NAME

       Authentication - None

BASIC AUTHENTICATION

       The  MongoDB C driver supports challenge response authentication (sometimes known as MONGODB‐CR ) through
       the use of MongoDB connection URIs.

       Simply provide the username and password as one would with an HTTP URL ,  as  well  as  the  database  to
       authenticate against via authSource \&.

       mongoc_client_t *client = mongoc_client_new ("mongodb://user:password@localhost/?authSource=mydb");

GSSAPI (KERBEROS) AUTHENTICATION

       NOTE
              Kerberos   support  is  only  provided  in  environments  supported  by  the  cyrus‐sasl  Kerberos
              implementation. This currently limits support to UNIX‐like environments.

       GSSAPI (Kerberos) authentication is available in the Enterprise  Edition  of  MongoDB,  version  2.4  and
       newer.  To  authenticate using GSSAPI , the MongoDB C driver must be installed with SASL support. Run the
       kinit command before using the following authentication methods:

       $ mongodbuser@EXAMPLE.COM's Password: $
       Credentials cache: FILE:/tmp/krb5cc_1000
               Principal: mongodbuser@EXAMPLE.COM

         Issued                Expires               Principal
       Feb  9 13:48:51 2013  Feb  9 23:48:51 2013  krbtgt/EXAMPLE.COM@EXAMPLE.COM

       Now authenticate using the MongoDB URI.  GSSAPI authenticates against the $external virtual database,  so
       a  database  does  not  need  to  be  specified in the URI. Note that the Kerberos principal must be URL‐
       encoded:

       mongoc_client_t *client;

       client = mongoc_client_new ("mongodb://mongodbuser%40EXAMPLE.COM@example.com/?authMechanism=GSSAPI");

       The default service name used by MongoDB and the MongoDB C driver is mongodb \&. A  custom  service  name
       can be specified with the gssapiServiceName option:

       mongoc_client_t *client;

       client = mongoc_client_new ("mongodb://mongodbuser%40EXAMPLE.COM@example.com/?authMechanism=GSSAPI&gssapiServiceName=myservicename");

       NOTE
              When  encountering  errors  such as Invalid net address , check if the application is behind a NAT
              (Network Address Translation)  firewall.  If  so,  create  a  ticket  that  uses  forwardable  and
              addressless Kerberos tickets. This can be done by passing ‐f ‐A to kinit \&.

              $

SSL AUTHENTICATION

       NOTE
              The MongoDB C Driver must be compiled with the ‐‐enable‐ssl option to use SSL authentication.

       To connect to a MongoDB server enabled with SSL, add the ?ssl=true option in the MongoDB URI.

       mongoc_uri_t *uri = mongoc_uri_new ("mongodb://localhost/?ssl=true");

       NOTE
              Connecting  to a server that does not support SSL will fail if the ?ssl=true parameter is provided
              in the URI. This is to prevent unintentional information leak.

SASL PLAIN AUTHENTICATION

       NOTE
              The MongoDB C Driver must be compiled with SASL support in order to use SASL PLAIN authentication.

       MongoDB Enterprise Edition versions 2.5.0 and newer support  the  SASL  PLAIN  authentication  mechanism,
       initially  intended  for  delegating  authentication to an LDAP server. Using the SASL PLAIN mechanism is
       very similar to the challenge response mechanism with usernames and passwords.  These  examples  use  the
       $external virtual database for LDAP support:

       NOTE
              SASL  PLAIN  is  a  clear‐text  authentication mechanism. It is strongly recommended to connect to
              MongoDB using SSL with certificate validation when using the PLAIN mechanism.

       mongoc_client_t *client;

       client = mongoc_client_new ("mongodb://user:password@example.com/?authMechanism=PLAIN&authSource=$external");

X.509 CERTIFICATE AUTHENTICATION

       NOTE
              The MongoDB C Driver must be compiled with SSL support for X.509 authentication support.

       The MONGODB‐X509 mechanism authenticates a username derived from the distinguished subject  name  of  the
       X.509 certificate presented by the driver during SSL negotiation. This authentication method requires the
       use of SSL connections with certificate validation and is available in MongoDB 2.5.1 and newer:

       mongoc_client_t *client;
       mongoc_ssl_opt_t ssl_opts = { 0 };

       ssl_opts.pem_file = "mycert.pem";
       ssl_opts.pem_pwd = "mycertpassword";
       ssl_opts.ca_file = "myca.pem";
       ssl_opts.ca_dir = "trust_dir";
       ssl_opts.weak_cert_validation = false;

       client = mongoc_client_new ("mongodb://x509_derived_username@localhost/?authMechanism=MONGODB‐X509");
       mongoc_client_set_ssl_opts (client, &ssl_opts);

       MONGODB‐X509 authenticates against the $external database, so specifying a database is not required.

COLOPHON

       This     page     is     part     of    MongoDB    C    Driver.     Please    report    any    bugs    at
       https://jira.mongodb.org/browse/CDRIVER.

MongoDB C Driver                                   2016‐01‐18                                  AUTHENTICATION(3)