> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Ops Manager Configuration Settings Ops Manager stores configuration settings both globally in the Ops Manager Application Database and locally on each server. Global settings apply to all your Ops Manager servers. Local settings apply to the server on which they are configured. Any local settings on a server override the global settings. You configure local settings through a server's `conf-mms.properties` file. Each server's `conf-mms.properties` must contain the connection string and authentication settings for accessing the Ops Manager Application Database. The `conf-mms.properties` file also contains any overrides of global settings specific to that server. The location of the `conf-mms.properties` file depends on how you installed Ops Manager, as described in the table below. | Install method | Location of `conf-mms.properties` | | --- | --- | | `rpm` or `deb` package | `/opt/mongodb/mms/conf/` | | `tar.gz` archive | `/conf/` | ## Bypass Initial Configuration Through the User Interface If you would like to skip the initial setup wizard after creating the first account and either edit the `conf-mms.properties` file or use the API to configure Ops Manager, change the following settings. This setting can help if you are automating the deployment of Ops Manager instances. *Type*: boolean Set this to `true` to allow full use of Ops Manager without requiring the first user account to complete the initial setup wizard. **Warning:** Ops Manager performs its regular pre-flight check to verify that it has all of the required settings. If one or more of those settings are not included in `conf-mms.properties`, Ops Manager refuses to start and lists which fields are missing in the log file. Before starting Ops Manager, add the following required settings to `conf-mms.properties` to enable basic Ops Manager functionality: | UI Setting | `conf-mms.properties` Setting | Necessity | | --- | --- | --- | | [`URL to Access Ops Manager`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-URL-to-Access-Ops-Manager) | [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl) | Required | | None | [`mongo.mongoUri`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) | Required | | [`Client Certificate Mode`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Client-Certificate-Mode) | [`mms.https.ClientCertificateMode`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.https.ClientCertificateMode) | Required | | [`"From" Email Address`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-From-Email-Address) | [`mms.fromEmailAddr`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.fromEmailAddr) | Required | | [`"Reply To" Email Address`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Reply-To-Email-Address) | [`mms.replyToEmailAddr`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.replyToEmailAddr) | Required | | [`Admin Email Address`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Admin-Email-Address) | [`mms.adminEmailAddr`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.adminEmailAddr) | Required | | [`Email Delivery Method Configuration`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Email-Delivery-Method-Configuration) | [`mms.emailDaoClass`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.emailDaoClass) | Required | | [`Transport`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Transport) | [`mms.mail.transport`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.transport) | Required | | [`SMTP Server Hostname`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SMTP-Server-Hostname) | [`mms.mail.hostname`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.hostname) | Required | | [`SMTP Server Port`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SMTP-Server-Port) | [`mms.mail.port`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.port) | Required | | [`User Authentication Method`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-User-Authentication-Method) | [`mms.userSvcClass`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.userSvcClass) | Optional | | [`Snapshot Interval (Hours)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Snapshot-Interval--Hours-) | [`brs.snapshotSchedule.interval`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.interval) | Optional | | [`Base Retention of Snapshots (in Days)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Base-Retention-of-Snapshots--in-Days-) | [`brs.snapshotSchedule.retention.base`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.retention.base) | Optional | | [`Daily Retention of Snapshots (in Days)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Daily-Retention-of-Snapshots--in-Days-) | [`brs.snapshotSchedule.retention.daily`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.retention.daily) | Optional | | [`Weekly Retention of Snapshots (in Weeks)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Weekly-Retention-of-Snapshots--in-Weeks-) | [`brs.snapshotSchedule.retention.weekly`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.retention.weekly) | Optional | | [`Monthly Retention of Snapshots (in Months)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Monthly-Retention-of-Snapshots--in-Months-) | [`brs.snapshotSchedule.retention.monthly`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.retention.monthly) | Optional | | [`Versions Directory`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Versions-Directory) | [`automation.versions.directory`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-automation.versions.directory) | Optional | **Note:** Fields marked as *Optional* have default values. If you want to change them, you can provide the setting and a new value. **Example:** The following values are examples. Substitute values appropriate to your Ops Manager installation. You may add any of the other settings specified in this reference. To configure an Ops Manager installation with the minimum functionality, add the following settings to `conf-mms.properties`: ```ini mms.ignoreInitialUiSetup=true mongo.mongoUri=mongodb://db1.example.com:27017,db2.example.com:27017,db3.example.com:27017 mms.centralUrl=http://localhost:8080 mms.fromEmailAddr=example@example.com mms.replyToEmailAddr=example@example.com mms.adminEmailAddr=example@example.com mms.mail.transport=smtp mms.mail.hostname=mail.example.com mms.mail.port=465 ``` ## All Clusters View *Type*: boolean *Default*: False Determines whether the [View All Clusters](https://www.mongodb.com/docs/ops-manager/current/tutorial/view-all-clusters.md) displays only the deployments to which an Ops Manager administrator belongs (set the value to `true`) or the deployments to which the administrator has access (set the value to `false`). ## Application Database Connection The following settings configure the Ops Manager connection to the [Ops Manager Application Database](https://www.mongodb.com/docs/ops-manager/current/core/system-overview.md#std-label-mms-application-database). You must configure this setting in the [conf-mms.properties](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#std-label-conf-mms.properties) file on each Ops Manager server. To encrypt authentication information, see [Encrypt User Credentials.](https://www.mongodb.com/docs/ops-manager/current/tutorial/encrypt-user-credentials.md#std-label-encrypt-mongodb-user-credentials) The [`mongo.mongoUri`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) setting is the part of the Ops Manager configuration responsible for the connection to the Application Database. If you deploy the Application Database as a replica set, set [`mongo.mongoUri`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) to a connection string that includes either all members of the replica set or a DNS (Domain Name System) seedlist for the replica set: ```ini mongo.mongoUri=mongodb://mongod1.example.com:40000,mongod2.example.com:40000,mongod3.example.com:40000 ``` If the Application Database uses authentication, the connection string must also include the credentials for the authentication mechanism that the database uses. To find the connection string format that matches your deployment type, protocol, and authentication method, use the selectors in [`mongo.mongoUri`.](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) *Type*: string [connection string](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-mongodb-uri) used to access the Ops Manager Application Database. If applicable, the connection string **must** include the authentication credentials for the [`authentication mechanism`](https://www.mongodb.com/docs/manual/reference/parameters.md#mongodb-parameter-param.authenticationMechanisms) used on the Ops Manager Application database. How you format your connection string depends on: - the type of cluster you deployed for your backing databases, - the protocol you use, and - the authentication method you use. If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all members of the replica set in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). ```ini mongo.mongoUri=mongodb://mongos1.example.com:40000,mongos2.example.com:40000 ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all members of the replica set in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). Prepend the MongoDB username and password to the hostname. Write the username and password in this format: **\:\@** ```ini mongo.mongoUri=mongodb://mongodbuser1:password@mongos1.example.com:40000,mongos2.example.com:40000 ``` **Note: Necessary MongoDB Roles** The MongoDB user that authenticates to the backing databases must have the following roles: - [`readWriteAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWriteAnyDatabase) - [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) - [`clusterAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterAdmin) if the database is a sharded cluster, otherwise [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all members of the replica set in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). Find the client certificate in the PEM (Privacy-Enhanced Mail) file you specified in the [`mongodb.ssl.PEMKeyFile`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.ssl.PEMKeyFile) setting. - Prepend the value of the *subject* from the [client certificate as a MongoDB user](https://www.mongodb.com/docs/manual/tutorial/configure-x509-client-authentication.md#std-label-x509-client-authentication) to the host. - Append **authMechanism=MONGODB-X509** to the specified port. ```ini mongo.mongoUri=mongodb://@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=MONGODB-X509 ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all members of the replica set in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). - Prepend the MongoDB username and password to the hostname in this format: **\:\@**. - Append the authentication mechanism to the port in this format: **authMechanism=PLAIN\&authSource=$external** ```ini mongo.mongoUri=mongodb://mongodbuser1:password@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=PLAIN&authSource=$external ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all members of the replica set in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). - Prepend the hostname with the Kerberos user principal. Write Kerberos UPN (User Principal Name)s as **\@\**. Escape the UPN (User Principal Name) using the URL (Uniform Resource Locator) encoded representation. A Kerberos user principal of **[username@REALM.EXAMPLE.COM](mailto:username@REALM.EXAMPLE.COM)** would therefore become **username%40REALM.EXAMPLE.COM**. - Append the authentication mechanism to the port in this format: **authMechanism=GSSAPI**. ```ini mongo.mongoUri=mongodb://username%40REALM.EXAMPLE.COM@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=GSSAPI ``` **Note: Modify Kerberos Settings** To enable Kerberos, modify the following settings: - [`jvm.java.security.krb5.conf`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.conf) - [`jvm.java.security.krb5.kdc`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.kdc) - [`jvm.java.security.krb5.realm`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.realm) - [`mms.kerberos.debug`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.debug) - [`mms.kerberos.keyTab`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.keyTab) - [`mms.kerberos.principal`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.principal) If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist, include the DNS (Domain Name System) record that describes your database's backing instance replica set. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) ```ini mongo.mongoUri=mongodb+srv://db.example.com:40000 ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist, include the DNS (Domain Name System) record that describes your database's backing instance replica set. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) Prepend the MongoDB username and password to the hostname. Write the username and password in this format: **\:\@** ```ini mongo.mongoUri=mongodb+srv://mongodbuser1:password@mongod.example.com:40000 ``` **Note: Necessary MongoDB Roles** The MongoDB user that authenticates to the backing databases must have the following roles: - [`readWriteAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWriteAnyDatabase) - [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) - [`clusterAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterAdmin) if the database is a sharded cluster, otherwise [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist, include the DNS (Domain Name System) record that describes your database's backing instance replica set. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) Find the client certificate in the PEM (Privacy-Enhanced Mail) file you specified in the [`mongodb.ssl.PEMKeyFile`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.ssl.PEMKeyFile) setting. - Prepend the value of the *subject* from the [client certificate as a MongoDB user](https://www.mongodb.com/docs/manual/tutorial/configure-x509-client-authentication.md#std-label-x509-client-authentication) to the host. - Append **authMechanism=MONGODB-X509** to the specified port. ```ini mongo.mongoUri=mongodb+srv://@mongod.example.com:40000/?authMechanism=MONGODB-X509 ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist, include the DNS (Domain Name System) record that describes your database's backing instance replica set. