Configure MongoDB Agent for OIDC Authentication

Navigate to the Security settings.

In Ops Manager, go to your project. In the left navigation, click Deployment, click Security, then select the Settings tab.

Enable OIDC authentication.

In the MongoDB Deployment Authentication Mechanism section, select Federated Auth (OIDC).

Add an OIDC Identity Provider configuration.

1. In the OIDC Connection and Authorization section, click + OIDC IdP Configuration.

2. In the OIDC Protocol Settings window, select Workload Identity Federation.

3. Enter the IdP details:

   Field	Description
   Configuration Name	Prefix that identifies this IdP configuration in Ops Manager.
   Issuer URI	URI of the IdP that issues access tokens.
   Audience	Must match the aud claim in the JWT that your IdP issues.
   Authorization Method	Select User ID or Group Membership, based on your IdP setup.
   Customize User Claim	Claim that identifies the user. Defaults to sub.

4. Click Save Configuration.

Configure the agent connection to the deployment.

1. In the MongoDB Agent Connections to Deployment section, select Workload Federation.

   Important

   After you deploy with Workload Federation, you cannot revert the MongoDB Agent to Local Authentication.

2. Enter the agent authentication details:

   Field	Description
   OIDC IdP Configuration	IdP configuration the MongoDB Agent uses to authenticate. Select the configuration you created in the previous step.
   User Identifier	User principal claim value. Ops Manager creates the MongoDB user as [configuration name]/[user identifier].
   Authentication Method	Authentication method for the agent's IdP connection. Select Client Credentials for standard IdP integrations such as Okta, or Built-in for cloud-native workload identities on Azure or GCP.
   Client ID	OAuth 2.0 client ID assigned to the agent. Required when using Client Credentials.
   Client Secret	OAuth 2.0 client secret assigned to the agent. Required when using Client Credentials.

   Tip

   If your IdP uses a cloud-native workload identity such as Azure or GCP, select Built-in. You do not need to provide a Client ID or Client Secret.

3. Click Save Settings.

Review and deploy the changes.

1. In the Review Your Changes modal, review the deployment diff. Confirm that the diff shows Auth Mechanisms: MONGODB-OIDC and the Workload Federation details under Auth.

2. Confirm the deployment.

After Ops Manager applies the changes, the MongoDB Agent automatically receives the updated configuration and fetches its initial OIDC tokens from the IdP. The agent transitions to OIDC authentication without a restart.

Generate a new client secret in your IdP.

In your IdP, open the OAuth/OIDC application you use for this deployment and generate a new client secret. Don't revoke the existing secret yet.

Update the secret in Ops Manager.

1. In Ops Manager, go to your project. Click Deployment, Security, then select the Settings tab.

2. Under MongoDB Agent Connections to Deployment, select Workload Federation.

3. Enter the new secret in Client Secret, then click Save Settings.

4. Review and confirm the deployment.

Wait for the MongoDB Agent to refresh its tokens, typically within one hour.

Revoke the old secret in your IdP.