MongoDB Documentation, Release 3.0.4 Authentication Mechanisms SCRAM-SHA-1 Authentication See also: $^{10}$https://tools.ietf.org/html/rfc5802 $^{11}$https://www.mongodb.com/blog/post/improved-password-based-authentication-mongodb-30-scram-explained-part-1?jmp=docs $^{12}$https://www.mongodb.com/blog/post/improved-password-based-authentication-mongodb-30-scram-explained-part-2?jmp=docs 321 6.2. Security Concepts SCRAM-SHA-1 and Existing User Credentials SCRAM-SHA-1 is the default mechanism for MongoDB versions beginning with the 3.0 series. However, if you are upgrading a MongoDB 2.6 instances that already have users credentials, MongoDB will continue to use MONGODB-CR for challenge-response authentication until you upgrade the authentication schema. Even when using the MONGODB-CR authentication mechanism, clients and drivers that support MongoDB 3.0 features (see Driver Compatibility Changes (page 808)) will use the SCRAM communication protocol. For details on upgrading the authentication schema model to SCRAM-SHA-1 , see Upgrade to SCRAM-SHA-1 (page 818). SCRAM-SHA-1 Advantages MongoDB’s implementation of SCRAM-SHA-1 represents an improvement in secu- rity over the previously-used MONGODB-CR , providing: Note: A driver upgrade is necessary to use the SCRAM-SHA-1 authentication mechanism if your current driver version does not support SCRAM-SHA-1 . See required driver versions (page 819) for details. SCRAM-SHA-1 verifies supplied user credentials against the user’s name (page 416), password (page 416) and database (page 416). The user’s database is the database where the user was created, and the user’s database and the user’s name together serves to identify the user. SCRAM-SHA-1 is an IETF standard, RFC 5802$^{10}$, that defines best practice methods for implementation of challenge- response mechanisms for authenticating users with passwords. New in version 3.0. To specify the authentication mechanism to use, see authenticationMechanisms . This section introduces the mechanisms available in MongoDB. MongoDB also supports x509 certificate authentication (page 322), LDAP proxy authentication (page 323), and Ker- beros authentication (page 322). MongoDB supports multiple authentication mechanisms. MongoDB’s default authentication method is a challenge and response mechanism (SCRAM-SHA-1) (page 321). Previously, MongoDB used MongoDB Challenge and Re- sponse (MONGODB-CR) (page 322) as the default. Changed in version 3.0. • Blog Post: Improved Password-Based Authentication in MongoDB 3.0: SCRAM Explained (Part 1) 11 • Blog Post: Improved Password-Based Authentication in MongoDB 3.0: SCRAM Explained (Part 2) 12 • A tunable work factor ( iterationCount ), • Per-user random salts rather than server-wide salts, • A cryptographically stronger hash function ( SHA-1 rather than MD5 ), and • Authentication of the server to the client as well as the client to the server.