MongoDB Documentation, Release 3.0.4 For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB in the $external database. For examples of adding a user to MongoDB as well as authenticating as that user, see Configure MongoDB with Kerberos Authentication on Linux (page 372) and Configure MongoDB with Kerberos Authentication on Windows (page 376). User and Role Management Tutorials (page 384) for general information regarding creating and managing users in MongoDB. Service Principal Every MongoDB mongod and mongos instance (or mongod.exe or mongos.exe on Win- dows) must have an associated service principal. Service principal names have the form: <service>/<fully qualified domain name>@<KERBEROS REALM> For MongoDB, the <service> defaults to mongodb . For example, if m1.example.com is a MongoDB server, and example.com maintains the EXAMPLE.COM Kerberos realm, then m1 should have the service principal name mongodb/m1.example.com@EXAMPLE.COM . To specify a different value for <service> , use serviceName during the start up of mongod or mongos (or mongod.exe or mongos.exe ). mongo shell or other clients may also specify a different service principal name using serviceName . Service principal names must be reachable over the network using the fully qualified domain name (FQDN) part of its service principal name. By default, Kerberos attempts to identify hosts using the /etc/kerb5.conf file before using DNS to resolve hosts. On Windows, if running MongoDB as a service, see Assign Service Principal Name to MongoDB Windows Service (page 378). Linux systems can store Kerberos authentication keys for a service principal (page 332) in keytab files. Each Kerber- ized mongod and mongos instance running on Linux must have access to a keytab file containing keys for its service principal (page 332). To keep keytab files secure, use file permissions that restrict access to only the user that runs the mongod or mongos process. On Linux, MongoDB clients can use Kerberos’s kinit program to initialize a credential cache for authenticating the user principal to servers. Unlike on Linux systems, mongod and mongos instances running on Windows do not require access to keytab files. Instead, the mongod and mongos instances read their server credentials from a credential store specific to the operating system. However, from the Windows Active Directory, you can export a keytab file for use on Linux systems. See Ktpass 19 for more information. $^{19}$http://technet.microsoft.com/en-us/library/cc753771.aspx See also: Linux Keytab Files Tickets Windows Active Directory Chapter 6. Security 332