Set up Self-Managed X.509 Authentication

On this page

Prerequisites

Configure a Project to use a Public Key Infrastructure
Add a Database User using Self-Managed X.509 Authentication

Self-managed X.509 certificates provide database users access to the clusters in their project. Database users are separate from Atlas users. Database users have access to MongoDB databases, while Atlas users have access to the Atlas application itself.

Prerequisites

In order to use self-managed X.509 certificates, you must have a Public Key Infrastructure to integrate with MongoDB Atlas.

Configure a Project to use a Public Key Infrastructure

In Atlas, go to the Advanced page for your project.

If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.
If it's not already displayed, select your project from the Projects menu in the navigation bar.
In the sidebar, click Advanced under the Security heading.
The Advanced page displays.

Turn on Self-Managed X.509 Authentication.

Toggle Self-Managed X.509 Authentication to ON.

Provide a PEM-encoded Certificate Authority.

You can provide a Certificate Authority (CA) by:

Clicking Upload and selecting a .pem file from your filesystem.
Copying the contents of a .pem file into the provided text area.

You can concatenate multiple CAs in the same .pem file or in the text area. Users can authenticate with certificates generated by any of the provided CAs.

When you upload a CA, a project-level alert is automatically created to send a notification 30 days before the CA expires, repeating every 24 hours. You can view and edit this alert from Atlas's Alert Settings page. For more information on configuring alerts, see Configure Alert Settings.

Click Save.

To edit your CA once uploaded, click the Self-Managed X.509 Authentication Settings icon.

Add a Database User using Self-Managed X.509 Authentication

In Atlas, go to the Database Access page for your project.

If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.
If it's not already displayed, select your project from the Projects menu in the navigation bar.
In the sidebar, click Database Access under the Security heading.
The Database Access page displays.

Open the Add New Database User dialog box.

If it isn't already displayed, click the Database Users tab.
Click Add New Database User.

Select CERTIFICATE.

Enter user information.

Field

Description

Common Name

The user's Common Name (CN) protected by the TLS/SSL certificate. For more information, see RFC 2253.

For example, if your common name is "Jane Doe", your organization is "MongoDB", and your country is "US", insert the following into the Common Name field:

CN=Jane Doe,O=MongoDB,C=US

User Privileges

You can assign roles in one of the following ways:

Select Atlas admin, which provides the user with readWriteAnyDatabase as well as a number of administrative privileges.
Select Read and write to any database, which provides the user with privileges to read and write to any database.
Select Only read any database which provides the user with privileges to read any database.
Select Select Custom Role to select a custom role previously created in Atlas. You can create custom roles for database users in cases where the built-in database user roles cannot describe the desired set of privileges. For more information on custom roles, see Configure Custom Database Roles.

Click Add Default Privileges. When you click this option, you can select individual roles and specify the database on which the roles apply. Optionally, for the read and readWrite roles, you can also specify a collection. If you do not specify a collection for read and readWrite, the role applies to all non-system collections in the database.

The following table describes the Atlas specific privileges, the database it applies to, and the privilege actions they represent.

Atlas Specific Privilege	Database	Privilege Actions
`backup`	`admin`	`listDatabases` `listCollections` `listIndexes` `appendOplogNote` `getParameter` `serverStatus`
`clusterMonitor`	`admin`	`connPoolStats` `getCmdLineOpts` `getDefaultRWConcern` `getLog` `getParameter` `getShardMap` `hostInfo` `inprog` `listDatabases` `listSessions` `listShards` `replSetGetConfig` `replSetGetStatus` `serverStatus` `shardingState` `top`
`dbAdmin`	User configured	`bypassDocumentValidation` `changeStream` `collMod` `collStats` `compact` `convertToCapped` `createCollection` `createIndex` `createSearchIndex` `dbHash` `dbStats` `dropCollection` `dropDatabase` `dropIndex` `dropSearchIndex` `enableProfiler` `find` `killCursors` `listCollections` `listIndexes` `listSearchIndexes` `planCacheIndexFilter` `planCacheRead` `planCacheWrite` `reIndex` `renameCollectionSameDB` `storageDetails` `updateSearchIndex` `validate`
`dbAdminAnyDatabase`	User configured except `local` and `config`	`dbAdminAnyDatabase`
`enableSharding`		`enableSharding`
`read`	User configured	`changeStream` `collStats` `dbHash` `dbStats` `find` `killCursors` `listIndexes` `listCollections` `listSearchIndexes`
`readWrite`	User configured	`changeStream` `collStats` `convertToCapped` `createCollection` `createSearchIndex` `dbHash` `dbStats` `dropCollection` `createIndex` `dropIndex` `dropSearchIndex` `find` `insert` `killCursors` `listIndexes` `listCollections` `listSearchIndexes` `remove` `renameCollectionSameDB` `update`
`killOpSession`	User configured	`inprog` `killop` `killAnySession` `killCursors` `listSessions`
`readWriteAnyDatabase`	User configured except `local` and `config`	`readWriteAnyDatabase` `changeStream` `collStats` `convertToCapped` `createCollection` `createSearchIndex` `dbHash` `dbStats` `dropCollection` `dropSearchIndex` `createIndex` `dropIndex` `find` `insert` `killCursors` `listIndexes` `listCollections` `listDatabases` `listSearchIndexes` `remove` `renameCollectionSameDB` `update`
`readAnyDatabase`	User configured except `local` and `config`	`readAnyDatabase` `changeStream` `collStats` `dbHash` `dbStats` `find` `killCursors` `listIndexes` `listCollections` `listDatabases` `listSearchIndexes`

For information on the built-in Atlas privileges, see Built-in Roles.

For more information on authorization, see Role-Based Access Control and Built-in Roles in the MongoDB manual.

Click Add User.

Back

Database Users

AWS IAM