MongoDB Documentation, Release 3.0.4 Prerequisites Procedure 373 6.3. Security Tutorials Step 4: Start mongod with Kerberos support. To start mongod with Kerberos support, set the environmental variable KRB5_KTNAME to the path of the keytab file and the mongod parameter authenticationMechanisms to GSSAPI in the following form: Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. For more information about creating and managing users, see http://docs.mongodb.org/manual/reference/command/nav-user-management . The following example adds the Kerberos principal application/reporting@EXAMPLE.NET with read-only access to the records database: Step 3: Add Kerberos Principal(s) to MongoDB. Add a Kerberos principal, <username>@<KERBEROS REALM> or <username>/<instance>@<KERBEROS REALM> , to MongoDB in the $external database. Specify the Kerberos realm in all uppercase. The $external database allows mongod to consult an external source (e.g. Kerberos) to authenticate. To specify the user’s privileges, assign roles (page 324) to the user. Step 2: Connect to mongod . Connect via the mongo shell to the mongod instance. If mongod has --auth enabled, ensure you connect with the privileges required to create a user . If a Kerberos user is already in MongoDB and has the privileges required to create a user , you can start mongod with Kerberos support. Step 1: Start mongod without Kerberos. For the initial addition of Kerberos users, start mongod without Kerberos support. The following procedure outlines the steps to add a Kerberos user principal to MongoDB, configure a standalone mongod instance for Kerberos support, and connect using the mongo shell and authenticate the user principal. In the output from this command, look for the string modules: subscription or modules: enterprise to confirm your system has MongoDB Enterprise. mongod --version To verify MongoDB Enterprise binaries: Setting up and configuring a Kerberos deployment is beyond the scope of this document. This tutorial assumes you have configured a Kerberos service principal (page 332) for each mongod and mongos instance in your MongoDB deployment, and you have a valid keytab file (page 332) for for each mongod and mongos instance. use $external db.createUser( { user: "application/reporting@EXAMPLE.NET", roles: [ { role: "read", db: "records" } ] } )