Workforce Identity Federation with OpenID Connect使用OpenID Connect的员工身份联合

Use Cases用例

With Workforce Identity Federation, you can:使用劳动力身份联合会，您可以：

• Manage your workforce access to MongoDB deployments through your existing IdP.通过现有的IdP管理员工对MongoDB部署的访问。
• Enforce security policies such as password complexity, credential rotation, and multi-factor authentication within your IdP.在IdP中实施安全策略，如密码复杂性、凭证轮换和多因素身份验证。
• Grant access for a group of users or a single user.为一组用户或单个用户授予访问权限。

Behavior行为

You must use MongoDB Enterprise and have MongoDB 7.0.11 or later.您必须使用MongoDB Enterprise，并拥有MongoDB 7.0.11或更高版本。

To verify that you are using MongoDB Enterprise, pass the --version command line option to the mongod or mongos:要验证您是否正在使用MongoDB Enterprise，请将--version命令行选项传递给mongod或mongos：

mongod --version

In the output from this command, look for the string modules: subscription or modules: enterprise to confirm you are using the MongoDB Enterprise binaries.在此命令的输出中，查找字符串modules:subscription或modules:enterprise，以确认您正在使用MongoDB enterprise二进制文件。

Get Started开始使用

To configure and use Workforce Identity Federation, you must perform the following tasks:要配置和使用劳动力身份联合，您必须执行以下任务：

1. Configure an External Identity Provider for Workforce Authentication为劳动力身份验证配置外部身份提供程序

   Register your OIDC application with an IdP that supports the OIDC standard, such as Microsoft Entra ID, Okta, or Ping Identity.使用支持OIDC标准的IdP注册OIDC应用程序，如Microsoft Entra ID、Okta或Ping Identity。

2. Configure MongoDB with Workforce Identity Federation使用劳动力身份联合配置MongoDB

   Configure your MongoDB server to use Workforce Identity Federation with OIDC.将MongoDB服务器配置为使用带有OIDC的劳动力身份联合。

3. Authorize Users with Workforce Identity Federation使用劳动力身份联合会授权用户

   Specify privileges for workforce identity principals by adding roles to MongoDB (for OIDC, external authorization, or both) or adding database users to MongoDB (for database-managed authorization).通过向MongoDB添加角色（用于OIDC、外部授权或两者）或向MongoDB添加数据库用户（用于数据库管理授权）来指定员工身份主体的权限。