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) - Prepend the MongoDB username and password to the hostname in this format: **\:\@**. - Append the authentication mechanism to the port in this format: **authMechanism=PLAIN\&authSource=$external** ```ini mongo.mongoUri=mongodb+srv://mongodbuser1:password@mongod.example.com:40000/?authMechanism=PLAIN&authSource=$external ``` If you use a [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist, include the DNS (Domain Name System) record that describes your database's backing instance replica set. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) - Prepend the hostname with the Kerberos user principal. Write Kerberos UPN (User Principal Name)s as **\@\**. Escape the UPN (User Principal Name) using the URL (Uniform Resource Locator) encoded representation. A Kerberos user principal of **[username@REALM.EXAMPLE.COM](mailto:username@REALM.EXAMPLE.COM)** would therefore become **username%40REALM.EXAMPLE.COM**. - Append the authentication mechanism to the port in this format: **authMechanism=GSSAPI**. ```ini mongo.mongoUri=mongodb+srv://username%40REALM.EXAMPLE.COM@mongod.example.com:40000/?authMechanism=GSSAPI ``` **Note: Modify Kerberos Settings** To enable Kerberos, modify the following settings: - [`jvm.java.security.krb5.conf`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.conf) - [`jvm.java.security.krb5.kdc`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.kdc) - [`jvm.java.security.krb5.realm`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.realm) - [`mms.kerberos.debug`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.debug) - [`mms.kerberos.keyTab`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.keyTab) - [`mms.kerberos.principal`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.principal) If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all shards in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). ```ini mongo.mongoUri=mongodb://mongos1.example.com:40000,mongos2.example.com:40000 ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all shards in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). Prepend the MongoDB username and password to the hostname. Write the username and password in this format: **\:\@** ```ini mongo.mongoUri=mongodb://mongodbuser1:password@mongos1.example.com:40000,mongos2.example.com:40000 ``` **Note: Necessary MongoDB Roles** The MongoDB user that authenticates to the backing databases must have the following roles: - [`readWriteAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWriteAnyDatabase) - [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) - [`clusterAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterAdmin) if the database is a sharded cluster, otherwise [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all shards in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). Find the client certificate in the PEM (Privacy-Enhanced Mail) file you specified in the [`mongodb.ssl.PEMKeyFile`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.ssl.PEMKeyFile) setting. - Prepend the value of the *subject* from the [client certificate as a MongoDB user](https://www.mongodb.com/docs/manual/tutorial/configure-x509-client-authentication.md#std-label-x509-client-authentication) to the host. - Append **authMechanism=MONGODB-X509** to the specified port. ```ini mongo.mongoUri=mongodb://@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=MONGODB-X509 ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all shards in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). - Prepend the MongoDB username and password to the hostname in this format: **\:\@**. - Append the authentication mechanism to the port in this format: **authMechanism=PLAIN\&authSource=$external** ```ini mongo.mongoUri=mongodb://mongodbuser1:password@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=PLAIN&authSource=$external ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), with a standard connection string, include all shards in the URI (Uniform Resource Identifier). If you omit the port number, Ops Manager uses the default **27017** port for all hosts. **Note:** Ops Manager doesn't require the [replicaSet](https://www.mongodb.com/docs/manual/reference/connection-string-options.md#std-label-replica-set-option) option in the URI (Uniform Resource Identifier). - Prepend the hostname with the Kerberos user principal. Write Kerberos UPN (User Principal Name)s as **\@\**. Escape the UPN (User Principal Name) using the URL (Uniform Resource Locator) encoded representation. A Kerberos user principal of **[username@REALM.EXAMPLE.COM](mailto:username@REALM.EXAMPLE.COM)** would therefore become **username%40REALM.EXAMPLE.COM**. - Append the authentication mechanism to the port in this format: **authMechanism=GSSAPI**. ```ini mongo.mongoUri=mongodb://username%40REALM.EXAMPLE.COM@mongos1.example.com:40000,mongos2.example.com:40000/?authMechanism=GSSAPI ``` **Note: Modify Kerberos Settings** To enable Kerberos, modify the following settings: - [`jvm.java.security.krb5.conf`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.conf) - [`jvm.java.security.krb5.kdc`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.kdc) - [`jvm.java.security.krb5.realm`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.realm) - [`mms.kerberos.debug`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.debug) - [`mms.kerberos.keyTab`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.keyTab) - [`mms.kerberos.principal`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.principal) If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist,include the DNS (Domain Name System) record that describes your database's backing instance sharded cluster. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS (Domain Name System) seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) ```ini mongo.mongoUri=mongodb+srv://db.example.com:40000 ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist,include the DNS (Domain Name System) record that describes your database's backing instance sharded cluster. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS (Domain Name System) seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) Prepend the MongoDB username and password to the hostname. Write the username and password in this format: **\:\@** ```ini mongo.mongoUri=mongodb+srv://mongodbuser1:password@mongos.example.com:40000 ``` **Note: Necessary MongoDB Roles** The MongoDB user that authenticates to the backing databases must have the following roles: - [`readWriteAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWriteAnyDatabase) - [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) - [`clusterAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterAdmin) if the database is a sharded cluster, otherwise [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist,include the DNS (Domain Name System) record that describes your database's backing instance sharded cluster. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS (Domain Name System) seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) Find the client certificate in the PEM (Privacy-Enhanced Mail) file you specified in the [`mongodb.ssl.PEMKeyFile`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.ssl.PEMKeyFile) setting. - Prepend the value of the *subject* from the [client certificate as a MongoDB user](https://www.mongodb.com/docs/manual/tutorial/configure-x509-client-authentication.md#std-label-x509-client-authentication) to the host. - Append **authMechanism=MONGODB-X509** to the specified port. ```ini mongo.mongoUri=mongodb+srv://@mongos.example.com:40000/?authMechanism=MONGODB-X509 ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist,include the DNS (Domain Name System) record that describes your database's backing instance sharded cluster. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS (Domain Name System) seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) - Prepend the MongoDB username and password to the hostname in this format: **\:\@**. - Append the authentication mechanism to the port in this format: **authMechanism=PLAIN\&authSource=$external** ```ini mongo.mongoUri=mongodb+srv://mongodbuser1:password@mongos.example.com:40000/?authMechanism=PLAIN&authSource=$external ``` If you use a [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) for the database's [backing instance](https://www.mongodb.com/docs/ops-manager/current/tutorial/prepare-backing-mongodb-instances.md), your connection string that includes the hostname for the DNS (Domain Name System) seedlist,include the DNS (Domain Name System) record that describes your database's backing instance sharded cluster. The connection string uses the **mongodb+srv:** protocol, not the **mongodb:** protocol. This option requires a DNS (Domain Name System) record for the application database. The DNS (Domain Name System) entry uses the DNS (Domain Name System) seedlist string format. Make sure Ops Manager can connect to this application database. **See also:** [DNS Seedlist Connection Format](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-dns-seed-list-connection-format) - Prepend the hostname with the Kerberos user principal. Write Kerberos UPN (User Principal Name)s as **\@\**. Escape the UPN (User Principal Name) using the URL (Uniform Resource Locator) encoded representation. A Kerberos user principal of **[username@REALM.EXAMPLE.COM](mailto:username@REALM.EXAMPLE.COM)** would therefore become **username%40REALM.EXAMPLE.COM**. - Append the authentication mechanism to the port in this format: **authMechanism=GSSAPI**. ```ini mongo.mongoUri=mongodb+srv://username%40REALM.EXAMPLE.COM@mongos.example.com:40000/?authMechanism=GSSAPI ``` **Note: Modify Kerberos Settings** To enable Kerberos, modify the following settings: - [`jvm.java.security.krb5.conf`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.conf) - [`jvm.java.security.krb5.kdc`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.kdc) - [`jvm.java.security.krb5.realm`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-jvm.java.security.krb5.realm) - [`mms.kerberos.debug`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.debug) - [`mms.kerberos.keyTab`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.keyTab) - [`mms.kerberos.principal`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.kerberos.principal) *Type*: boolean To use encrypted credentials in [`mongo.mongoUri`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri), encrypt the credentials using the Ops Manager [credentialstool](https://www.mongodb.com/docs/ops-manager/current/tutorial/encrypt-user-credentials.md), enter them in the [`mongo.mongoUri`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) setting, and set this to `true`: ```ini mongo.encryptedCredentials=true ``` ### Kerberos Authentication to Ops Manager Application Database *Type*: boolean Debug flag to output more information on Kerberos authentication process. ```ini mms.kerberos.debug=false ``` *Type*: string Required if using Kerberos. The absolute path to the keytab file for the principal. ```ini mms.kerberos.keyTab=/path/to/mms.keytab ``` *Type*: string Required if using Kerberos. Principal used to authenticate with MongoDB. This should be the exact same user on the [`mongo.mongoUri`.](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongo.mongoUri) ```ini mms.kerberos.principal=mms/mmsweb.example.com@EXAMPLE.COM ``` *Type*: string Optional. Path to an alternate Kerberos configuration file. The value is set to JVM (Java Virtual Machine)'s `java.security.krb5.conf`. ```ini jvm.java.security.krb5.conf=/etc/conf/krb5.conf ``` *Type*: string Required if using Kerberos. IP/FQDN (fully qualified domain name) of the KDC (Key Distribution Center) server. The value will be set to JVM (Java Virtual Machine)'s `java.security.krb5.kdc`. ```ini jvm.java.security.krb5.kdc=kdc.example.com ``` *Type*: string Required if using Kerberos. This is the default realm for Kerberos. It is being used for JVM (Java Virtual Machine)'s `java.security.krb5.realm`. ```ini jvm.java.security.krb5.realm=EXAMPLE.COM ``` ### OIDC Authentication to Ops Manager Application Database Ops Manager and the Backup Daemon can authenticate to the [Ops Manager Application Database](https://www.mongodb.com/docs/ops-manager/current/core/system-overview.md#std-label-mms-application-database) using OIDC (OpenID Connect), in addition to the existing authentication mechanisms on this page. Ops Manager reads these settings from `conf-mms.properties` at startup. Changing any of these settings requires restarting Ops Manager; because the Backup Daemon reads the same `conf-mms.properties` file at startup, restart the Backup Daemon as well. These settings apply globally to every `mongo.*`-configured connection in `conf-mms.properties`, so all such connections share the same OIDC (OpenID Connect) configuration. *Type*: boolean *Default*: false Enables OIDC (OpenID Connect) authentication from Ops Manager and the Backup Daemon to the Ops Manager Application Database. OIDC (OpenID Connect) authentication is available in addition to existing authentication mechanisms; enabling it does not disable other configured mechanisms. ```ini mongo.oidcEnabled=true ``` *Type*: string The token acquisition method that Ops Manager uses to authenticate to the Ops Manager Application Database with OIDC (OpenID Connect). Set this option to one of the following values: - `callback`: Use the client credentials flow against a custom IdP (Identity Provider), such as Keycloak, Okta, or Azure. - `azure`: Use built-in environment authentication for a workload identity on Azure. - `gcp`: Use built-in environment authentication for a workload identity on GCP. - `k8s`: Use built-in environment authentication for a Kubernetes workload identity. For the `azure`, `gcp`, and `k8s` methods, the MongoDB driver obtains a workload identity token from the environment and does not require a client secret. ```ini mongo.oidcMethod=callback ``` *Type*: string The token endpoint URL of the IdP (Identity Provider). Ops Manager uses this endpoint to request access tokens using the client credentials flow. Required when [`mms.oidcMethod`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.oidcMethod) is `callback`. Not used for the `azure`, `gcp`, or `k8s` methods. ```ini mongo.oidcTokenUri=https://idp.example.com/realms/prod/protocol/openid-connect/token ``` *Type*: string The client identifier that Ops Manager presents to the IdP (Identity Provider) when requesting an access token. Required when [`mms.oidcMethod`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.oidcMethod) is `callback`. For the `azure` method, you can optionally set this to the client ID of a user-assigned managed identity; if you omit it, Ops Manager uses the system-assigned managed identity. Not used for the `gcp` or `k8s` methods. ```ini mongo.oidcClientId=ops-manager-appdb ``` *Type*: string The client secret that Ops Manager presents to the IdP (Identity Provider) when requesting an access token. Required when [`mms.oidcMethod`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.oidcMethod) is `callback`. Not used for the `azure`, `gcp`, or `k8s` methods, since those methods do not require a client secret. ```ini mongo.oidcClientSecret= ``` *Type*: string The OAuth2 scope that Ops Manager requests from the IdP (Identity Provider) when acquiring an access token using the client credentials flow. Used only when [`mms.oidcMethod`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.oidcMethod) is `callback`. Not used for the `azure`, `gcp`, or `k8s` methods. ```ini mongo.oidcScope=openid ``` *Type*: string The audience or resource identifier that Ops Manager requests when acquiring a workload identity token from the environment. This value must match the `audience` configured for this IdP (Identity Provider) in the target MongoDB deployment's `oidcIdentityProviders` setting. Required when [`mms.oidcMethod`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.oidcMethod) is `azure` or `gcp`. Not used for the `callback` or `k8s` methods. ```ini mongo.oidcTokenResource=https://my-mongodb-audience ``` **Important:** Ops Manager exposes OIDC (OpenID Connect) configuration for the Ops Manager Application Database only through `conf-mms.properties`. The Admin interface does not include a UI for this configuration. ### TLS/SSL Connection to the Application Database *Type*: boolean Enables TLS (Transport Layer Security) connection to the [Ops Manager Application Database](https://www.mongodb.com/docs/ops-manager/current/core/system-overview.md#std-label-mms-application-database) when set to `true`. *Type*: string Name of the PEM file that contains the root certificate chain from the Certificate Authority that signed the MongoDB server certificate. *Type*: string Name of the PEM file that contains the X509 certificate and private key. Required if the MongoDB instance is running with the [`--tlsCAFile`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#std-option-mongod.