Navigation

Set up Self-Managed X.509 Authentication

Important

If your project has users with Atlas-generated X.509 certificates, enabling self-managed X.509 authentication requires a brief downtime. After you enable self-managed X.509 authentication, users cannot authenticate with Atlas-generated certificates.

Self-managed X.509 certificates provide MongoDB users access to the clusters in your project. MongoDB users are separate from Atlas users. MongoDB users have access to MongoDB databases, while Atlas users have access to the Atlas application itself.

Prerequisites

In order to use self-managed X.509 certificates, you must have a Public Key Infrastructure to integrate with MongoDB Atlas.

Configure a Project to use a Public Key Infrastructure

1

Turn on Self-Managed X.509 Authentication.

  1. In the Security section of Atlas’s left navigation panel, click Advanced.
  2. Toggle Self-Managed X.509 Authentication to ON.
2

Provide a PEM-encoded Certificate Authority.

You can provide a Certificate Authority (CA) by:

  • Clicking Upload and selecting a .pem file from your filesystem.
  • Copying the contents of a .pem file into the provided text area.

You can concatenate multiple CAs in the same .pem file or in the text area. Users can authenticate with certificates generated by any of the provided CAs.

When you upload a CA, a project-level alert is automatically created to send a notification 30 days before the CA expires, repeating every 24 hours. You can view and edit this alert from Atlas’s Alert Settings page. For more information on configuring alerts, see Configure Alert Settings.

3

Click Save.

To edit your CA once uploaded, click the Self-Managed X.509 Authentication Settings pencil icon icon.

Add a MongoDB User using Self-Managed X.509 Authentication

1

Open the Add New User dialog.

  1. In the Security section of the left navigation, click Database Access. The MongoDB Users tab displays.
  2. Click plus icon Add New User.
2

Select CERTIFICATE.

3

Enter user information.

Field Description
Distinguished Name

The user’s Common Name (CN) and optionally additional Distinguished Name fields. For more information, see RFC 2253.

Example

CN=Jane Doe,O=MongoDB,C=US

User Privileges

You can assign roles in one of the following ways:

  • Select Atlas admin, which provides the user with readWriteAnyDatabase as well as a number of administrative privileges.

  • Select Read and write to any database, which provides the user with privileges to read and write to any database.

  • Select Only read any database which provides the user with privileges to read any database.

  • Select Select Custom Role, which allows you to select a custom MongoDB role previously created in Atlas. For more information on custom MongoDB roles, see Configure Custom MongoDB Roles.

  • Click Add Default Privileges. When you click this option, you can select individual roles and specify the database on which the roles apply. Optionally, for the read and readWrite roles, you can also specify a collection. If you do not specify a collection for read and readWrite, the role applies to all non-system collections in the database.

    Note

    When applied to a collection, the read and readWrite roles in Atlas differ slightly from the built-in MongoDB read and readWrite roles.

    In Atlas, read provides the following collection-level actions:

    In Atlas, readWrite provides the same actions as read, as well as the following additional collection-level actions:

    Tip

    You can create custom MongoDB roles in Atlas in cases where the built-in Atlas roles cannot describe the desired set of priveleges. For more information on custom roles, see Configure Custom MongoDB Roles.

For information on the built-in Atlas privileges, see MongoDB Database User Privileges.

For more information on authorization, see Role-Based Access Control and Built-in Roles in the MongoDB manual.

4

Click Add User.