MongoDB Documentation, Release 3.0.4 } ) db.getSiblingDB("$external").auth( { mechanism: "MONGODB-X509", user: "CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry" } ) In the above example, to add the user with the readWrite role in the test database, the role specification document specified ’test’ in the db field. To add userAdminAnyDatabase role for the user, the above example specified ’admin’ in the db field. Note: Some roles are defined only in the admin database, including: clusterAdmin , readAnyDatabase , readWriteAnyDatabase , dbAdminAnyDatabase , and userAdminAnyDatabase . To add a user with these roles, specify ’admin’ in the db . See Add a User to a Database (page 386) for details on adding a user with roles. Authenticate with a x.509 Certificate To authenticate with a client certificate, you must first add a MongoDB user that corresponds to the client certificate. See Add x.509 Certificate subject as a User (page 362). To authenticate, use the db.auth() method in the $external database, specifying "MONGODB-X509" for the mechanism field, and the user that corresponds to the client certificate (page 362) for the user field. For example, if using the mongo shell, 1. Connect mongo shell to the mongod set up for SSL: 2. To perform the authentication, use the db.auth() method in the $external database. For the mechanism field, specify "MONGODB-X509" , and for the user field, specify the user, or the subject , that corresponds to the client certificate. Use x.509 Certificate for Membership Authentication New in version 2.6. MongoDB supports x.509 certificate authentication for use with a secure TLS/SSL connection (page 342). Sharded cluster members and replica set members can use x.509 certificates to verify their membership to the cluster or the replica set instead of using keyfiles (page 320). The membership authentication is an internal process. For client authentication with x.509, see Use x.509 Certificates to Authenticate Clients (page 361). Important: A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, in particular x.509 cer- tificates, and Certificate Authority is beyond the scope of this document. This tutorial assumes prior knowledge of TLS/SSL as well as access to valid x.509 certificates. Member x.509 Certificate The member certificate, used for internal authentication to verify membership to the sharded cluster or a replica set, must have the following properties: 363 6.3. Security Tutorials mongo --ssl --sslPEMKeyFile <path to CA signed client PEM file> --sslCAFile <path to