mongos.exe --setParameter authenticationMechanisms=GSSAPI --configdb shard0.example.net, MongoDB Documentation, Release 3.0.4 Modify or include any additional mongos.exe options as required for your configuration. For example, instead of using --keyFile for internal authentication of sharded cluster members, you can use x.509 member authentication (page 363) instead. Assign Service Principal Name to MongoDB Windows Service Use setspn.exe to assign the service principal name (SPN) to the account running the mongod.exe and the mongos.exe service: setspn.exe -A <service>/<fully qualified domain name> <service account name> For example, if mongod.exe runs as a service named mongodb on testserver.mongodb.com with the ser- vice account name mongodtest , assign the SPN as follows: setspn.exe -A mongodb/testserver.mongodb.com mongodtest Incorporate Additional Authentication Mechanisms Kerberos authentication ( GSSAPI (page 322) (Kerberos)) can work alongside MongoDB’s challenge/response authentication mechanisms ( SCRAM-SHA-1 (page 321) and MONGODB-CR (page 322)), MongoDB’s authentication mechanism for LDAP ( PLAIN (page 323) (LDAP SASL)), and MongoDB’s authentication mechanism for x.509 ( MONGODB-X509 (page 322)). Specify the mechanisms as follows: --setParameter authenticationMechanisms=GSSAPI,SCRAM-SHA-1 Only add the other mechanisms if in use. This parameter setting does not affect MongoDB’s internal authentication of cluster members. To authenticate to a running mongod or mongos instance, you must have user credentials for a resource on that instance. When you authenticate to MongoDB, you authenticate either to a database or to a cluster. Your user privileges determine the resource you can authenticate to. You authenticate to a resource either by: This section describes both approaches. In general, always use a trusted channel (VPN, TLS/SSL, trusted wired network) for connecting to a MongoDB instance. You must have user credentials on the database or cluster to which you are authenticating. Prerequisites Procedures Authenticate When First Connecting to MongoDB Chapter 6. Security 378 Overview Authenticate to a MongoDB Instance or Cluster • using the authentication options when connecting to the mongod or mongos instance, or • connecting first and then authenticating to the resource with the authenticate command or the db.auth() method.