Database Manual / Self-Managed Deployments / Security / Authentication / OIDC/OAuth 2.0

Workload Identity Federation with OAuth 2.0使用OAuth 2.0的工作负载身份联合

Workload Identity Federation uses OAuth 2.0 to enable your applications to access MongoDB using external programmatic identities such as Azure Service Principals, Azure Managed Identities, and Google Service Accounts.Workload Identity Federation使用OAuth 2.0使应用程序能够使用外部编程身份（如Azure服务主体、Azure托管身份和Google服务帐户）访问MongoDB。

Important

OpenID Connect (OIDC) is only supported on Linux.OpenID Connect(OIDC)仅在Linux上受支持。

Use Cases用例

With Workload Identity Federation, you can:使用工作负载身份联合，您可以：

  • Manage your application's access to MongoDB deployments through your existing cloud provider or identity provider (IdP).通过现有的云提供商或身份提供商（IdP）管理应用程序对MongoDB部署的访问。
  • Enforce security policies such as role-based access control, credential rotation, and workload-specific permissions.强制执行安全策略，如基于角色的访问控制、凭据轮换和特定于工作负载的权限。
  • Grant access to specific applications, containers, or virtual machines without managing individual service accounts.授予对特定应用程序、容器或虚拟机的访问权限，而无需管理单个服务帐户。

Behavior行为

  • To use Workload Identity Federation, you must use MongoDB Enterprise and have MongoDB 7.0.11 or later.要使用工作负载身份联合，您必须使用MongoDB Enterprise并拥有MongoDB 7.0.11或更高版本。

    To verify that you are using MongoDB Enterprise, pass the --version command line option to the mongod or mongos:要验证您是否正在使用MongoDB Enterprise，请将--version命令行选项传递给mongod或mongos：

    mongod --version

    In the output from this command, look for the string modules: subscription or modules: enterprise to confirm you are using the MongoDB Enterprise binaries.在此命令的输出中，查找字符串modules:subscription或modules:enterprise，以确认您正在使用MongoDB enterprise二进制文件。

  • Workload Identity Federation allows your applications to access MongoDB clusters with OAuth 2.0 access tokens. The access tokens can be issued by any external identity provider, including Azure Entra ID and Google Cloud Platform.Workload Identity Federation允许应用程序使用OAuth 2.0访问令牌访问MongoDB集群。访问令牌可以由任何外部身份提供者颁发，包括Azure Entra ID和Google Cloud Platform。
  • MongoDB stores user identifiers and privileges, but not secrets.MongoDB存储用户标识符和权限，但不存储机密。

Get Started开始使用

To configure and use Workload Identity Federation, perform the following tasks:要配置和使用工作负载身份联合，请执行以下任务：

  1. Configure an External Identity Provider for Workload Authentication为工作负载身份验证配置外部身份提供程序

    Register your OAuth 2.0 application with an IdP that supports the OAuth 2.0 standard, such as Azure Service Principals, Azure Managed Identities and Google Service Accounts.使用支持OAuth 2.0标准的IdP注册OAuth 2.0应用程序，例如Azure服务主体、Azure托管身份和Google服务帐户。

  2. Configure MongoDB with Workload Identity Federation使用工作负载身份联合配置MongoDB

    Configure your MongoDB server to use Workload Identity Federation with OAuth 2.0.将MongoDB服务器配置为使用OAuth 2.0的工作负载身份联合。

  3. Authorize Users with Workload Identity Federation使用工作负载身份联合授权用户

    Specify privileges for workload identity principals by adding roles to MongoDB (for OAuth, external authorization, or both) or adding database users to MongoDB (for database-managed authorization).通过向MongoDB添加角色（用于OAuth、外部授权或两者）或向MongoDB添加数据库用户（用于数据库管理授权）来指定工作负载身份主体的权限。

Details详情

MongoDB Drivers support two types of authentication flow for Workload Identity Federation: Built-in Authentication and Callback Authentication.MongoDB驱动程序支持工作负载身份联合的两种身份验证流：内置身份验证和回调身份验证。

Built-in Authentication内置身份验证

You can use built-in authentication if you deploy your application on a supported infrastructure with a supported principal type. Your application can access MongoDB clusters without supplying a password or manually requesting a JSON Web Tokens (JWT) from your cloud provider's metadata service. 如果将应用程序部署在具有受支持主体类型的受支持基础架构上，则可以使用内置身份验证。应用程序可以访问MongoDB集群，而无需提供密码或从云提供商的元数据服务手动请求JSON Web令牌（JWT）。Instead, your chosen MongoDB driver uses your existing principal identifier to request a JWT access token under the hood, which is then passed to the Atlas cluster automatically when your application connects.相反，您选择的MongoDB驱动程序使用您现有的主体标识符在后台请求JWT访问令牌，然后在应用程序连接时自动将其传递给Atlas集群。

For more implementation details, see your chosen Driver's documentation.有关更多实施细节，请参阅您选择的驱动程序文档。

Built-in Authentication Supported Infrastructure and Principal Types内置支持身份验证的基础架构和主体类型

Cloud Provider云服务提供商Infrastructure Type基础设施类型Principal Type主型
Google Cloud Provider (GCP)Compute EngineGCP Service AccountsGCP服务帐户
App Engine Standard Environment应用引擎标准环境
App Engine Flexible Environment应用引擎灵活的环境
Cloud Functions云函数
Google Run
Google Kubernetes Engine
Cloud Build
AzureAzure VMAzure Managed Identities (User and System assigned)Azure托管标识（用户和系统分配）

Callback Authentication回拨身份验证

You can use callback authentication with any service supporting OAuth 2.0 access tokens. 您可以对任何支持OAuth 2.0访问令牌的服务使用回调身份验证。Workload Identity Federation calls a callback method, in which you can request the required JWT from your authorization server or cloud provider that you must pass when your application connects to MongoDB with Workload Identity Federation.Workload Identity Federation调用一个回调方法，在该方法中，您可以从授权服务器或云提供商请求所需的JWT，当应用程序使用Workload Identity Federal连接到MongoDB时，您必须传递该JWT。

Review your chosen driver's documentation for more implementation details.查看您选择的驱动程序文档以了解更多实施细节。