--tlsCAFile) option or [`net.tls.CAFile`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-net.tls.CAFile) setting. The `Extended Key Usage` field of that certificate should include `TLS Web client authentication`. If you authenticate using the `MONGODB-X509` authentication mechanism, you also enter this as the name of the user in the `mongoUri` connection string. *Type*: string Required if the PEM (Privacy-Enhanced Mail) file contains an encrypted private key. Specify the password for PEM (Privacy-Enhanced Mail) file. You can encrypt the password using the Ops Manager `encryptiontool`. ## Automation Default Paths *Type*: string *Default*: `/var/log/mongodb-mms-automation/backup-agent.log` Default path for the Backup logs on Linux/macOS. *Type*: string Default path for the Certificate Authority file on Linux/macOS. *Type*: string *Default*: `/data` Default data path for the MongoDB databases that Automation manages. *Type*: string *Default*: /var/lib/mongodb-mms-automation Default path for the Monitoring, Backup, and MongoDB binaries for the deployments managed by Automation on Linux/macOS. *Type*: string *Default*: `/var/log/mongodb-mms-automation/monitoring-agent.log` Default path for the Monitoring logs on Linux/macOS. *Type*: string FQDN (fully qualified domain name) of the Ops Manager Application to which the legacy Monitoring Agents or MongoDB Agents use to push monitoring data. Uses the value of [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl) if not set. **Important:** If you plan on accessing your Ops Manager Application using its IPv6 (Internet Protocol version 6) address, you must enclose the IPv6 (Internet Protocol version 6) address in square brackets (`[ ]`) to separate it from its port number. For example: ```ini http://[2600:1f16:777:8700:93c2:b99c:a875:2b10]:8080 ``` ## Backup *Type*: integer *Default*: 10 If the Backup experiences more than this number of consecutive failed conf calls, Ops Manager triggers the following [global alert](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-global-alerts.md): `Backup has too many conf call failures`. *Type*: integer *Default*: 85 If the [blockstore](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-backup-blockstore-database) uses at least this percentage of its total disk capacity, Ops Manager triggers the following [system alert](https://www.mongodb.com/docs/ops-manager/current/core/system-alerts.md): [`Blockstore space used exceeds threshold`.](https://www.mongodb.com/docs/ops-manager/current/core/system-alerts.md#mongodb-alert-Blockstore-space-used-exceeds-threshold) *Type*: string FQDN (fully qualified domain name) of the Ops Manager Application to which the legacy Backup Agents or MongoDB Agents use to send backup data. Uses the value of [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl) if not set. **Important:** If you plan on accessing your Ops Manager Application using its IPv6 (Internet Protocol version 6) address, you must enclose the IPv6 (Internet Protocol version 6) address in square brackets (`[ ]`) to separate it from its port number. For example: ```ini http://[2600:1f16:777:8700:93c2:b99c:a875:2b10]:8080 ``` *Type*: boolean *Default*: False This sets whether the [HEAD database](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-head-database) should use [journaling](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-journal). See [Manage Backup Jobs](https://www.mongodb.com/docs/ops-manager/current/admin/backup/jobs-page.md#std-label-manage-backup-jobs) to enable or disable journaling for the [head database](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-head-database) of a single backup job. [FCV](https://www.mongodb.com/docs/manual/reference/command/setFeatureCompatibilityVersion/#mongodb-dbcommand-dbcmd.setFeatureCompatibilityVersionbon.mon) `4.2` and later use [backup cursors](https://www.mongodb.com/docs/ops-manager/current/reference/glossary.md#std-term-backup-cursor) instead of [head databases](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-head-database) for backups. *Type*: float *Default*: 3 This sets the minimum number of hours of database operations that the oplog should record. Your deployment's oplog needs to be large enough to hold recovery data since the last snapshot. Increase this value to have Ops Manager monitor the oplog capacity. You should set this value to meet or exceed the value in [`brs.snapshotSchedule.interval`.](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.interval) If you set the value to less than [`brs.snapshotSchedule.interval`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.interval), you may have a gap between the last snapshot and the end of the oplog. This makes the backup unusuable for restores. Stale backup jobs must be resynchronized before it can be used for restores. *Type*: integer *Default*: 2 This sets the number of parallel upload workers that the MongoDB Agent uses when uploading snapshot blocks directly to S3 with Direct to S3 Backup. Ops Manager passes this value to the MongoDB Agent with each backup; the MongoDB Agent does not read it from its own local configuration. If you set this property, the MongoDB Agent uses that exact number of workers and skips its own auto-tuning. If you leave it unset, the MongoDB Agent sizes the worker count based on the host's CPU and memory. You can also override this value per backup job. To learn how to enable Direct to S3 Backup, see [Direct to S3 Backup in Ops Manager.](https://www.mongodb.com/docs/ops-manager/current/core/backup-direct-to-s3.md#std-label-om-direct-s3-backup) *Type*: integer *Default*: 100 This sets the maximum number of blocks per work unit for the Direct to S3 Backup upload path, when the MongoDB Agent splits snapshot files for parallel upload to S3. When this property is unset, the MongoDB Agent falls back to a built-in default of 100 blocks per work unit. To learn how to enable Direct to S3 Backup, see [Direct to S3 Backup in Ops Manager.](https://www.mongodb.com/docs/ops-manager/current/core/backup-direct-to-s3.md#std-label-om-direct-s3-backup) ### Backup Snapshots *Type*: integer *Default*: 6 Determines how much Ops Manager compresses file system-based snapshots. The level ranges from `0` to `9`: - `0` provides no compression. - `1` to `9` increases the degree of compression at a cost of how fast the snapshot is compressed. Level `1` compresses snapshots the least but at the fastest speed. Level `9` compresses snapshots the most but at the slowest speed. **Note:** Changing File System Store Gzip Compression Level affects new snapshots only. It does not affect the compression level of existing snapshots. Corresponds to [`File System Store Gzip Compression Level`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-File-System-Store-Gzip-Compression-Level) *Type*: string *Default*: SHA1 Specifies whether or not to generate a [SHA1](https://tools.ietf.org/html/3174) checksum for restore archive files. Accepted values are `SHA1` or `NONE`. Corresponds to [`Restore Digest Method`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Restore-Digest-Method) *Type*: integer *Default*: 24 Specifies the time, in hours, between two consecutive snapshots. Accepted values are: `6`, `8`, `12`, or `24` Corresponds to [`Snapshot Interval (Hours)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Snapshot-Interval--Hours-) *Type*: integer *Default*: 2 Specifies how many days an interval snapshot is stored. The accepted values vary depending upon the value of [`brs.snapshotSchedule.interval`:](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.interval) | [`brs.snapshotSchedule.interval`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-brs.snapshotSchedule.interval) | Accepted Values | | --- | --- | | < `24` | `2`, `3`, `4`, or `5`. | | = `24` | `2`, `3`, `4`, `5`, `6`, `7`, `8`, `9`, `10`, `11`, `12`, `13`, `14`, `15`, `16`, `17`, `18`, `19`, `20`, `21`, `22`, `23`, `24`, `25`, `26`, `27`, `28`, `29`, `30`. | Corresponds to `.Base Retention of Snapshots` *Type*: integer *Default*: 0 Specifies how many days a daily snapshot is stored. Accepted values are: `0`, `3`, `4`, `5`, `6`, `7`, `15`, `30`, `60`, `90`, `120`, `180` or `360` Corresponds to `.Daily Retention of Snapshots` *Type*: integer *Default*: 1 Specifies how many months a monthly snapshot is stored. Accepted values are: `0`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`, `9`, `10`, `11`, `12`, `13`, `18`, `24`, `36`, `48`, `60`, `72`, and `84` Corresponds to [`Monthly Retention of Snapshots (in Months)`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Monthly-Retention-of-Snapshots--in-Months-) *Type*: integer *Default*: 2 Specifies how many weeks a weekly snapshot is stored. Accepted values are: `0`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`, `12`, `16`, `20`, `24`, and `52` Corresponds to `.Weekly Retention of Snapshots` *Type*: integer *Default*: 24 Duration time in hours when you can [restore from a specific point-in-time (PIT).](https://www.mongodb.com/docs/ops-manager/current/tutorial/restore-pit-snapshot-http.md#std-label-restore-http-point) Corresponds to `.PIT Window` *Type*: string *Default*: None Specifies the hostname of a KMIP (Key Management Interoperability) server. Starting in MongoDB 4.2.1 (and 4.0.14), you can specify more than one KMIP (Key Management Interoperability) server in a comma-seperated list. **Important:** In MongoDB versions earlier than 4.0.14 or 4.2.1, Ops Manager uses only the first KMIP (Key Management Interoperability) hostname in a list of KMIP (Key Management Interoperability) server hostnames. Corresponds to [`KMIP Server Host`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-KMIP-Server-Host) *Type*: integer *Default*: None Specifies the port of the KMIP (Key Management Interoperability) server. Corresponds to [`KMIP Server Port`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-KMIP-Server-Port) *Type*: string *Default*: None Specifies a `.PEM`-format file that contains one or more certificate authorities. Corresponds to [`KMIP Server CA File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-KMIP-Server-CA-File) *Type*: integer *Default*: 2048 This sets the maximum cumulative size of files, in Megabytes, that are saved concurrently when taking a [snapshot.](https://www.mongodb.com/docs/ops-manager/current/reference/glossary.md#std-term-snapshot) *Type*: integer *Default*: 4 This sets the number of files that are saved concurrently when taking a [snapshot](https://www.mongodb.com/docs/ops-manager/current/reference/glossary.md#std-term-snapshot). Increasing the value of this setting can improve [backup job](https://www.mongodb.com/docs/ops-manager/current/reference/glossary.md#std-term-backup-job) performance when there are a large number of small files in a high latency environment. ### Queryable Snapshot Configuration *Type*: integer *Default*: 30 Number of seconds to wait for a connection to the Queryable Snapshot [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) instance before timing out. Corresponds to `Mongo .Connection Timeout` *Type*: integer *Default*: 24 Duration time in hours for a Queryable Snapshop once initiated. Corresponds to [`Expiration (Hours)`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Expiration--Hours-) *Type*: integer *Default*: 512 Size (in megabytes) that you allocate from the JVM (Java Virtual Machine) heap for the global snapshot cache. The global snapshot cache optimizes repeated queries for the same snapshot data to the Queryable Snapshots. **Important:** MongoDB does not advise changing this value unless MongoDB support directs you to change it. Corresponds to [`Read Cache Size (MB)`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Read-Cache-Size--MB-) *Type*: integer *Default*: 60 Number of seconds to wait for the Queryable Snapshot to prepare before timing out. Corresponds to `.Queryable Startup Timeout` *Type*: string Required if [`Proxy Server PEM File`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File) is encrypted. **Note:** After updating [`Proxy Server PEM File Password`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File-Password), restart the Web Server for the change to take effect. Corresponds to [`Proxy Server PEM File Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File-Password) *Type*: string Required if using Queryable Snapshot. PEM (Privacy-Enhanced Mail) file that contains the full certificate chain for one or more trusted certificates and the associated private keys. [`Proxy Server PEM File`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File) has the following restrictions: - This PEM file must be different than the