LDAP support for user authentication requires proper configuration of the saslauthd daemon process as well as the MongoDB server. Step 1: Specify the mechanism. On systems that configure saslauthd with the /etc/sysconfig/saslauthd file, such as Red Hat Enterprise Linux, Fedora, CentOS, and Amazon Linux AMI, set the mechanism MECH to ldap : On systems that configure saslauthd with the /etc/default/saslauthd file, such as Ubuntu, set the MECHANISMS option to ldap : MECH=ldap MECHANISMS="ldap" Step 2: Adjust caching behavior. On certain Linux distributions, saslauthd starts with the caching of authenti- cation credentials enabled . Until restarted or until the cache expires, saslauthd will not contact the LDAP server to re-authenticate users in its authentication cache. This allows saslauthd to successfully authenticate users in its cache, even in the LDAP server is down or if the cached users’ credentials are revoked. To set the expiration time (in seconds) for the authentication cache, see the -t option 59 of saslauthd . Step 3: Configure LDAP Options with OpenLDAP. If the saslauthd.conf file does not exist, create it. The saslauthd.conf file usually resides in the /etc folder. If specifying a different file path, see the -O option 60 of saslauthd . To connect to an OpenLDAP server, update the saslauthd.conf file with the following configuration options: The ldap_servers specifies the uri of the LDAP server used for authentication. In general, for OpenLDAP installed on the local machine, you can specify the value ldap://localhost:389 or if using LDAP over TLS/SSL, you can specify the value ldaps://localhost:636 . The ldap_search_base specifies distinguished name to which the search is relative. The search includes the base or objects below. The ldap_filter specifies the search filter. The values for these configuration options should correspond to the values specific for your test. For example, to filter on email, specify ldap_filter: (mail=%n) instead. OpenLDAP Example A sample saslauthd.conf file for OpenLDAP includes the following content: ldap_servers: ldaps://ad.example.net ldap_search_base: ou=Users,dc=example,dc=com ldap_filter: (uid=%u) ldap_servers: <ldap uri> ldap_search_base: <search base> ldap_filter: <filter> Configure saslauthd MongoDB Documentation, Release 3.0.4 $^{59}$http://www.linuxcommand.org/man_pages/saslauthd8.html $^{60}$http://www.linuxcommand.org/man_pages/saslauthd8.html Chapter 6. Security 370