MongoDB Documentation, Release 3.0.4 Step 3: Add Kerberos Principal(s) to MongoDB. Add a Kerberos principal, <username>@<KERBEROS REALM> , to MongoDB in the $external database. Specify the Kerberos realm in ALL UPPERCASE . The $external database allows mongod.exe to consult an external source (e.g. Kerberos) to authenticate. To specify the user’s privileges, assign roles (page 324) to the user. The following example adds the Kerberos principal reportingapp@EXAMPLE.NET with read-only access to the records database: Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. For more information about creating and managing users, see http://docs.mongodb.org/manual/reference/command/nav-user-management . Step 4: Start mongod.exe with Kerberos support. You must start mongod.exe as the service principal ac- count (page 378). To start mongod.exe with Kerberos support, set the mongod.exe parameter authenticationMechanisms to GSSAPI : mongod.exe --setParameter authenticationMechanisms=GSSAPI <additional mongod.exe options> For example, the following starts a standalone mongod.exe instance with Kerberos support: mongod.exe --auth --setParameter authenticationMechanisms=GSSAPI Modify or include additional mongod.exe options as required for your configuration. Step 5: Connect mongo.exe shell to mongod.exe and authenticate. Connect the mongo.exe shell client as the Kerberos principal application@EXAMPLE.NET . You can connect and authenticate from the command line. Or, alternatively, you can first connect mongo.exe to the mongod.exe , and then from the mongo.exe shell, use the db.auth() method to authenticate in the $external database. mongo.exe --authenticationMechanism=GSSAPI --authenticationDatabase='$external' \ --username reportingapp@EXAMPLE.NET use $external db.auth( { mechanism: "GSSAPI", user: "reportingapp@EXAMPLE.NET" } ) Configure mongos.exe for Kerberos To start mongos.exe with Kerberos support, set the mongos.exe pa- rameter authenticationMechanisms to GSSAPI . You must start mongos.exe as the service principal ac- count (page 378).: mongos.exe --setParameter authenticationMechanisms=GSSAPI <additional mongos options> For example, the following starts a mongos instance with Kerberos support: 377 6.3. Security Tutorials Additional Considerations use $external db.createUser( { user: "reportingapp@EXAMPLE.NET", roles: [ { role: "read", db: "records" } ] } )