LDAP Authentication Using SASL¶

Overview¶

The following components are necessary for external authentication to work:

• LDAP Server: Remotely stores all user credentials (i.e. user name and associated password).
• SASL Daemon: Used as a MongoDB server-local proxy for the remote LDAP service.
• SASL Library: Used by the MongoDB client and server to create data necessary for the authentication mechanism.

The following image illustrates this architecture:

An authentication session uses the following sequence:

1. A mongo client connects to a running mongod instance.
2. The client creates a PLAIN authentication request using the SASL library.
3. The client then sends this SASL request to the server as a special Mongo command.
4. The mongod server receives this SASL Message, with its authentication request payload.
5. The server then creates a SASL session scoped to this client, using its own reference to the SASL library.
6. Then the server passes the authentication payload to the SASL library, which in turn passes it on to the saslauthd daemon.
7. The saslauthd daemon passes the payload on to the LDAP service to get a YES or NO authentication response (in other words, does this user exist and is the password correct).
8. The YES/NO response moves back from saslauthd, through the SASL library, to mongod.
9. The mongod server uses this YES/NO response to authenticate the client or reject the request.
10. If successful, the client has authenticated and can proceed.

Environment Setup and Configuration¶

This section describes an example configuration suitable only to test out the external authentication functionality in a non-production environment. Use common sense to adapt these guidelines to your production.

The following components are required:

• slapd: OpenLDAP server.
• libsasl2 version 2.1.25 or later.
• saslauthd: SASL Authentication Daemon (distinct from libsasl2).

The following steps will help you configure your environment:

Assumptions

Before we move on to the configuration steps, we assume the following:

1. You have the LDAP server up and running. The LDAP server is accessible to the server with the Percona Server for MongoDB installed.
2. You must place these two servers behind a firewall as the communications between them will be in plain text. This is because the SASL mechanism of PLAIN can only be used when authenticating and credentials will be sent in plain text.
3. You have sudo privilege to the server with the Percona Server for MongoDB installed.

ldap_servers: ldap://localhost
ldap_mech: PLAIN
ldap_search_base: CN=Users,DC=example,DC=com
ldap_filter: (sAMAccountName=%ucn=%u)
ldap_bind_dn: CN=ldapmgr,CN=Users,DC=<AD Domain>,DC=<AD TLD>
ldap_password: ld@pmgr_Pa55word

$ testsaslauthd -u christian -p secret  -f /var/run/saslauthd/mux

pwcheck_method: saslauthd
saslauthd_path: /var/run/saslauthd/mux
log_level: 5
mech_list: plain

> use admin
switched to db admin
> db.createUser({"user": "admin", "pwd": "$3cr3tP4ssw0rd", "roles": ["root"]})
Successfully added user: { "user" : "admin", "roles" : [ "root" ] }

security:
  authorization: enabled

setParameter:
  authenticationMechanisms: PLAIN,SCRAM-SHA-1

systemctl restart mongod

External Authentication Commands¶

Use the following command to add an external user to the mongod server:

> db.getSiblingDB("$external").createUser( {user : "christian", roles: [ {role: "read", db: "test"} ]} );

The previous example assumes that you have set up the server-wide admin user/role and have successfully authenticated as that user locally.

When running the mongo client, a user can authenticate against a given database using the following command:

> db.getSiblingDB("$external").auth({ mechanism:"PLAIN", user:"christian", pwd:"secret", digestPassword:false})

Authentication and Authorization with Direct Binding to LDAP¶

This feature has been supported in MongoDB Enterprise since its version 3.4.

Note the following limitations of LDAP Authorization in Percona Server for MongoDB:

• The ldapTimeoutMS parameter is ignored.
• The –ldapServers option may only contain a single server (MongoDB 4.4 Enterprise accepts a comma-separated list).

As of version 4.4.2-4, Percona Server for MongoDB supports LDAP referrals. For security reasons, LDAP referrals are disabled by default. Double-check that using referrals is safe before enabling them.

To enable LDAP referrals, set the ldapFollowReferrals server parameter to true either using the setParameter command or editing the configuration file.

setParameter:
   ldapFollowReferrals: true

Connection pool

As of version 4.4.2-4, Percona Server for MongoDB always uses a connection pool to LDAP server to process authentication requests. The connection pool is enabled by default. The default connection pool size is 2 connections.

You can change the connection pool size either at the server startup or dynamically by specifying the value for the ldapConnectionPoolSizePerHost server parameter.

For example, to set the number of connections in the pool to 5, use the setParameter command:

$ db.adminCommand( { setParameter: 1, ldapConnectionPoolSizePerHost: 5  } )

Alternatively, edit the configuration file:

setParameter:
  ldapConnectionPoolSizePerHost: 5

Kerberos Authentication¶

Percona Server for MongoDB supports Kerberos authentication starting from release 4.2.6-6. It is implemented the same way as in MongoDB Enterprise.