one used for HTTPS (Hypertext Transfer Protocol Secure) connections to Ops Manager ([`mms.https.PEMKeyFile`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.https.PEMKeyFile)). - This PEM file should use a key length greater than 512-bit. Using a 2048-bit RSA key is recommended. - This PEM file should use a message digest stronger than `sha1`, such as `sha256`. **Note:** After updating [`Proxy Server PEM File`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File), restart the Web Server for the change to take effect. Corresponds to [`Proxy Server PEM File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-PEM-File) *Type*: integer *Default*: 25999 Port for the queryable backup host. **Note:** After updating [`Proxy Server Port`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-Port), restart the Web Server for the change to take effect. Corresponds to [`Proxy Server Port`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Server-Port) *Type*: string *Default*: SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.3 TLS (Transport Layer Security) protocol versions that have been disabled for queryable snapshots and restores. *Type*: string *Default*: TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 List of TLS (Transport Layer Security) ciphers suites that your Ops Manager instance can't accept when clients connect to the queryable backup host. Specify TLS (Transport Layer Security) cipher suite names as a comma-separated list with no whitespace between entries. ## Diagnostic Archive *Type*: integer *Default*: 10000 Maximum number of entries that Ops Manager should retrieve from the [activity feed.](https://www.mongodb.com/docs/ops-manager/current/reference/audit-events.md#std-label-activity-feed) *Type*: integer *Default*: 7 Maximum number of days of data that Ops Manager should retrieve from the [activity feed.](https://www.mongodb.com/docs/ops-manager/current/reference/audit-events.md#std-label-activity-feed) *Type*: integer *Default*: 7 Maximum number of days of data that Ops Manager should retrieve from the [activity feed.](https://www.mongodb.com/docs/ops-manager/current/reference/audit-events.md#std-label-activity-feed) *Type*: integer *Default*: 7 Add the last specified days of the **automationLastAgentStatus** in diagnostic archive. *Type*: boolean *Default*: False Flag that indicates whether to add **automationConfigs** for groups with non-empty processes array in diagnostic archive. ## Email *Type*: string Email address used for sending the general emails, such as Ops Manager alerts. You can include an alias with the email address. ```ini mms.fromEmailAddr=mms-alerts@example.com ``` Corresponds to [`From Email Address`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-From-Email-Address) *Type*: string Email address from which to send replies to general emails. Corresponds to [`Reply To Email Address`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Reply-To-Email-Address) *Type*: string Email address of the Ops Manager admin. This address receives emails related to problems with Ops Manager. Corresponds to [`Admin Email Address`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Admin-Email-Address) *Type*: string *Default*: `SIMPLE_MAILER` Email interface to use. This setting is labeled in different ways for the user interface and the configuration file. | Delivery Method | Configuration Setting (`mms.emailDaoClass`) | | --- | --- | | AWS (Amazon Web Services) SES (Simple Email Service) | `AWS_MAILER` | | SMTP (Simple Mail Transport Protocol) | `SIMPLE_MAILER` | If you set this to SMTP (Simple Mail Transport Protocol) Email Server, you must set: - [`mms.mail.transport`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.transport) - [`mms.mail.hostname`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.hostname) - [`mms.mail.port`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.port) - [`mms.mail.username`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.username) - [`mms.mail.password`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.password) - [`mms.mail.tls`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.mail.tls) If you set this to AWS (Amazon Web Services) Simple Email Service, you must set: - [`aws.ses.endpoint`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-aws.ses.endpoint) - [`aws.accesskey`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-aws.accesskey) - [`aws.secretkey`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-aws.secretkey) Corresponds to [`Email Delivery Method Configuration`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Email-Delivery-Method-Configuration) ### SMTP Email Server *Conditional.* The following settings appear if you set [`mms.emailDaoClass`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.emailDaoClass) to `SIMPLE_MAILER`. *Type*: string *Default*: smtp Transfer protocol your email provider specifies: - `smtp` (standard SMTP (Simple Mail Transport Protocol)) Corresponds to [`Transport`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Transport) *Type*: string *Default*: localhost Email hostname your email provider specifies. ```ini mms.mail.hostname=mail.example.com ``` Corresponds to [`SMTP Server Hostname`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SMTP-Server-Hostname) *Type*: number *Default*: 25 Port number for SMTP (Simple Mail Transport Protocol) your email provider specifies. Corresponds to [`SMTP Server Port`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SMTP-Server-Port) *Type*: string User name of the email account. If unset, defaults to disabled SMTP (Simple Mail Transport Protocol) authentication. Corresponds to [`Username`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Username) *Type*: string Password for the email account. If left blank, this setting disables SMTP (Simple Mail Transport Protocol) authentication. Corresponds to [`Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Password) *Type*: boolean *Default*: False Set this to `true` if the transfer protocol uses TLS (Transport Layer Security). Corresponds to [`Use SSL`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Use-SSL) ### AWS Simple Email Service *Conditional.* The following settings appear if you set [`mms.emailDaoClass`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.emailDaoClass) to `AWS_MAILER`. *Type*: string *Default*: `https://email.us-east-1.amazonaws.com` Sets the [sending API endpoint](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/regions.html#region-endpoints) for the AWS (Amazon Web Services) SES (Simple Email Service). Corresponds to [`AWS Endpoint`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-AWS-Endpoint) *Type*: string Access key ID for AWS (Amazon Web Services). Corresponds to [`AWS Access Key`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-AWS-Access-Key) *Type*: string Secret access key for AWS (Amazon Web Services). Corresponds to [`AWS Secret Key`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-AWS-Secret-Key) ## HTTP Proxy *Type*: string Specify the hostname of the HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext Transfer Protocol Secure) proxy to which you wish to connect. ```ini http.proxy.host=proxy.example.com ``` Corresponds to [`Proxy Host`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Host) *Type*: integer Specify the port on which you wish to connect to the host. You must specify both the [`Proxy Port`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Port) and [`Proxy Host`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Host) to use a proxy. Corresponds to [`Proxy Port`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Port) *Type*: string If the proxy requires authentication, use this setting to specify the username with which to connect to the proxy. Corresponds to [`Proxy Username`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Username) *Type*: string If the proxy requires authentication, use this setting to specify the password with which to connect to the proxy. Corresponds to [`Proxy Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Proxy-Password) *Type*: string Specify a pipe-separated (`|`) list of internal hosts to bypass the outgoing proxy that you configured. ```ini *.foo.com|localhost ``` Corresponds to [`Non Proxy Hosts`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Non-Proxy-Hosts) ### Kubernetes Setup *Type*: string Path to the YAML file that contains your [Programmatic API Key](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-programmatic-api-keys.md#std-label-mms-prog-api-key) as a Kubernetes secret to create or update [objects](https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/) in your Ops Manager project. This file must be in YAML format and must be stored under the `/mongodb-ops-manager/` directory. This file corresponds to [`Kubernetes Secret Setup`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Kubernetes-Secret-Setup) ```yaml apiVersion: v1 kind: Secret metadata: name: organization-secret namespace: mongodb stringData: user: ${publicKey} publicApiKey: ${privateKey} ``` *Type*: string Path to the YAML file that contains the ConfigMap to use to link to your Ops Manager project. This file must be in YAML format and must be stored under the `/mongodb-ops-manager/` directory. This file corresponds to [`Kubernetes ConfigMap Setup`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Kubernetes-ConfigMap-Setup) ## MongoDB Version Management *Type*: string *Default*: `remote` Indicates the source of MongoDB installer binaries. Accepted values for [`automation.versions.source`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-automation.versions.source) and the conditions that must exist to set the value are: | Value | Condition | | --- | --- | | `remote` | Ops Manager and Agents have Internet access. | | `hybrid` | Ops Manager has Internet access, but Agents do not. Ops Manager downloads MongoDB binaries from the Internet; Agents download the binaries from Ops Manager. | | `local` | Neither Ops Manager nor the Agents have Internet access. An Ops Manager administrator must upload the version manifest and the MongoDB binaries to the Ops Manager host, as described in [Configure Deployment to Have Limited Internet Access.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-local-mode.md) | Corresponds to [`Installer Download Source`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Installer-Download-Source) *Type*: string *Default*: downloads.mongodb.com, downloads.mongodb.org, fastdl.mongodb.org, opsmanager.mongodb.com HTTP(S) endpoint to fetch MongoDB binaries from. If the endpoint is an HTTPS endpoint, the Certificate Authority file specified by [`httpsCAFile`](https://www.mongodb.com/docs/ops-manager/current/reference/mongodb-agent-settings.md#mongodb-setting-httpsCAFile) will be used to validate the certificate. If `automation.versions.download.baseUrl` is unset, MongoDB uses the default remote URLs for MongoDB binaries. Corresponds to [`Base URL`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Base-URL) *Type*: boolean *Default*: True When set to `true`, Ops Manager limits the MongoDB versions you can specify to those available for your deployment. This setting is applied only when [`automation.versions.download.baseUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-automation.versions.download.baseUrl) is set with a custom value. *Type*: string *Default*: `/opt/mongodb/mms/mongodb-releases/` Specify the directory on the Ops Manager Application server where Ops Manager stores the MongoDB binaries. The Automation accesses the binaries when installing or changing versions of MongoDB on your deployments. If you set `Version Manifest Source` to run in `Local` mode, the Backup Daemons also access the MongoDB binaries from this directory. See [Configure Deployment to Have Limited Internet Access](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-local-mode.md) for more information. Corresponds to [`Versions Directory`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Versions-Directory) *Type*: boolean *Default*: True Flag indicating whether the Backup Daemons automatically install the versions of MongoDB that the Backup Daemons need. | `true` | The daemons retrieve the binaries from MongoDB Inc. over the Internet. | | --- | --- | | `false` | Backup Daemons do not have Internet access and require that an Ops Manager administrator manually download and extract every archived version of a MongoDB release that the backup daemons need. The administrator must place the extracted binaries into the [`Versions Directory`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Versions-Directory) on the Ops Manager hosts. | **Warning:** Set to `false` when Ops Manager is running in [Local Mode.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-local-mode.md) Corresponds to [`Backup Versions Auto Download`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Backup-Versions-Auto-Download) *Type*: boolean Flag indicating whether the Backup Daemons automatically install the Enterprise editions of the versions of MongoDB that the Backup Daemons need. Requires [`mongodb.release.autoDownload`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.release.autoDownload) be set to `true`. **Warning:** If you plan on running [MongoDB Enterprise](http://www.mongodb.com/products/mongodb-enterprise-advanced?tck=docs) on Linux hosts, then you must manually install a set of dependencies to each host *before installing MongoDB*. The MongoDB manual provides the appropriate command to install the dependencies. See [Configure Deployment to Have Limited Internet Access.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-local-mode.md) Corresponds to [`Backup Versions Auto Download Enterprise Builds`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Backup-Versions-Auto-Download-Enterprise-Builds) *Type*: string Specifies whether to use MongoDB Community or Enterprise binaries for [backup.](https://www.mongodb.com/docs/ops-manager/current/tutorial/nav/backup-deployments.md) Accepted values are: - `enterprisePreferred` - `enterpriseRequired` - `communityRequired` When `enterpriseRequired` or `communityRequired` is selected, Ops Manager only uses those binaries for backup. When `enterprisePreferred` is selected, Ops Manager uses Enterprise binaries if available and Community binaries if they are not. **Note:** When `enterpriseRequired` is selected, you must either set [`mongodb.release.autoDownload.enterprise`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mongodb.release.autoDownload.enterprise) to `true` or manually place Enterprise binaries in the [`automation.versions.directory`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-automation.versions.directory) in [Local Mode.