> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Security Overview

To ensure the security of your MongoDB Agents, Ops Manager hosts, and MongoDB deployments, Ops Manager supports the following security options.

## TLS (Transport Layer Security) for Encrypted Connections

Ops Manager supports encrypted connections using TLS (Transport Layer Security) server or client certificates. Client certificates identify the *user* while server certificates identifies the *host*.

- The MongoDB Agent uses TLS (Transport Layer Security) server or client certificate that the legacy Automation Agent used.

  - If the legacy Monitoring Agent used its own TLS (Transport Layer Security) server or client certificate before the update to the MongoDB Agent, Monitoring continues to use that certificate.

  - If the legacy Backup Agent used its own TLS (Transport Layer Security) server or client certificate before the update to the MongoDB Agent, Backup continues to use that certificate.

- Ops Manager can [connect to its backing databases](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-ssl-connection-to-backing-mongodb.md) using TLS (Transport Layer Security) server or client certificates.

- Ops Manager users can connect to the Ops Manager console or API (Application Programming Interface) using TLS (Transport Layer Security) [server certificates.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-ssl-connection-to-web-interface.md)

## Authentication Mechanisms

### Authenticate with Deployments

Ops Manager supports these mechanisms to authenticate the Ops Manager Application and its Agents with your MongoDB processes:

| From | To | [MONGODB-CR](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-mongodbcr-authentication-for-group.md) | [SCRAM-SHA-1](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-mongodbcr-authentication-for-group.md) | [SCRAM-SHA-256](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-mongodbcr-authentication-for-group.md) | [x.509](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-x509-authentication-for-group.md) | [Kerberos](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-kerberos-authentication-for-group.md) | [LDAP](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-ldap-authentication-for-group.md) |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Ops Manager | [Backing Database](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-ssl-connection-to-backing-mongodb.md#std-label-configure-auth-backing) |  |  |  |  |  | |
| MongoDB Agent | [MongoDB Processes](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-ssl-for-a-deployment.md#std-label-set-project-ssl) |  |  |  |  |  | |
| Your Application Clients | [MongoDB Processes](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-ssl-for-a-deployment.md#std-label-set-project-ssl) |  |  |  |  |  | |

**Note:**

Kerberos and LDAP (Lightweight Directory Access Protocol) authentication is available with [MongoDB Enterprise](http://www.mongodb.com/products/mongodb-enterprise-advanced?tck=docs) only.

### Authenticate with Ops Manager

Ops Manager supports these mechanisms to authenticate with Ops Manager Application:

| From | To | Ops Manager DB | [LDAP](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-ldap-authentication.md) | [SAML](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) |
| --- | --- | --- | --- | --- |
| Ops Manager User | Ops Manager |  |  | |