MongoDB Documentation, Release 3.0.4 Warning: The procedure to upgrade to SCRAM-SHA-1 discards the MONGODB-CR credentials used by 2.6. As such, the procedure is irreversible , short of restoring from backups. The procedure also disables MONGODB-CR as an authentication mechanism. MONGODB-CR is a challenge-response mechanism that authenticates users through passwords. Changed in version 3.0: As of version 3.0, MongoDB no longer defaults to MONGODB-CR and instead uses SCRAM-SHA-1 as the default authentication mechanism. MONGODB-CR verifies supplied user credentials against the user’s name (page 416), password (page 416) and database (page 416). The user’s database is the database where the user was created, and the user’s database and the user’s name together serve to identify the user. Using key files , you can also use MONGODB-CR authentication for the internal member authentication (page 323) of replica set members and sharded cluster members. The contents of the key files serve as the shared password for the members. You must store the key file on each mongod or mongos instance for that replica set or sharded cluster. The content of the key file is arbitrary but must be the same on all mongod and mongos instances that connect to each other. See Generate a Key File (page 379) for instructions on generating a key file and turning on key file authentication for members. New in version 2.6. MongoDB supports x.509 certificate authentication for use with a secure TLS/SSL connection (page 342). To authenticate to servers, clients can use x.509 certificates instead of usernames and passwords. See Client x.509 Certificate (page 361) for more information. For membership authentication, members of sharded clusters and replica sets can use x.509 certificates instead of key files. See Use x.509 Certificate for Membership Authentication (page 363) for more information. MongoDB Enterprise 13 supports authentication using a Kerberos service. Kerberos is an industry standard authentica- tion protocol for large client/server systems. To use MongoDB with Kerberos, you must have a properly configured Kerberos deployment, configured Kerberos service principals (page 332) for MongoDB, and added Kerberos user principal (page 331) to MongoDB. See Kerberos Authentication (page 331) for more information on Kerberos and MongoDB. To configure MongoDB to use Kerberos authentication, see Configure MongoDB with Kerberos Authentication on Linux (page 372) and Configure MongoDB with Kerberos Authentication on Windows (page 376). 322 Chapter 6. Security $^{13}$http://www.mongodb.com/products/mongodb-enterprise?jmp=docs Kerberos Authentication x.509 Certificate Authentication MONGODB-CR Authentication