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-local-mode.md) **Warning:** Backup fails when either `enterpriseRequired` or `communityRequired` is selected, but the [`automation.versions.directory`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-automation.versions.directory) does not contain the required binary. Corresponds to [`Required Module For Backup`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Required-Module-For-Backup) ## MongoDB Usage *Type*: string *Default*: `PRODUCTION_SERVER` Default MongoDB Enterprise server type for all Enterprise processes that this Ops Manager instance manages. In the configuration file, set this parameter to one of the following values: - `PRODUCTION_SERVER` - `TEST_SERVER` - `DEV_SERVER` - `RAM_POOL` - `RAM_POOL_TEST` - `BACKING_DATABASE` Ops Manager uses this value only when the host, its project, and its organization don't specify a server type. To set the server type for a specific host, use the [MongoDB Usage Page](https://www.mongodb.com/docs/ops-manager/current/admin/general/mongodb-usage-page.md#std-label-mongodb-usage-page). Ops Manager bases usage reporting on each host's own server type. The following table describes the environment purpose and license requirement for each server type. The table uses the server type labels that appear in the Ops Manager UI, not the configuration file values listed above: | Server Intention | Environment Purpose | License Requirement | | --- | --- | --- | | Production Server | Hosts your application to your internal or external end users. If an end user might use an environment, it functions as a Production environment. This applies whether the environment also provides testing, quality assurance, evaluation, or development capabilities. | One license per server | | Test/QA Server | This type of environment can be used to: TestExercises your application to verify that it works as designed and expected. The platform configuration might be a less performant version of Production in compute, network, and storage capability.Assure system qualityValidates your application against a combination of data, hardware, and software configured to simulate Production. The platform configuration must be a smaller scale of Production in compute, network, and storage capability.StageSimulates the Production environment including performance testing and release candidate approval. The platform configuration must mirror Production in compute, network, and storage capability. | One license per server | | Development Server | Hosts in progress design, code, debugging, or some combination thereof for your application. Used to evaluate if the current state of your application can be promoted to another environment. | None | | RAM Pool | Provides any combination of servers for any environment purpose. | One license for any number of servers up to the maximum of the total GB of RAM you purchased across these servers. | | Backing Database | Hosts your Ops Manager backing database. [Enable Application Database Monitoring](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-appdb-monitoring.md#std-label-enable-application-database-monitoring) to enable this option. | None | Corresponds to [`Default Ops Manager MongoDB Server Type`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Default-Ops-Manager-MongoDB-Server-Type) *Type*: boolean Enables the MongoDB Usage UI in the Ops Manager Admin if set to `true`. Corresponds to [`MongoDB Usage UI`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-MongoDB-Usage-UI) *Type*: boolean *Default*: False Enables the daily collection of MongoDB Usage Data if set to `true`. Corresponds to [`MongoDB Usage Data Collection`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-MongoDB-Usage-Data-Collection) ## Monitoring *Type*: string FQDN (fully qualified domain name) of the Ops Manager Application to which the legacy Monitoring Agents or MongoDB Agents use to push monitoring data. Uses the value of [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl) if not set. **Important:** If you plan on accessing your Ops Manager Application using its IPv6 (Internet Protocol version 6) address, you must enclose the IPv6 (Internet Protocol version 6) address in square brackets (`[ ]`) to separate it from its port number. For example: ```ini http://[2600:1f16:777:8700:93c2:b99c:a875:2b10]:8080 ``` ### Monitoring Failover You can [activate the Monitoring function](https://www.mongodb.com/docs/ops-manager/current/tutorial/mongodb-agent-functions.md#std-label-activate-monitoring) on multiple MongoDB Agents to distribute monitoring assignments and provide failover. Ops Manager distributes monitoring assignments among up to 100 running MongoDB Agents. Each MongoDB Agent running active Monitoring monitors a different set of MongoDB processes. One MongoDB Agent running active Monitoring per project is the primary Monitor. The primary Monitor reports the cluster's status to Ops Manager. As MongoDB Agents have Monitoring enabled or disabled, Ops Manager redistributes assignments. If the primary Monitor fails, Ops Manager assigns another MongoDB Agent running active Monitoring to be the primary Monitor. The following settings tune the interval Ops Manager uses to determine if a Monitoring is unaccessible and the frequency with which standby agents poll Ops Manager to determine if they should receive monitoring assignments. *Type*: integer *Default*: 90000 Interval that Ops Manager uses to determine if a standby agent should start monitoring. If Ops Manager does not hear from a Monitoring for the duration specified, Ops Manager promotes a standby agent. Configuring the timeout below `90000` (90 seconds) will cause Ops Manager to fail at startup with a configuration error. *Type*: integer *Default*: 4 Specifies how frequently a standby agent checks in with Ops Manager to see if it should start monitoring. The following values are permitted: | Value | Standby Agents Check Frequency | | --- | --- | | `1` | Every 55 seconds | | `2` | Every 27 seconds | | `3` | Every 18 seconds | | `4` | Every 14 seconds | ## Ops Manager Administration API *Type*: boolean Certain API (Application Programming Interface) calls require that requests originate from a [IP address in the access list](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-public-api-access.md#std-label-access-list-for-api-operations). To turn off this requirement, add this setting and set its value to `false`. ## Prometheus You must configure the following settings to enable the metrics that are available for ingestion through Prometheus. You can also configure these settings in the Custom tab of the [Ops Manager Config](https://www.mongodb.com/docs/ops-manager/current/admin/general/ops-manager-config-page.md#std-label-admin-console-general-om-config) page in the [Administration Console : General Tab.](https://www.mongodb.com/docs/ops-manager/current/admin/admin-tab-general.md#std-label-admin-console-general-tab) After configuring these settings, you must restart Ops Manager on each instance. After restarting, the new Prometheus endpoint can be accessed at a URL (Uniform Resource Locator) in the following format: ```shell http(s)://:/metrics ``` **Note:** You can designate a listening port for the Prometheus metrics. This doesn't have to be the default port that Ops Manager uses, 8080 for HTTP (Hypertext Transfer Protocol) or 8443 for HTTPS (Hypertext Transfer Protocol Secure). Ensure that your network allows traffic to the specified Prometheus metrics port. After enabling, you must configure a new scrape config similar to the following in Prometheus for each Ops Manager server that you would like to gather statistics from. ```shell scrape_configs: - job_name: 'opsmanager' static_configs: - targets: [:] ``` Note that each server's endpoint only provides metrics for the same server. *Type*: boolean Flag that specifies whether to enable access for Prometheus. To enable Ops Manager Prometheus endpoint, set value to `true`. If omitted, defaults to `false`. *Type*: number The port over which Ops Manager listens for requests to the Prometheus endpoint. The port must be different than the port Ops Manager is already listening on, 8080 for HTTP (Hypertext Transfer Protocol) or 8443 for HTTPS (Hypertext Transfer Protocol Secure). Every server will listen on the specified port. So, ensure that the port is available as an open port on every server. If you want to specify different port for each server, use `conf-mms.properties` instead to specify the ports. ## Push Live Migrations *Type*: string Base URL for Live Migration from Ops Manager to Atlas, such as `https://cloud.mongodb.com`. *Type*: boolean If set to `true`, allows Ops Manager to request information about Live Migration processes, such as: - The list of available projects and deployments that can be used as sources for Live Migrations. - The list of available configured migration hosts that can facilitate Live Migrations in their respective deployments and projects. - The current status of running Live Migrations in Atlas. Ops Manager uses this information to facilitate Live Migration processes. The default is `true`. *Type*: boolean The repeat interval, in seconds, between sync refreshes. The syncs of the organization's project information between Ops Manager and Atlas occur periodically. The default interval between syncs is `60`. Ops Manager expects sync refreshes to occur within an interval from 10 to 43200 seconds (12 hours). If the actual interval between sync refreshes is longer than 43200 seconds or if the actual interval between sync refreshes is longer than 1800 seconds (30 minutes) during the validation phase, the Live Migration to Atlas might stall, time out, or fail. **Note:** After updating this setting, restart the Web Server for the change to take effect. *Type*: boolean The interval, in seconds, between information sync refreshes for an organization's project. The default interval between sync refreshes is `10`. Ops Manager expects sync refreshes to occur within an interval from 10 to 43200 seconds (12 hours). If the actual interval between consecutive syncs is longer than 43200 seconds, the Live Migration to Atlas might stall, time out, or fail. **Note:** After updating this setting, restart the Web Server for the change to take effect. *Type*: boolean The repeat interval, in seconds, for syncing the Live Migration plan updates from Atlas.The plan lists the steps in the Atlas migration process. Ops Manager periodically retrieves the current plan from Atlas to check progress. Without this information, Ops Manager does not move the Live Migration process to the next stage. The default interval between syncs is `60`. Ops Manager expects sync refreshes to occur within an interval from 10 to 43200 seconds (12 hours). If the actual interval between consecutive syncs is longer than 43200 seconds, the Live Migration to Atlas might stall, time out, or fail. **Note:** After updating this setting, restart the Web Server for the change to take effect. *Type*: boolean Indicates whether to show Live Migration hosts as available agents in the Add new deployment view under Projects in the user interface. The default is `false`. **See also:** - [Modifying a Custom Setting](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) - [Migrate from Ops Manager to Atlas](https://www.mongodb.com/docs/ops-manager/current/tutorial/migrate-to-atlas.md#std-label-migrate-to-atlas) ## Security *Type*: boolean *Default*: False When `true`, Ops Manager makes all HTTP (Hypertext Transfer Protocol) responses not cacheable. *Type*: integer *Default*: 0 (Can use HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext Transfer Protocol Secure).) How long (in seconds) Ops Manager limits browser connections to use HTTPS (Hypertext Transfer Protocol Secure). This value must be a positive integer. A value of `0` means that it can use HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext Transfer Protocol Secure). **See also:** To learn how to deploy HSTS (HTTP Strict Transport Security), see [HTTP Strict Transport Security](https://en.wikipedia.org/w/index.php?title=HTTP_Strict_Transport_Security\&oldid=774831831), [RFC 6797](https://tools.ietf.org/html/6797) and [hstspreload.org](https://hstspreload.org/#deployment-recommendations). *Type*: boolean *Default*: True When `false`, Ops Manager doesn't display the version number in the login page. ### Non-Uniform Memory Access (NUMA) *Type*: boolean To disable NUMA for the [head databases](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-head-database), follow the [Modify a Custom Setting](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) procedure using the following values: | Key | `mongodb.disable.numa` | | --- | --- | | Value | `true` | To learn more about NUMA, see [MongoDB and NUMA Hardware](https://www.mongodb.com/docs/manual/administration/production-notes.md#std-label-production-numa) in the MongoDB Production Notes. **Important:** Each Ops Manager instance with Backup Daemons enabled must have the `numactl` service installed. If `numactl` is not installed and this setting is set to `true`, backup jobs fail. Ops Manager can encrypt any backup job. Use [backup cursors](https://www.mongodb.com/docs/ops-manager/current/reference/glossary.md#std-term-backup-cursor) instead of [head databases](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-head-database) to encrypt backup jobs. For more information, see [Backup Daemon Service.](https://www.mongodb.com/docs/ops-manager/current/core/system-overview.md#std-label-backup-daemon) ## Data Explorer The following setting controls the availability of the Data Explorer feature in Ops Manager. *Type*: string *Default*: `controlled` Globally controls the availability of the Data Explorer feature in Ops Manager. The default value `controlled` persists until you explicitly change it to `enabled` or `disabled`. When set to `disabled`, users cannot access the Data Explorer in any project. This setting overrides any project-level Data Explorer settings. | Value | Description | | --- | --- | | `controlled` | (**Default**) Administrators can enable or disable Data Explorer on a per-Organization or per-Project basis. | | `enabled` | Data Explorer is globally enabled for all Organizations and Projects. | | `disabled` | Data Explorer is globally disabled. Users cannot access Data Explorer in any Project. | **See also:** To learn how to add this setting, see [Modifying a Custom Setting.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) ## Third-Party Integrations ### Datadog Integration *Type*: string *Default*: `https://api.datadoghq.com/api/v1` URL (Uniform Resource Locator) that Ops Manager uses to access the Datadog API. Enable this custom parameter if you have deployed Datadog locally. Set this to a value appropriate for your deployment. **See also:** To learn how to add this setting, see [Modifying a Custom Setting.