Configure User Authentication and Authorization with OneLogin VLDAP

Set up OneLogin LDAP service.

1. To learn more about setting up the OneLogin LDAP service, see the OneLogin documentation.

   Important

   You may need to contact OneLogin support to enable the VLDAP service for your account.

2. Note your <onelogin-instance-id>. You must provide it in several places during the configuration process.

   The instance name is located in the URL you use to sign in to your OneLogin account:

   https://<onelogin-instance-id>.onelogin.com

Add IP addresses to the IP access list.

In OneLogin, click Authentication, then click VLDAP. Add the following to the Allow access by IP address field to add them to the IP access list:

1. The IP address of each node in your Atlas cluster. Use nslookup to get the IP address of each host in your cluster, using hostnames that Atlas generates:

   nslookup cluster0-shard-00-00-example.mongodb.net

   Note

   If the IP addresses of any of your nodes change, you must update the IP access list with the new IP addresses.

2. (Optional) The IP address of a machine you can run ldapsearch commands from to troubleshoot LDAP connection issues.

Create a bind user.

1. Create a new OneLogin user to use as the Atlas bind user. The bind user is a OneLogin user that you use to query the account and to authenticate database users' credentials when they connect to an Atlas database.

   The Email and Username fields are required when you create the bind user. You should enter the same email address in both of these fields.

   Important

   Don't use your own user account for the bind user.

2. Use the following template to determine the full Distinguished Name (DN) of your bind user:

   cn=<bind-user-email>,ou=users,dc=<onelogin-instance-id>,dc=onelogin,dc=com

   For example, if your <bind-user-email> is bind@example.com and your <onelogin-instance-id> is mdb-example, your bind user's DN is:

   cn=bind@example.com,ou=users,dc=mdb-example,dc=onelogin,dc=com

Assign privileges to the bind user.

In OneLogin, assign the bind user the Manage users, Manage group, or Super user privilege.

1. Navigate to your OneLogin Users page.

2. Click the bind user.

3. Click Add Privilege.

4. Select the privilege you want to grant the user, then click Continue.

5. Click Save User.

Set the bind user's password in OneLogin.

If you have not done so already, set a password for the bind user in OneLogin:

1. Click More Actions, then click Change Password.

2. Enter a password, then click Update.

Create database users in OneLogin.

If they don't exist already, create users in OneLogin that you want to grant database access to:

1. Navigate to your OneLogin users page.

2. Click New User.

3. Enter the user's details.

   The Email and Username fields are required when you create database users. Enter the same email address in both of these fields.

   Note

   Avoid entering email addresses with plus symbols (+). The Atlas LDAP integration may encounter issues with email addresses containing plus symbols.

4. Click Save User.

Set the database users' passwords in OneLogin.

If you have not done so already, set a password for each database user in OneLogin:

1. Navigate to your OneLogin users page.

2. Click the user you want to set a password for.

3. Click More Actions, then click Change Password.

4. Enter a password, then click Update.

In Atlas, go to the Advanced page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Advanced under the Security heading.

   The Advanced page displays.

Toggle the button next to LDAP Authentication to On.

Enter the server details and bind credentials for all of your LDAP servers in the Configure Your LDAP Server panel.

You may list multiple servers separated by commas. You cannot use different ports.

Add a User to DN Mapping.

Add a User to DN mapping similar to the following example to allow clients to provide their email addresses instead of full DNs when they connect to Atlas databases:

[
   {
       "match": "(.+)",
       "substitution": "cn={0},ou=users,dc=<onelogin_instance_id>,dc=onelogin,dc=com"
   }
]

Enter certificates issued from a Certificate Authority (CA) for your LDAP servers, separated by commas, in the CA Root Certificate field.

You may provide self-signed certificates.

Click Verify and Save.

Wait for Atlas to deploy your changes. Atlas verifies that your clusters can connect to, authenticate with, and query your LDAP servers using the configuration details that you provided.

In Atlas, go to the Database Access page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Database Access under the Security heading.

   The Database Access page displays.

Add LDAP users to Atlas

Add users managed in the OneLogin LDAP to Atlas.

1. Click Add New Database User.

2. Click LDAP User.

3. Perform one of the following:

   1. If you have not entered a User to DN Mapping, enter the full DN of the LDAP user. Follow this template:

      cn=<user-name>,ou=users,dc=<onelogin-instance-id>,dc=onelogin,dc=com

      For example, if your <user-name> is jane@example.com and your <onelogin-instance-id> is mdb-example, your bind user's DN is:

      cn=jane@example.com,ou=users,dc=mdb-example,dc=onelogin,dc=com

   2. If you entered a User to DN Mapping, enter the username or email address that your mapping requires.

4. Select the database access level to grant to the user.

5. Click Add User.

Create OneLogin database access groups.

Atlas LDAP authorization uses LDAP groups to determine if users are authorized to perform database actions.

Create separate OneLogin groups for each level of access that you want to grant to users. For example, you create one group for read access to one database, another for read and write access, and so on.

1. Navigate to your OneLogin groups page.

2. Click New Group.

3. Enter a group name, for example db-read.

4. Click Save.

Add OneLogin Users to database access groups.

Assign users to groups based on the level of access each user requires.

1. Navigate to your OneLogin Users page.

2. Click the user you want to add to a group.

3. Click the Authentication tab.

4. Select the group you want to add the user to.

5. Click Save User.

In Atlas, go to the Database Access page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Database Access under the Security heading.

   The Database Access page displays.

Add the database access LDAP groups to Atlas.

Add each of the OneLogin database groups you created to Atlas. Members of groups that you add are authorized to perform database actions granted to the group.

1. Click Add New Database User.

1. Click LDAP Group, and then enter the full DN of the group containing your database users, even if you enabled User to DN Mapping. Follow this template:

   cn=<group-name>,ou=groups,dc=<onelogin-instance-id>,dc=onelogin,dc=com

   For example, if your <group-name> is db-read and your <onelogin-instance-id> is mdb-example, your bind user's DN is:

   cn=db-read,ou=groups,dc=mdb-example,dc=onelogin,dc=com

1. Select the database access level to grant to users in this group.

2. Click Add User.

In Atlas, go to the Advanced page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Advanced under the Security heading.

   The Advanced page displays.

Toggle the button next to LDAP Authorization to On.

Verify the server details and bind credentials for your LDAP server are correct in the Configure Your LDAP Server panel.

Enter a query template in Query Template.

When a user attempts to perform an action, Atlas executes the LDAP query template to obtain the LDAP groups to which the authenticated user belongs. Atlas permits the action if the query returns at least one group that is authorized to perform the action. Atlas does not permit the action if the query returns no groups that are authorized to perform the action.

Atlas substitutes the authenticated username in the {USER} placeholder when it runs the query. The query is relative to the host specified in Server Hostname.

The formatting for the query must conform to RFC4515 and RFC 4516.

Enter the following Query Template:

{USER}?memberOf?base

Click Verify and Save.

Wait for Atlas to deploy your changes. Atlas verifies that your clusters can connect to, authenticate with, and query your LDAP server using the configuration details that you provide.

In Atlas, go to the Clusters page for your project.

1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

3. If it's not already displayed, click Clusters in the sidebar.

   The Clusters page displays.

Connect to your cluster with the user credentials that you added to Atlas.

Use mongosh to connect to your cluster. To copy the connection string:

1. Click Connect.

2. Click LDAP, and then click Copy.

3. Paste and edit the string with your User DN and password.

After connecting to your cluster, run commands to verify the user has the read or write privileges you assigned them.