Database Manual / Self-Managed Deployments / Security / Authentication / OIDC/OAuth 2.0 / Workload (Applications)

Configure MongoDB with Workload Identity Federation使用工作负载身份联合配置MongoDB

Configure MongoDB with Workload Identity Federation to authenticate services across different platforms. This enhances security and simplifies service identity management.使用工作负载身份联合配置MongoDB，以跨不同平台对服务进行身份验证。这增强了安全性并简化了服务身份管理。

Important

OpenID Connect (OIDC) is only supported on Linux.OpenID Connect(OIDC)仅在Linux上受支持。

Before you Begin开始之前

  • Ensure that you are on MongoDB Enterprise.确保您使用的是MongoDB Enterprise。

    To verify that you are using MongoDB Enterprise, pass the --version command line option to the mongod or mongos:要验证您是否正在使用MongoDB Enterprise，请将--version命令行选项传递给mongod或mongos：

    mongod --version

    In the output from this command, look for the string modules: subscription or modules: enterprise to confirm you are using the MongoDB Enterprise binaries.在此命令的输出中，查找字符串modules:subscription或modules:enterprise，以确认您正在使用MongoDB enterprise二进制文件。

  • Configure your external identity provider. For more details, see Configure an External Identity Provider for Workload Authentication.配置外部身份提供程序。有关更多详细信息，请参阅为工作负载身份验证配置外部身份提供程序。

Steps步骤

1

Configure the MongoDB server with OpenID Connect (OIDC)使用OpenID Connect(OIDC)配置MongoDB服务器

To configure the MongoDB server, enable the MONGODB-OIDC authentication mechanism and use the oidcIdentityProviders to specify identity provider (IDP) configurations.要配置MongoDB服务器，请启用MongoDB-OIDC身份验证机制，并使用oidcIdentityProviders指定身份提供者（IDP）配置。

Note

When configuring MongoDB for Workload Identity Federation, set the supportsHumanFlows field in oidcIdentityProviders to false.为工作负载身份联合配置MongoDB时，将oidcIdentityProviders中的supportsHumanFlows字段设置为false。

You can configure the MongoDB server using your configuration file or command line.您可以使用配置文件或命令行配置MongoDB服务器。

Configuration file配置文件

To use your configuration file, specify these parameters in the file:要使用配置文件，请在文件中指定以下参数：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "authorizationClaim": "groups",
      "supportsHumanFlows": false,
   } ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. When you specify multiple identity providers, you must specify a matchPattern for each provider. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。指定多个身份提供程序时，必须为每个提供程序指定一个matchPattern。例如：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "authorizationClaim": "groups",
      "supportsHumanFlows": false,
   }, {
      "issuer": "https://azure-test.azure.com",
      "audience": "example2@kernel.mongodb.com",
      "authNamePrefix": "azure-issuer",
      "authorizationClaim": "groups",
      "supportsHumanFlows": false,
   } ]'
Command line命令行

To use the command line, specify the following startup options:要使用命令行，请指定以下启动选项：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "authorizationClaim": "groups",
   "supportsHumanFlows": false,
} ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. When you specify multiple identity providers, you must specify a matchPattern for each provider. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。指定多个身份提供程序时，必须为每个提供程序指定一个matchPattern。例如：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "authorizationClaim": "groups",
   "supportsHumanFlows": false
}, {
   "issuer": "https://azure-test.azure.com",
   "audience": "example2@kernel.mongodb.com",
   "authNamePrefix": "azure-issuer",
   "authorizationClaim": "groups",
   "supportsHumanFlows": false
} ]'
2

(Optional) Enable internal authorization启用内部授权

To enable internal authorization, set the useAuthorizationClaim field of the oidcIdentityProviders parameter to false. 要启用内部授权，请将oidcIdentityProviders参数的useAuthorizationClaim字段设置为false。This setting enables more flexible user management by relying on user documents rather than authorization claims from the identity provider.此设置通过依赖用户文档而不是身份提供者的授权声明，实现了更灵活的用户管理。

Important

If useAuthorizationClaim is set to false, do not include the authorizationClaim field.如果useAuthorizationClaim设置为false，则不包括authorizationClaim字段。

Configuration file配置文件
setParameter:
   authenticationMechanisms: MONGODB-OIDC
   oidcIdentityProviders: '[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "useAuthorizationClaim": false,
      "supportsHumanFlows": false,
   } ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。例如：

setParameter:
   authenticationMechanisms: MONGODB-OIDC
      oidcIdentityProviders: '[ {
         "issuer": "https://okta-test.okta.com",
         "audience": "example@kernel.mongodb.com",
         "authNamePrefix": "okta-issuer",
         "useAuthorizationClaim": false,
         "supportsHumanFlows": false,
      }, {
         "issuer": "https://azure-test.azure.com",
         "audience": "example2@kernel.mongodb.com",
         "authNamePrefix": "azure-issuer",
         "useAuthorizationClaim": false,
         "supportsHumanFlows": false,
      } ]'
Command line命令行
mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
   "issuer": "https://okta-test.okta.com",
   "audience": "example@kernel.mongodb.com",
   "authNamePrefix": "okta-issuer",
   "useAuthorizationClaim": false,
   "supportsHumanFlows": false,
} ]'

To specify multiple identity providers, add additional objects to the oidcIdentityProviders array. For example:要指定多个身份提供程序，请向oidcIdentityProviders数组添加其他对象。例如：

mongod --auth --setParameter authenticationMechanisms=MONGODB-OIDC --setParameter \
'oidcIdentityProviders=[ {
      "issuer": "https://okta-test.okta.com",
      "audience": "example@kernel.mongodb.com",
      "authNamePrefix": "okta-issuer",
      "useAuthorizationClaim": false,
      "supportsHumanFlows": false,
   }, {
      "issuer": "https://azure-test.azure.com",
      "audience": "example2@kernel.mongodb.com",
      "authNamePrefix": "azure-issuer",
      "useAuthorizationClaim": false,
      "supportsHumanFlows": false,
   } ]'

When you set useAuthorizationClaim to false, users who authenticate with the MONGODB-OIDC mechanism obtain their authorization rights from a user document in $external. 当您将useAuthorizationClaim设置为false时，使用MONGODB-OIDC机制进行身份验证的用户将从$external中的用户文档中获得授权权限。The server searches for a user document with an _id matching the value of the authNamePrefix/principalName claim for every OIDC based authentication attempt for a user of your identity provider.对于身份提供程序的用户的每次基于OIDC的身份验证尝试，服务器都会搜索一个用户文档，该文档的_id与authNamePrefix/presidentName声明的值匹配。

Next Steps后续步骤

Learn More了解更多