Docs Menu

Docs HomeMongoDB Manual


On this page

  • Compatibility
  • Getting Started
  • Authentication Mechanisms
  • Internal / Membership Authentication

Authentication is the process of verifying the identity of a client. When access control (authorization) is enabled, MongoDB requires all clients to authenticate themselves in order to determine their access.

Although authentication and authorization are closely connected, authentication is distinct from authorization:

  • Authentication verifies the identity of a user.

  • Authorization determines the verified user's access to resources and operations.

You can use authentication for deployments hosted in the following environments:

  • MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud

To learn more about authenticating for deployments hosted in MongoDB Atlas, see Atlas UI Authentication.

To get started using access control, follow these tutorials:

Salted Challenge Response Authentication Mechanism (SCRAM) is the default authentication mechanism for MongoDB.

For more information on SCRAM and MongoDB, see:

MongoDB supports x.509 certificate authentication for client authentication and internal authentication of the members of replica sets and sharded clusters. x.509 certificate authentication requires a secure TLS/SSL connection.

To use MongoDB with x.509, you must use valid certificates generated and signed by a certificate authority. The client x.509 certificates must meet the client certificate requirements.

For more information on x.509 and MongoDB, see:

MongoDB Enterprise supports Kerberos Authentication. Kerberos is an industry standard authentication protocol for large client/server systems that provides authentication using short-lived tokens that are called tickets.

To use MongoDB with Kerberos, you must have a properly configured Kerberos deployment, configured Kerberos service principals for MongoDB, and a Kerberos user principal added to MongoDB.

For more information on Kerberos and MongoDB, see:

MongoDB Enterprise and MongoDB Atlas support LDAP Proxy Authentication proxy authentication through a Lightweight Directory Access Protocol (LDAP) service.

For more information on Kerberos and MongoDB, see:

These mechanisms allow MongoDB to integrate into your existing authentication system.

In addition to verifying the identity of a client, MongoDB can require members of replica sets and sharded clusters to authenticate their membership to their respective replica set or sharded cluster. See Internal/Membership Authentication for more information.

←  Enable Access ControlSCRAM →
Share Feedback
© 2023 MongoDB, Inc.


  • Careers
  • Investor Relations
  • Legal Notices
  • Privacy Notices
  • Security Information
  • Trust Center
© 2023 MongoDB, Inc.