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) ### Opsgenie Integration *Type*: string *Default*: `https://api.opsgenie.com/v2/alerts` URL (Uniform Resource Locator) that Ops Manager uses to access the Ops Genie API (Application Programming Interface) in European countries. Enable this custom parameter if your Ops Manager instance runs in Europe. Then, set its value to `https://api.eu.opsgenie.com/v2/alerts`. For more information, see [Opsgenie Alert documentation.](https://docs.opsgenie.com/docs/alert-api#:~:text=If%20using%20the%20EU%20instance,for%20requests%20to%20be%20successful.) **See also:** To learn how to add this setting, see [Modifying a Custom Setting.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) ### Twilio Integration To receive alert notifications via SMS (short message service) or 2FA (two-factor authentication) code, you must have a [Twilio](http://www.twilio.com/docs/quickstart) account. *Type*: string [Twilio](http://www.twilio.com/docs/quickstart) account ID. Corresponds to [`Account SID`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Account-SID) *Type*: string Twilio API (Application Programming Interface) token. Corresponds to [`Twilio Auth Token`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Twilio-Auth-Token) *Type*: string Twilio phone number. Corresponds to [`Twilio From Number`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Twilio-From-Number) ## User Authentication *Type*: string *Default*: false Determines if Ops Manager requires usernames to be email addresses. | Value | Description | | --- | --- | | `false` | (**Default**) Username is not required to be an email address. | | `loose` | Username must contain an `@` symbol followed by a period. | | `strict` | Username must adhere to a strict email address validation regular expression. | If set to `strict`, Ops Manager uses the following regular expression to validate that an email address adheres to the requirements described in Section 3 of [RFC-3696:](https://tools.ietf.org/html/3696) ```sh ^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ ``` **Example:** `jane.smith@example.com` is valid. `jane.smith@ex@mple.com` is not. Corresponds to [`Username Validation`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Username-Validation) *Type*: string *Default*: `UserSvcDb` Select whether to store authentication credentials in the Ops Manager Application Database or in an LDAP (Lightweight Directory Access Protocol) directory. Accepted values are: | Auth Method | Accepted Value | | --- | --- | | Application Database | `UserSvcDb` IMPORTANT: In Ops Manager 6.0, the accepted value is `com.xgen.svc.mms.svc.user.UserSvcDb`. If you use this old accepted value, your Ops Manager instance will not start during preflight checks. | | LDAP (Lightweight Directory Access Protocol) | `UserSvcLdap` | | SAML (Security Assertion Markup Language) | `UserSvcSaml` | Corresponds to [`User Authentication Method`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-User-Authentication-Method) ### Authentication through Ops Manager Application Database *Type*: number Number of days a password is valid before the password expires. Corresponds to [`Days Before Password Change Required`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Days-Before-Password-Change-Required) *Type*: number Maximum number of days with no visits to the Ops Manager website before Ops Manager locks an account. Corresponds to [`Days Inactive Before Account Lock`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Days-Inactive-Before-Account-Lock) *Type*: number Number of failed login attempts before an account becomes locked. Only an an Ops Manager Administrator can unlock a locked account. Corresponds to [`Failed Login Attempts Before Account Lock`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Failed-Login-Attempts-Before-Account-Lock) *Type*: number Number of previous passwords to remember. You cannot reuse a remembered password as a new password. Corresponds to [`Password Changes Before Reuse`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Password-Changes-Before-Reuse) *Type*: number Number of logins a user from a specific IP address can attempt during a timeout period. You must configure this setting alongside [`Login Attempts Timeout Period`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Login-Attempts-Timeout-Period) Corresponds to [`Login Attempts Allowed Before Timeout`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Login-Attempts-Allowed-Before-Timeout) *Type*: number This setting specifies: - The time period (in minutes) used to determine if too many login attempts have been made. - The duration that accounts are locked before you can resume login attempts. You must configure this setting alongside [`Login Attempts Allowed Before Timeout`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Login-Attempts-Allowed-Before-Timeout) **Important:** The dropdown menu lists the only possible values for this setting. Attempting to set a value in your `conf-mms.properties` file or [local database](https://www.mongodb.com/docs/manual/reference/local-database.md#std-label-replica-set-local-database) that is not listed in the dropdown causes an error when restarting the Ops Manager instance. Corresponds to [`Login Attempts Timeout Period`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Login-Attempts-Timeout-Period) *Type*: boolean If true, new users can register by invitation only. The invitation provides a URL (Uniform Resource Locator) that displays the registration link. If false, new users can register if they have the Ops Manager URL (Uniform Resource Locator). Corresponds to [`Invitation Only Mode`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Invitation-Only-Mode) *Type*: boolean *Default*: False This checkbox appears when you set `mms.userSvcClass` to `UserSvcDb`. | Value | Results | | --- | --- | | `true` | You can add existing users to any organization or project without an invitation.; Ops Manager deletes and invalidates any pending invitations.; *New* users continue to receive and must accept invitations. | | `false` | *All* users continue to receive and must accept invitations. | Corresponds to [`Bypass Invitation Mode`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Bypass-Invitation-Mode) *Type*: number Number of iterations for the `pbkdf2` hashing algorithm. Corresponds to [`Password Hashing Iterations`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Password-Hashing-Iterations) ### Authentication through LDAP These settings configure Ops Manager to use an LDAP server for authentication. If you use LDAP authentication, users must belong to an LDAP group to log into Ops Manager. You must create LDAP groups for each Ops Manager [user role.](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md) *Settings that begin with* `mms.ldap.global.role` assign Ops Manager [global roles](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-roles) to the members of the specified LDAP groups. Specify groups using the format used by the LDAP attribute specified in the [`LDAP User Group`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Group) setting. You can specify multiple groups using the `;;` delimiter. To change the default delimiter, use the [`mms.ldap.group.separator`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.group.separator) setting. Each Ops Manager global role provides its level of access to all the Ops Manager [projects](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-projects.md) in the deployment. To provide access to specific groups, use [group-level roles.](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md) *Type*: string LDAP (Lightweight Directory Access Protocol) user used to execute searches for other users. ```ini mms.ldap.bindDn=authUser@acme.example.com ``` Corresponds to [`LDAP Bind Dn`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Bind-Dn) *Type*: string Password for the search user. ```ini mms.ldap.bindPassword= ``` Corresponds to [`LDAP Bind Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Bind-Password) *Type*: string LDAP (Lightweight Directory Access Protocol) group whose members have the [global automation admin role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-automation-admin-role) in Ops Manager. Specify projects using the format used by the LDAP (Lightweight Directory Access Protocol) attribute specified in the [`LDAP User Group`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Group) setting. You can specify multiple projects using the `;;` delimiter. To change the default delimiter, use the `mms.ldap.project.separator` setting. ```ini mms.ldap.global.role.automationAdmin=CN\=MMS-AutomationAdmin,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Each Ops Manager global role provides its level of access to all the Ops Manager [projects](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-projects.md) in the deployment. To provide access to specific projects, use [group-level roles.](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-roles) Corresponds to [`LDAP Global Role Automation Admin`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-Automation-Admin) *Type*: string LDAP (Lightweight Directory Access Protocol) group whose members have the [global backup admin role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-backup-admin-role) in Ops Manager. ```ini mms.ldap.global.role.backupAdmin=CN\=MMS-BackupAdmin,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP Global Role Backup Admin`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-Backup-Admin) *Type*: string LDAP (Lightweight Directory Access Protocol) group whose members have the [global monitoring admin role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-monitoring-admin-role) in Ops Manager. ```ini mms.ldap.global.role.monitoringAdmin=CN\=MMS-MonitoringAdmin,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP Global Role Monitoring Admin`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-Monitoring-Admin) *Type*: string LDAP (Lightweight Directory Access Protocol) group that has full privileges for the Ops Manager deployment, including full access to all Ops Manager [projects](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-projects.md) and all administrative permissions. Users in the specified LDAP (Lightweight Directory Access Protocol) group receive the [global owner](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-owner-role) role in Ops Manager. Specify the project using the format that is used by the LDAP (Lightweight Directory Access Protocol) attribute specified in the [`LDAP User Group`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Group) setting. ```ini mms.ldap.global.role.owner=CN\=MMSGlobalOwner,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP Global Role Owner`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-Owner) *Type*: string LDAP (Lightweight Directory Access Protocol) group whose members have the [global read-only role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-read-only-role) in Ops Manager. ```ini mms.ldap.global.role.readOnly=CN\=MMS-ReadOnly,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP Global Role Read Only`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-Read-Only) *Type*: string LDAP (Lightweight Directory Access Protocol) group whose members have the [global user admin role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-user-admin-role) in Ops Manager. ```ini mms.ldap.global.role.userAdmin=CN\=MMS-UserAdmin,OU\=MMS,OU\=acme Groups,DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP Global Role User Admin`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Global-Role-User-Admin) *Type*: string *Default*: [`LDAP User Base Dn`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Base-Dn) value Base Distinguished Name (DN) that Ops Manager uses to search for groups. If left blank, this setting uses the default value. ```ini mms.ldap.group.baseDn=OU\=groups,DC\=acme,DC\=com ``` Corresponds to [`LDAP Group Base Dn`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Group-Base-Dn) *Type*: string Field on the group entry containing user Distinguished Names (DN). The [groupOfNames](https://tools.ietf.org/html/4519#section-3.5) or [groupOfUniqueNames](https://tools.ietf.org/html/4519#section-3.6) object classes are commonly used. ```ini mms.ldap.group.member=member ``` Corresponds to [`LDAP Group Member Attribute`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Group-Member-Attribute) *Type*: string *Default*: `;;` To set the LDAP (Lightweight Directory Access Protocol) separator, follow the [Modify a Custom Setting](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) procedure using the following values: | Key | `mms.ldap.group.separator` | | --- | --- | | Value | `` | Each of the global role values takes a delimited list of projects: ```ini "dbas,sysadmins" ``` If a group value contains the delimiter, the delimiter must be set to another value. **Example:** If you have the group value `"CN\=foo,DN\=bar"` and the delimiter is `,` then Ops Manager parses `"CN\=foo,DN\=bar"` as two elements rather than as the description for a single group. *Type*: string LDAP (Lightweight Directory Access Protocol) field used to set how to handle referrals. Accepts two values: - `ignore`: Ignore referrals. - `follow`: Automatically follow any referrals. Corresponds to [`LDAP Referral`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-Referral) *Type*: string A file containing one or more trusted certificates in PEM format. Use this setting if you are using LDAPS (Secure Lightweight Directory Access Protocol) and the server is using a certificate that is not from a well-known Certificate Authority. ```ini mms.ldap.ssl.CAFile=/opt/CA.pem ``` Corresponds to [`LDAP SSL CA File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-SSL-CA-File) *Type*: string A file containing a client certificate and private key. Use this setting when your TLS (Transport Layer Security) LDAP (Lightweight Directory Access Protocol) server requires client certificates. ```ini mms.ldap.ssl.PEMKeyFile=/opt/keyFile.pem ``` Corresponds to [`LDAP SSL PEM Key File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-SSL-PEM-Key-File) *Type*: string Password for [`LDAP SSL PEM Key File`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-SSL-PEM-Key-File). Use this setting if the `PEMKeyFile` is encrypted. ```ini mms.ldap.ssl.PEMKeyFilePassword= ``` Corresponds to [`LDAP