Database Manual / Self-Managed Deployments / Security / Authentication / OIDC/OAuth 2.0 / Workload (Applications)

Authorize Users with Workload Identity Federation使用工作负载身份联合授权用户

You can add a database user to MongoDB using Workload Identity Federation. This approach enables your organization’s identity provider to manage user access, ensuring secure, centralized authentication for database operations.您可以使用Workload Identity Federation将数据库用户添加到MongoDB。这种方法使您组织的身份提供者能够管理用户访问，确保数据库操作的安全、集中身份验证。

Before you Begin开始之前

Note

Your oidcIdentityProviders configuration determines the approach you must take to authorize users:oidcIdentityProviders配置决定了您必须采取的授权用户的方法：

  • If the useAuthorizationClaim field is set to false to enable internal authorization, authorize users with user IDs.如果useAuthorizationClaim字段设置为false以启用内部授权，请使用用户ID授权用户。
  • If the field is set to true, authorize users with identity provider groups.如果该字段设置为true，则使用身份提供程序组授权用户。

Steps步骤

Authorize Users with IdP Groups使用IdP组授权用户
1

Create MongoDB roles创建MongoDB角色

In the admin database, use the db.createRole() method to create roles that map the identity provider group roles to MongoDB roles.在admin数据库中，使用db.createRole()方法创建将身份提供者组角色映射到MongoDB角色的角色。

Use the following format to create roles:使用以下格式创建角色：

<authNamePrefix>/<authorizationClaim>

The oidcIdentityProviders parameter provides the authNamePrefix field and the authorizationClaim field. For example:oidcIdentityProviders参数提供authNamePrefix字段和authorizationClaim字段。例如：

db.createRole( {
   role: "okta/Everyone",
   privileges: [ ],
   roles: [ "readWriteAnyDatabase" ]
} )
Authorize Users with User IDs使用用户ID授权用户
1

Switch to the $external database切换到$external数据库

When you create a user, you must create it in the $external database. To switch to the $external database, run the following command:创建用户时，必须在$external数据库中创建它。要切换到$external数据库，请运行以下命令：

use $external
2

Create a user创建一个用户

To create users and add them to your MongoDB database, use the db.createUser() command.要创建用户并将其添加到MongoDB数据库中，请使用db.createUser()命令。

Use the following format for the user field, where the authNamePrefix and authorizationClaim values come from the oidcIdentityProviders parameter:用户字段使用以下格式，其中authNamePrefix和authorizationClaim值来自oidcIdentityProviders参数：

<authNamePrefix>/<authorizationClaim>

To create a user in MongoDB with the authNamePrefix of okta and an authorizationClaim of jane.doe, run the following:要在MongoDB中创建authNamePrefix为okta、authorizationClaim为jane.doe的用户，请运行以下命令：

db.createUser( {
   user: "okta/jane.doe",
   roles: [
      {
         role: "readWriteAnyDatabase",
         db: "admin"
      }
   ]
} )

Next Steps后续步骤

You can connect an application to MongoDB using Workload Identity Federation with the following supported drivers:您可以使用工作负载身份联合将应用程序连接到MongoDB，并支持以下驱动程序：

Learn More了解更多