux上受支持。

Before you Begin开始之前

  • Ensure that you are on MongoDB Enterprise.确保您使用的是MongoDB Enterprise。

    To verify that you are using MongoDB Enterprise, pass the --version command line option to the mongod or mongos:要验证您是否正在使用MongoDB Enterprise，请将--version命令行选项传递给mongod或mongos：

    mongod --version

    In the output from this command, look for the string modules: subscription or modules: enterprise to confirm you are using the MongoDB Enterprise binaries.在此命令的输出中，查找字符串modules:subscription或modules:enterprise，以确认您正在使用MongoDB enterprise二进制文件。

  • Configure your external identity provider. For more details, see Configure an External Identity Provider for Workforce Authentication.配置外部身份提供程序。有关更多详细信息，请参阅为劳动力身份验证配置外部身份提供程序。

Steps步骤

1

Configure the MongoDB server with OpenID Connect (OIDC)使用OpenID Connect(OIDC)配置MongoDB服务器

Note

When configuring MongoDB for Workforce Identity Federation, omit the supportsHumanFlows field in oidcIdentityProviders.为劳动力身份联合配置MongoDB时，省略oidcIdentityProviders中的supportsHumanFlows字段。

You can configure the MongoDB server using your configuration file or command line.您可以使用配置文件或命令行配置MongoDB服务器。

Configuration file配置文件

To use your configuration file, specify these parameters in the file:要使用配置文件，请在文件中指定以下参数：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "authorizationClaim": "groups",
      "clientId": "0zzw3ggfd2ase33",
   } ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. When you specify multiple identity providers, you must specify a matchPattern for each provider. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。指定多个身份提供程序时，必须为每个提供程序指定一个matchPattern。例如：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "authorizationClaim": "groups",
      "matchPattern": "@okta.com$",
      "clientId": "0zzw3ggfd2ase33",
   }, {
      "issuer": "https://azure-test.azure.com",
      "audience": "example2@kernel.mongodb.com",
      "authNamePrefix": "azure-issuer",
      "authorizationClaim": "groups",
      "matchPattern": "@azure.com$",
      "clientId": "1zzw3ggfd2ase33",
   } ]'
Command line命令行

To use the command line, specify the following startup options:要使用命令行，请指定以下启动选项：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "authorizationClaim": "groups",
   "clientId": "0zzw3ggfd2ase33",
} ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. When you specify multiple identity providers, you must specify a matchPattern for each provider. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。指定多个身份提供程序时，必须为每个提供程序指定一个matchPattern。例如：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "authorizationClaim": "groups",
   "matchPattern": "@okta.com$",
   "clientId": "0zzw3ggfd2ase33",
}, {
   "issuer": "https://azure-test.azure.com",
   "audience": "example2@kernel.mongodb.com",
   "authNamePrefix": "azure-issuer",
   "authorizationClaim": "groups",
   "matchPattern": "@azure.com$",
   "clientId": "1zzw3ggfd2ase33",
} ]'
2

(Optional) Enable internal authorization（可选）启用内部授权

To enable internal authorization, set the useAuthorizationClaim field of the oidcIdentityProviders parameter to false. This setting enables more flexible user management by relying on user documents rather than authorization claims from the identity provider.要启用内部授权，请将oidcIdentityProviders参数的useAuthorizationClaim字段设置为false。此设置通过依赖用户文档而不是身份提供者的授权声明，实现了更灵活的用户管理。

Important

If useAuthorizationClaim is set to false, do not include the authorizationClaim field.如果useAuthorizationClaim设置为false，则不包括authorizationClaim字段。

Configuration file配置文件
setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "useAuthorizationClaim": false,
      "clientId": "0zzw3ggfd2ase33"
   } ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。例如：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
      oidcIdentityProviders: '[ {
         "issuer": "https://okta-test.okta.com",
         "audience": "example@kernel.mongodb.com",
         "authNamePrefix": "okta-issuer",
         "useAuthorizationClaim": false,
         "clientId": "0zzw3ggfd2ase33"
      }, {
         "issuer": "https://azure-test.azure.com",
         "audience": "example2@kernel.mongodb.com",
         "authNamePrefix": "azure-issuer",
         "useAuthorizationClaim": false,
         "clientId": "1zzw3ggfd2ase33"
      } ]'
Command line命令行
mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "useAuthorizationClaim": false,
   "clientId": "0zzw3ggfd2ase33"
} ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。例如：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "useAuthorizationClaim": false,
      "clientId": "0zzw3ggfd2ase33"
   }, {
      "issuer": "https://azure-test.azure.com",
      "audience": "example2@kernel.mongodb.com",
      "authNamePrefix": "azure-issuer",
      "useAuthorizationClaim": false,
      "clientId": "1zzw3ggfd2ase33"
   } ]'

When you set useAuthorizationClaim to false, users who authenticate with the MONGODB-OIDC mechanism obtain their authorization rights from a user document in $external. 当您将useAuthorizationClaim设置为false时，使用MONGODB-OIDC机制进行身份验证的用户将从$external中的用户文档中获得授权权限。The server searches for a user document with an _id matching the value of the authNamePrefix/principalName claim for every OIDC based authentication attempt for a user of your identity provider.对于身份提供程序的用户的每次基于OIDC的身份验证尝试，服务器都会搜索一个用户文档，该文档的_id与authNamePrefix/principalName声明的值匹配。