SSL PEM Key File Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-SSL-PEM-Key-File-Password) *Type*: string URI (Uniform Resource Identifier) for the LDAP (Lightweight Directory Access Protocol) or LDAPS (Secure Lightweight Directory Access Protocol) server. ```ini mms.ldap.url=ldaps://acme-dc1.acme.example.com:3890 ``` Corresponds to [`LDAP URI`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-URI) *Type*: string Base Distinguished Name (DN) that Ops Manager uses to search for users. Escape the `=` sign with `\`. ```ini mms.ldap.user.baseDn=DC\=acme,DC\=example,DC\=com ``` Corresponds to [`LDAP User Base Dn`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Base-Dn) *Type*: string *Default*: `mail` per [RFC2256](https://tools.ietf.org/html/2256) LDAP (Lightweight Directory Access Protocol) user attribute that contains the user's email address. After successful LDAP (Lightweight Directory Access Protocol) authentication, Ops Manager synchronizes the specified LDAP (Lightweight Directory Access Protocol) attribute with the email address from the Ops Manager user record. ```ini mms.ldap.user.email=mail ``` Corresponds to [`LDAP User Email`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Email) *Type*: string *Default*: `givenName` per [RFC2256](https://tools.ietf.org/html/2256) LDAP (Lightweight Directory Access Protocol) user attribute that contains the user's first name. After successful LDAP (Lightweight Directory Access Protocol) authentication, Ops Manager synchronizes the specified LDAP (Lightweight Directory Access Protocol) attribute with the first name from the Ops Manager user record. ```ini mms.ldap.user.firstName=givenName ``` Corresponds to [`LDAP User First Name`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-First-Name) *Type*: string LDAP (Lightweight Directory Access Protocol) user attribute that contains the list of LDAP (Lightweight Directory Access Protocol) groups the user belongs to. The LDAP (Lightweight Directory Access Protocol) attribute can use any format to list the projects, including Common Name (`cn`) or Distinguished Name (`dn`). All Ops Manager settings in this configuration file that specify projects must match the chosen format. **Important:** Ops Manager deprecated [`mms.ldap.user.group`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.user.group). Use [`mms.ldap.group.member`.](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.group.member) If you provide values for: - Both [`mms.ldap.user.group`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.user.group) and [`mms.ldap.group.member`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.group.member), Ops Manager uses [`mms.ldap.group.member`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.group.member) and ignores [`mms.ldap.user.group`.](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.user.group) - [`mms.ldap.user.group`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.ldap.user.group) only, Ops Manager doesn't recognize the user's membership in nested LDAP groups. ```ini mms.ldap.user.group=memberOf ``` Corresponds to [`LDAP User Group`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Group) *Type*: string *Default*: `surname` per [RFC2256](https://tools.ietf.org/html/2256) LDAP (Lightweight Directory Access Protocol) user attribute that contains the user's last name. After successful LDAP (Lightweight Directory Access Protocol) authentication, Ops Manager synchronizes the specified LDAP (Lightweight Directory Access Protocol) attribute with the last name from the Ops Manager user record. ```ini mms.ldap.user.lastName=sn ``` Corresponds to [`LDAP User Last Name`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Last-Name) *Type*: string LDAP (Lightweight Directory Access Protocol) field used for the LDAP (Lightweight Directory Access Protocol) search. This is typically a username or an email address. The value of this field is also used as the Ops Manager username. ```ini mms.ldap.user.searchAttribute= ``` Corresponds to [`LDAP User Search Attribute`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-LDAP-User-Search-Attribute) *Type*: boolean Indicator as to the user should be notified that they have logged in from a new device. Corresponds to [`New Device Login Notification`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-New-Device-Login-Notification) ### Authentication through SAML *Type*: string URI (Uniform Resource Identifier) of the Identity Provider (IdP (Identity Provider)) that you use to coordinate your Single Sign-On. This might be referred to as the *EntityId* or the *Identity Provider Issuer*. *Type*: string URL (Uniform Resource Locator) of the Single Sign-On endpoint that Ops Manager calls when a user attempts to sign in. *Type*: string URL (Uniform Resource Locator) of the Single Logout endpoint that Ops Manager calls when a user attempts to log out. If set, when a user attempts to log out of Ops Manager, they log out of your IdP (Identity Provider). If left blank, logging out of Ops Manager doesn't log the user out of their IdP (Identity Provider) session. *Type*: string Certificate provided by your IdP (Identity Provider) that Ops Manager uses to verify its validity to the IdP (Identity Provider). *Type*: string Absolute path to the PEM file for the certificate that the SP (Service Provider) uses to sign requests, containing both the private and public key. If this is left blank, Ops Manager doesn't sign SAML (Security Assertion Markup Language) auth requests to the IdP (Identity Provider) and you can't encrypt SAML (Security Assertion Markup Language) assertions. *Type*: string Required if the PEM (Privacy-Enhanced Mail) file contains an encrypted private key. Specify the password for PEM (Privacy-Enhanced Mail) file. *Type*: boolean Flag that indicates whether or not the IdP (Identity Provider) encrypts the assertions it sends to Ops Manager. *Type*: boolean *Default*: `true` Flag that indicates whether or not the IdP (Identity Provider) signs the assertions it sends to Ops Manager. **Important:** Ensure that either the assertions or the response are signed. The configuration will fail the verification and Ops Manager returns an error if either the assertions or the response aren't signed. Corresponds to [`SAML Signed Assertions`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SAML-Signed-Assertions) *Type*: boolean *Default*: `true` Flag that indicates whether or not the IdP (Identity Provider) signs the responses it sends to Ops Manager. **Important:** Ensure that either the assertions or the response are signed. The configuration will fail the verification and Ops Manager returns an error if either the assertions or the response aren't signed. Corresponds to [`SAML Signed Messages`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SAML-Signed-Messages) *Type*: string Algorithm to encrypt the signature sent to and from the IdP (Identity Provider). You must use one of the following full W3.org signature algorithm values: - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha1` - `http://www.w3.org/2000/09/xmldsig#dsa-sha1` - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha256` - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha384` - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha512` **Important:** You must specify the complete W3.org signature algorithm URL, not a simple string value. Using simple string values, such as `rsa-sha256`, causes Ops Manager to return an `unauthorized` error because the IdP (Identity Provider) cannot validate the signatures properly. **Example:** ```text mms.saml.signature.algorithm=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 ``` *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have full privileges over this deployment, including full access to all groups and all administrative permissions. *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have the [`Global Automation Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Automation-Admin) role. *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have the [`Global Backup Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Backup-Admin) role. *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have the [`Global Monitoring Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Monitoring-Admin) role. *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have the [`Global User Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-User-Admin) role. *Type*: string Group in the SAML (Security Assertion Markup Language) Group Member Attribute whose members have the [`Global Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Read-Only) role. *Type*: string SAML (Security Assertion Markup Language) User Attribute that contains the user's first name. *Type*: string SAML (Security Assertion Markup Language) User Attribute that contains the user's last name. *Type*: string SAML (Security Assertion Markup Language) User Attribute that contains the user's email address. *Type*: string *Default*: `groups` SAML (Security Assertion Markup Language) Attribute that contains the list of groups Ops Manager uses to map roles to Projects and Organizations. Corresponds to [`SAML Group Member Attribute`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-SAML-Group-Member-Attribute) ### Authentication through OIDC You can configure Ops Manager to use OIDC (OpenID Connect) to authenticate users through an external identity provider. For the full setup procedure, see [Configure Ops Manager Users for OIDC (OpenID Connect) Authentication.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-oidc-authentication.md#std-label-security-oidc) *Type*: string Issuer URI (Uniform Resource Identifier) or OIDC (OpenID Connect) metadata discovery document URL (Uniform Resource Locator) for your IdP (Identity Provider). Corresponds to [`Issuer URI`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Issuer-URI) *Type*: string Client identifier that your IdP (Identity Provider) assigns to Ops Manager. Corresponds to [`Client ID`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Client-ID) *Type*: string Client secret that your IdP (Identity Provider) assigns to Ops Manager. Corresponds to [`Client Secret`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Client-Secret) *Type*: string PEM (Privacy-Enhanced Mail)-encoded certificate authority certificate or certificates to trust when Ops Manager connects to your IdP (Identity Provider). Use this setting when your IdP (Identity Provider) uses a self-signed or private certificate authority. You can concatenate multiple certificates. Corresponds to [`Custom CA Certificate (PEM)`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Custom-CA-Certificate--PEM-) *Type*: boolean *Default*: true Enables PKCE (Proof Key of Code Exchange) for the authorization code flow. Ops Manager enables this setting by default. Disable this setting only if your IdP (Identity Provider) doesn't support PKCE (Proof Key of Code Exchange) for confidential clients. Corresponds to [`Enable PKCE (Proof Key for Code Exchange)`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Enable-PKCE--Proof-Key-for-Code-Exchange-) *Type*: string List of scopes that Ops Manager requests from the authorization endpoint. Corresponds to [`Requested Scopes`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Requested-Scopes) *Type*: string Base URL (Uniform Resource Locator) for the OIDC (OpenID Connect) service provider. If you don't set this value, Ops Manager uses [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl). Use this setting when you need a different URL (Uniform Resource Locator) to access Ops Manager. Corresponds to [`Service Provider Base URL`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Service-Provider-Base-URL) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global Owner`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Owner) role. Global Owners have full privileges over this deployment, including all administrative permissions. Corresponds to [`Global Role Owner Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-Role-Owner-Groups) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global Automation Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Automation-Admin) role. Corresponds to [`Global Automation Admin Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-Automation-Admin-Groups) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global Backup Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Backup-Admin) role. Corresponds to [`Global Backup Admin Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-Backup-Admin-Groups) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global Monitoring Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Monitoring-Admin) role. Corresponds to [`Global Monitoring Admin Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-Monitoring-Admin-Groups) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global User Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-User-Admin) role. Corresponds to [`Global User Admin Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-User-Admin-Groups) *Type*: string Comma-separated list of IdP (Identity Provider) groups whose members receive the [`Global Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Global-Read-Only) role. Corresponds to [`Global Read Only Groups`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Global-Read-Only-Groups) *Type*: string *Default*: given\_name Claim that contains the user's first name. Corresponds to [`OIDC Claim for User First Name`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-OIDC-Claim-for-User-First-Name) *Type*: string *Default*: family\_name Claim that contains the user's last name. Corresponds to [`OIDC Claim for User Last Name`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-OIDC-Claim-for-User-Last-Name) *Type*: string *Default*: email Claim that contains the user's email address. Corresponds to [`OIDC Claim for User Email`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-OIDC-Claim-for-User-Email) *Type*: string *Default*: groups Claim that contains the list of groups that Ops Manager uses to map roles to organizations and projects. Corresponds to [`OIDC Claim for Group Member`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-OIDC-Claim-for-Group-Member) ### Multi-Factor Authentication (MFA) *Type*: string *Default*: OFF Configures the [two-factor authentication](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-two-factor-authentication.md) "level": | Setting | Description | | --- | --- | | `OFF` | Disables two-factor authentication. Ops Manager does not use two-factor authentication. | | `OPTIONAL` | Users can choose to set up two-factor authentication for