MongoDB LDAP and Kerberos Authentication with Centrify

jieforest

Setting up MongoDB with Kerberos authentication using Centrify

Centrify agent automatically updates system Kerberos configuration (the /etc/krb5.conf file), so no manual configuration is necessary. Additionally, Centrify provides means to create Active Directory service user, service principal name and keyfile directly from the Linux server, thus making automation easier.

1. Create the “lin-client-svc” user in Active Directory with SPN and UPN for the server, and export its keytab to the “mongod_lin.keytab” file:

1. $ adkeytab -n -P mongodb/lin-client.mongotest.com@MONGOTEST.COM -U mongodb/lin-client.mongotest.com@MONGOTEST.COM -K /home/ec2-user/mongod_lin.keytab -c "OU=support" -V --user ldap_admin lin-client-svc
   
2. ldap_admin@MONGOTEST.COM's password:
   
3. $ adquery user lin-client-svc -PS
   
4. userPrincipalName:mongodb/lin-client.mongotest.com@MONGOTEST.COM
   
5. servicePrincipalName:mongodb/lin-client.mongotest.com

复制代码

Again, the “ldap_admin” is user who is a member of the “Domain Admins” group in AD. An OU “support” will be used to create the “lin-client-svc” service user.

jieforest

2. Start MongoDB with Kerberos authentication enabled, by adjusting the config file. You also need to make sure that mongod listens on the interface associated with the FQDN. For this exercise, you can just configure mongod to listen on all interfaces:

1. $ nano /etc/mongod.conf
   
2. # Listen to local interface only. Comment out to listen on all interfaces.
   
3. #bind_ip=127.0.0.1
   
4. auth=true
   
5. setParameter=authenticationMechanisms=GSSAPI
   
6. $ service mongod stop
   
7. $ env KRB5_KTNAME=/home/ec2-user/mongod_lin.keytab mongod -f /etc/mongod.conf
   

复制代码

jieforest

3. Try to authenticate as the user “alex@MONGOTEST.COM” in MongoDB:

1. $ kinit alex@MONGOTEST.COM
   
2. Password for alex@MONGOTEST.COM:
   
3. $ mongo --host lin-client.mongotest.com
   
4. > db.getSiblingDB("$external").auth(
   
5. {
   
6. mechanism: "GSSAPI",
   
7. user: "alex@MONGOTEST.COM",
   
8. }
   
9. )
   
10. 1
    
11. >
    

复制代码

The return value of “1” indicates success.

jieforest

Summary and more information

MongoDB supports different options for authentication, including Kerberos and LDAP external authentication. With MongoDB and Centrify integration, it is now possible to speed up enterprise deployments of MongoDB into your existing security and Active Directory infrastructure and ensure quick day-one productivity without expending days and weeks of labor dealing with open-source tools.

About Centrify

Centrify is a leading provider of unified identity management solutions that result in single sign-on (SSO) for users and a simplified identity infrastructure for IT. Centrify’s Server Suite software integrates Linux systems into Active Directory domains to enable centralized authentication, access control, privilege user management and auditing access for compliance needs. Over the last 10 years, more than 5,000 customers around the world, including nearly half of the Fortune 50, have deployed and trusted Centrify solutions across millions of servers, workstations, and applications, and have regularly reduced their identity management and compliance costs by 50% or more.

jieforest

Video tutorials

Video on how to use Centrify to integrate MongoDB with Active Directory:

Video on how to enforce PAM access rights as an additional security layer for MongoDB with Centrify:

Centrify Community post and videos showcasing Active Directory integration for MongoDB:

http://community.centrify.com/t5 ... Centrify/td-p/18779

MongoDB security documentation is available here: http://docs.mongodb.org/manual/security/

MongoDB user and role management tutorials:

http://docs.mongodb.org/manual/a ... er-role-management/

jieforest

over.