MongoDB Documentation, Release 3.0.4 MongoDB does not support LDAP authentication in mixed sharded cluster deployments that contain both version 2.4 and version 2.6 shards. See Upgrade MongoDB to 2.6 (page 866) for upgrade instructions. Use secure encrypted or trusted connections between clients and the server, as well as between saslauthd and the LDAP server. The LDAP server uses the SASL PLAIN mechanism, sending and receiving data in plain text . You should use only a trusted channel such as a VPN, a connection encrypted with TLS/SSL, or a trusted wired network. LDAP support for user authentication requires proper configuration of the saslauthd daemon process as well as the MongoDB server. Step 1: Specify the mechanism. On systems that configure saslauthd with the /etc/sysconfig/saslauthd file, such as Red Hat Enterprise Linux, Fedora, CentOS, and Amazon Linux AMI, set the mechanism MECH to ldap : On systems that configure saslauthd with the /etc/default/saslauthd file, such as Ubuntu, set the MECHANISMS option to ldap : MECHANISMS="ldap" MECH=ldap Step 2: Adjust caching behavior. On certain Linux distributions, saslauthd starts with the caching of authenti- cation credentials enabled . Until restarted or until the cache expires, saslauthd will not contact the LDAP server to re-authenticate users in its authentication cache. This allows saslauthd to successfully authenticate users in its cache, even in the LDAP server is down or if the cached users’ credentials are revoked. To set the expiration time (in seconds) for the authentication cache, see the -t option 55 of saslauthd . Step 3: Configure LDAP Options with ActiveDirectory. If the saslauthd.conf file does not exist, create it. The saslauthd.conf file usually resides in the /etc folder. If specifying a different file path, see the -O option 56 of saslauthd . To use with ActiveDirectory, start saslauthd with the following configuration options set in the saslauthd.conf file: For the <ldap uri> , specify the uri of the ldap server. For example, ldap_servers: ldaps://ad.example.net . For more information on saslauthd configuration, see http://www.openldap.org/doc/admin24/guide.html#Configuringsaslauthd. Step 4: Test the saslauthd configuration. Use testsaslauthd utility to test the saslauthd configuration. For example: testsaslauthd -u testuser -p testpassword -f /var/run/saslauthd/mux $^{55}$http://www.linuxcommand.org/man_pages/saslauthd8.html $^{56}$http://www.linuxcommand.org/man_pages/saslauthd8.html 6.3. Security Tutorials 367 Configure saslauthd ldap_servers: <ldap uri> ldap_use_sasl: yes ldap_mech: DIGEST-MD5 ldap_auth_method: fastbind