their Ops Manager account. | | `REQUIRED_FOR_GLOBAL_ROLES` | Users who possess a [global role](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#std-label-global-roles) *must* set up two-factor authentication. Two factor authentication is optional for all other users. | | `REQUIRED` | *All* users must set up two-factor authentication for their Ops Manager account. | Two-factor authentication is recommended for the security of your Ops Manager deployment. **Warning:** If enabling `mms.multiFactorAuth.level` through the configuration file, you must create a [user account](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-users.md#std-label-add-users) first before updating the configuration file. Otherwise, you cannot login to Ops Manager. **Note:** If you enable [Twilio integration](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-two-factor-authentication.md#std-label-enable-twilio) (optional), ensure that Ops Manager servers can access the `twilio.com` domain. Corresponds to [`Multi-factor Auth Level`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Multi-factor-Auth-Level) *Type*: boolean *Default*: False When `true`, Ops Manager allows users to reset their two-factor authentication settings via email in an analogous fashion to resetting their passwords. To reset two-factor authentication, a user must: - be able to receive email at the address associated with the user account. - know the user account's password. - know the [agent API key](https://www.mongodb.com/docs/ops-manager/current/reference/glossary/#std-term-agent-api-key) for each Ops Manager project the user belongs to. Corresponds to [`Multi-factor Auth Allow Reset`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Multi-factor-Auth-Allow-Reset) *Type*: string If Google Authenticator provides two-factor authentication, this string is the `issuer` in the Google Authenticator app. If left blank, the `issuer` is the domain name of the Ops Manager installation. Corresponds to [`Multi-factor Auth Issuer`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Multi-factor-Auth-Issuer) *Type*: boolean *Default*: False When `true`, Ops Manager will require two-factor authentication for users to log in or to perform certain destructive operations within the application. If you configure [Twilio integration](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-twilio-sms-alert-settings), users may obtain their second factor tokens via Google Authenticator, SMS, or voice calls. Otherwise, the only mechanism to provide two-factor authentication is Google Authenticator. ### reCaptcha and Session Length *Type*: boolean *Default*: false Indicator as to you want a new user to validate themselves using reCaptcha validation when they register to use Ops Manager. Set to `true` to require [reCaptcha](https://www.google.com/recaptcha) validation when a new user registers. This setting requires a [reCaptcha account](https://www.google.com/recaptcha/admin). Corresponds to [`ReCaptcha Enabled On Registration`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-ReCaptcha-Enabled-On-Registration) *Type*: boolean *Default*: false Indicator as to you want a user to validate themselves using reCaptcha validation when they log into Ops Manager. Set to `true` to require [reCaptcha](https://www.google.com/recaptcha) validation when a user logs in. This setting requires a [reCaptcha account](https://www.google.com/recaptcha/admin). Corresponds to `ReCaptcha Enabled`. *Type*: string ReCaptcha private key associated with your account. Corresponds to [`ReCaptcha Private Key`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-ReCaptcha-Private-Key) *Type*: string ReCaptcha public key associated with your account. Corresponds to [`ReCaptcha Public Key`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-ReCaptcha-Public-Key) *Type*: number Number of hours before a session on the Ops Manager website expires. **Note:** Session Max Hours reflects the total Ops Manager session time, not just idle time. Both active and idle sessions expire when Session Max Hours elapses. Set this value to `0` to use browser session cookies only. Corresponds to [`Session Max Hours`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Session-Max-Hours) *Type*: String Either `None` or `Idle`. `None` disables idle session timeout. `Idle` logs users out after a period of inactivity. *Type*: number The maximum amount of time in minutes that a session can be active with no user activity. ## Web Server *Type*: string FQDN (fully qualified domain name) and port number of the Ops Manager Application. To use a port other than `8080`, see [Manage Ops Manager Hostname and Ports.](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-ports.md) ```ini mms.centralUrl=http://mms.example.com:8080 ``` Corresponds to [`URL to Access Ops Manager`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-URL-to-Access-Ops-Manager) **Important:** If you plan on accessing your Ops Manager Application using its IPv6 (Internet Protocol version 6) address, you must enclose the IPv6 (Internet Protocol version 6) address in square brackets (`[ ]`) to separate it from its port number. For example: ```ini http://[2600:1f16:777:8700:93c2:b99c:a875:2b10]:8080 ``` *Type*: string Absolute path to the PEM file that contains the Ops Manager Application's valid certificate and private key. The PEM file is required if the Ops Manager Application uses HTTPS (Hypertext Transfer Protocol Secure) to encrypt connections between the Ops Manager Application, the agents, and the web interface. The default port for HTTPS (Hypertext Transfer Protocol Secure) access to the Ops Manager Application is `8443`, as set in `/conf/mms.conf` file. If you change this default, you must also change the port specified in the [`mms.centralUrl`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.centralUrl) setting. Corresponds to [`HTTPS PEM Key File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-HTTPS-PEM-Key-File) *Type*: string Password for the HTTPS (Hypertext Transfer Protocol Secure) PEM key file. You must include this setting if the PEM (Privacy-Enhanced Mail) key file contains an encrypted private key. Corresponds to [`HTTPS PEM Key File Password`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-HTTPS-PEM-Key-File-Password) *Type*: string Specifies if Ops Manager requires clients to present valid TLS (Transport Layer Security) client certificates when connecting to it. Accepted values are: - `none` - `agents_only` - `required` These values are case-sensitive. Corresponds to [`Client Certificate Mode`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Client-Certificate-Mode) *Type*: string Required if: - You are using a private certificate authority. - You set [`mms.https.ClientCertificateMode`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.https.ClientCertificateMode) to `agents_only` or `required`. - You run Ops Manager in hybrid mode with TLS (Transport Layer Security) enabled. Specifies the filesystem location of a private certificate authority file containing the list of acceptable client certificates. The Ops Manager Application authenticates HTTPS (Hypertext Transfer Protocol Secure) requests from clients bearing a certificate described in this file. ```ini mms.https.CAFile=/path/to/ca_file.pem ``` Corresponds to [`CA File`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-CA-File) *Type*: boolean *Default*: False Enables connections to Ops Manager using HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) concurrently. You can use this setting temporarily while you upgrade Ops Manager and the MongoDB Agents to use TLS (Transport Layer Security). To ensure zero downtime, set to `true` and provide a value for [`mms.http.bindhostname`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.http.bindhostname). After you configure Ops Manager and the MongoDB Agents, set to `false`. **Important:** Ops Manager is accessible using insecure connections while `mms.https.dualConnectors` is `true`. Set `mms.https.dualConnectors` to `false` to allow secure connections only after you have updated the MongoDB Agents to use TLS (Transport Layer Security) connections. *Type*: string *Default*: 127.0.0.1 The hostname or IP (Internet Protocol) at which MongoDB Agents can connect to Ops Manager using HTTP (Hypertext Transfer Protocol). You can use this setting temporarily while you upgrade Ops Manager and the MongoDB Agents to use TLS (Transport Layer Security). To ensure zero downtime, set a value and set [`mms.https.dualConnectors`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.https.dualConnectors) to `true`. After you configure Ops Manager and the MongoDB Agents, remove the value. *Type*: string If you use a load balancer with the Ops Manager Application, set this to the HTTP (Hypertext Transfer Protocol) header field the load balancer uses to identify the originating client's IP address to the Ops Manager host. When you specify [`Load Balancer Remote IP Header`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Load-Balancer-Remote-IP-Header), do not allow clients to connect directly to any Ops Manager host. A load balancer placed in front of the Ops Manager hosts must not return cached content. Once [`Load Balancer Remote IP Header`](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Load-Balancer-Remote-IP-Header) is set, Ops Manager enables the following HTTP (Hypertext Transfer Protocol) headers: | HTTP (Hypertext Transfer Protocol) Header | Forwards to Ops Manager | | --- | --- | | [X-Forwarded-Host](https://tools.ietf.org/html/7239#section-5.3) | Original host that the client requested in the Host HTTP (Hypertext Transfer Protocol) request header. | | [X-Forwarded-Proto](https://tools.ietf.org/html/7239#section-5.4) | Protocol used to make the HTTP (Hypertext Transfer Protocol) request. | | [X-Forwarded-Server](https://www.eclipse.org/jetty/javadoc/current/org/eclipse/jetty/server/ForwardedRequestCustomizer.html) | Hostname of the proxy server. | | [X-Proxied-Https](https://www.eclipse.org/jetty/javadoc/current/org/eclipse/jetty/server/ForwardedRequestCustomizer.html) | HTTPS (Hypertext Transfer Protocol Secure) status of a request. | To learn more, see [Configure a Highly Available Ops Manager Application.](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-application-high-availability.md) Corresponds to [`Load Balancer Remote IP Header`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Load-Balancer-Remote-IP-Header) *Type*: string *Default*: `TLSv1.2` Specifies the TLS (Transport Layer Security) version required for clients to connect to Ops Manager. This property affects all clients, such as browsers used to connect to the Ops Manager Admin interface and command-line tools, such as `curl`, used to connect to the REST (Representational State Transfer) API (Application Programming Interface). Ops Manager versions between 4.0.9 and 4.0.18 and earlier than 4.2.13 and 4.4.0 Ops Manager supports `TLSv1.2` only. If you change this value to anything other than `TLSv1.2`, including a blank value, you can't connect to this Ops Manager. Ops Manager versions 4.0.0 to 4.0.8, 4.0.18 or later, 4.2.13 or later, 4.4.0 or later Ops Manager supports `TLSv1.0`, `TLSv1.1` and `TLSv1.2`. **Note:** TLSv1.2 requires connecting clients to meet the following minimum requirements: - Browser supports TLS (Transport Layer Security) version 1.2 - `curl` version 7.34.0+ - OpenSSL version 1.0.1+ To set `minimum.TLSVersion`, follow the [Modify a Custom Setting](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) procedure with the following values: | Key | `minimum.TLSVersion` | | --- | --- | | Value | `` | *Type*: string *Default*: `SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA`, `SSL_DHE_DSS_WITH_DES_CBC_SHA`, `SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA`, `SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA`, `SSL_DHE_RSA_WITH_DES_CBC_SHA`, `SSL_RSA_EXPORT_WITH_DES40_CBC_SHA`, `SSL_RSA_EXPORT_WITH_RC4_40_MD5`, `TLS_DHE_DSS_WITH_AES_128_CBC_SHA256`, `TLS_DHE_DSS_WITH_AES_128_CBC_SHA`, `TLS_DHE_DSS_WITH_AES_256_CBC_SHA256`, `TLS_DHE_DSS_WITH_AES_256_CBC_SHA`, `TLS_DHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_DHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_DHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_DHE_RSA_WITH_AES_256_CBC_SHA256`, `TLS_DHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_DHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384` Specifies a list of TLS (Transport Layer Security) cipher suites which your instance of Ops Manager can't accept when clients connect to the Ops Manager Application and API (Application Programming Interface). Specify TLS (Transport Layer Security) cipher suite names as a comma-separated list, as in the following example. **Important:** Cipher suite names used in Ops Manager must follow [RFC 5246](https://tools.ietf.org/html/5246#appendix-C) naming conventions. Do not use the OpenSSL naming convention. For convenience, Ops Manager logs a list of all supported cipher suite names during startup. If Ops Manager does not recognize a TLS (Transport Layer Security) cipher suite name, it logs the following warning: Your config lists the following as ciphers which should be disabled as the JDK (Java Development Kit) does not recognize them. Please check the format of the entries and list of enabled ciphers. \[*unrecognized\_cipher\_name*] To change [`mms.disableCiphers`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.disableCiphers), follow the [Modify a Custom Setting](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#std-label-opsmgr-config-add-custom) procedure with the following values: | Key | `mms.disableCiphers` | | --- | --- | | Value | `` For example: `TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256` | **Warning:** Setting [`mms.disableCiphers`](https://www.mongodb.com/docs/ops-manager/current/reference/configuration.md#mongodb-setting-mms.disableCiphers) to a custom value could re-enable one or more of these disabled ciphers. ## Webhook *Type*: string Corresponds to [`Webhook URL`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Webhook-URL) *Type*: string Corresponds to [`Webhook Secret`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Webhook-Secret) *Type*: string Corresponds to [`Webhook OAuth2 Token URL`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Webhook-OAuth2-Token-URL) *Type*: string Corresponds to [`Webhook OAuth2 Client ID`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Webhook-OAuth2-Client-ID) *Type*: string Corresponds to [`Webhook OAuth2 Client Secret`.](https://www.mongodb.com/docs/ops-manager/current/reference/config/ui-settings.md#mongodb-setting-Webhook-OAuth2-Client-Secret)