MongoDB Documentation, Release 3.0.4 security: authorization: enabled setParameter: saslauthdPath: "" authenticationMechanisms: PLAIN auth=true setParameter=saslauthdPath="" setParameter=authenticationMechanisms=PLAIN db.getSiblingDB("$external").auth( { mechanism: "PLAIN", user: <username>, pwd: <cleartext password>, digestPassword: false } ) Considerations $^{58}$http://docs.mongodb.org/v2.4/reference/configuration-options Or, if using the older configuration file format$^{58}$: Step 3: Authenticate the user in the mongo shell. To perform the authentication in the mongo shell, use the db.auth() method in the $external database. Specify the value "PLAIN" in the mechanism field, the user and password in the user and pwd fields respectively, and the value false in the digestPassword field. You must specify false for digestPassword since the server must receive an undigested password to forward on to saslauthd , as in the following example: The server forwards the password in plain text. In general, use only on a trusted channel (VPN, TLS/SSL, trusted wired network). See Considerations. MongoDB Enterprise provides support for proxy authentication of users. This allows administrators to configure a MongoDB cluster to authenticate users by proxying authentication requests to a specified Lightweight Directory Access Protocol (LDAP) service. MongoDB Enterprise for Windows does not include LDAP support for authentication. However, MongoDB Enterprise for Linux supports using LDAP authentication with an ActiveDirectory server. MongoDB does not support LDAP authentication in mixed sharded cluster deployments that contain both version 2.4 and version 2.6 shards. See Upgrade MongoDB to 2.6 (page 866) for upgrade instructions. Use secure encrypted or trusted connections between clients and the server, as well as between saslauthd and the LDAP server. The LDAP server uses the SASL PLAIN mechanism, sending and receiving data in plain text . You should use only a trusted channel such as a VPN, a connection encrypted with TLS/SSL, or a trusted wired network. Authenticate Using SASL and LDAP with OpenLDAP 369 6.3. Security Tutorials