By Alex Komyagin at MongoDB with the help of Felderi Santiago at Centrify and Robertson Pimentel at Centrify Overview Centrify provides unified identity management solutions that result in single sign-on (SSO) for users and a simplified id
by alex komyagin at mongodb with the help of felderi santiago at centrify and robertson pimentel at centrify
Overview
Centrify provides unified identity management solutions that result in single sign-on (SSO) for users and a simplified identity infrastructure for IT. Centrify’s Server Suite integrates Linux systems into Active Directory domains to enable centralized authentication, access control, privilege user management and auditing access for compliance needs.
Since version 2.4, MongoDB Enterprise allows authentication with Microsoft Active Directory Services using LDAP and Kerberos protocols. On Linux systems it is now possible to leverage Centrify’s Server Suite solution for integrating MongoDB with Active Directory.
The use of Centrify’s Active Directory integration with MongoDB greatly simplifies setup process and allows MongoDB to seamlessly integrate into the most complex Active Directory environments found at enterprise customer sites with hundreds or thousands of employees.
Requirements
- Existing Active Directory domain
- MongoDB Enterprise 2.4 or greater
- Centrify Suite
All further MongoDB commands in this paper are given for the current latest stable release, MongoDB 2.6.5. The Linux OS used is RHEL6.4. The Centrify Server Suite version is 2014.1.
Setup procedure
Preparing a new MongoDB Linux server
In existing Enterprise environments that are already using Centrify and MongoDB there are usually specific guidelines on setting up Linux systems. Here we will cover the most basic steps needed, that can be used as a quick reference:
1. Configure hostname and DNS resolution
For Centrify and MongoDB to function properly you must set a hostname on the system and make sure it’s configured to use the proper Active Directory-aware DNS server instance IP address. You can update the hostname using commands that resemble the following:
$ nano /etc/sysconfig/network HOSTNAME=lin-client.mongotest.com $ reboot $ hostname -f lin-client.mongotest.com
Next, verify the DNS settings and add additional servers, if needed:
$ nano /etc/resolv.conf search mongotest.com nameserver 10.10.42.250
2. Install MongoDB Enterprise
The installation process is well outlined in our Documentation. It’s recommended to turn SELinux off for this exercise:
$ nano /etc/selinux/config SELINUX=disabled
Since MongoDB grants user privileges through role-based authorization, there should be an LDAP and a Kerberos user created in mongodb:
$ service mongod start
$ mongo
> db.getSiblingDB("$external").createUser(
{
user : "alex",
roles: [ { role: "root" , db : "admin"} ]
}
)
> db.getSiblingDB("$external").createUser(
{
user: "alex@MONGOTEST.COM",
roles: [ { role: "root", db: "admin" } ]
}
)
“alex” is a user listed in AD and who is a member of the “Domain Users” group and has “support” set as its Organizational Unit.
3. Install Centrify agent
Unpack the Centrify suite archive and install the centrify-dc package. Then join the server to your domain as a workstation:
$ rpm -ihv centrifydc-5.2.0-rhel3-x86_64.rpm $ adjoin -V -w -u ldap_admin mongotest.com ldap_admin@MONGOTEST.COM's password:
Here “ldap_admin” is user who is a member of the “Domain Admins” group in AD.
Setting up MongoDB with LDAP authentication using Centrify
Centrify agent manages all communications with Active Directory, and MongoDB can use the Centrify PAM module to authenticate LDAP users.
1. Configure saslauthd, which is used by MongoDB as an interface between the database and the Linux PAM system.
a. Verify that “MECH=pam” is set in /etc/sysconfig/saslauthd:
$ grep ^MECH /etc/sysconfig/saslauthd MECH=pam
b. Turn on the saslauthd service and ensure it is started upon reboot:
$ service saslauthd start Starting saslauthd: [ OK ] $ chkconfig saslauthd on $ chkconfig --list saslauthd saslauthd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
2. Configure PAM to recognize the mongodb service by creating an appropriate PAM service file. We will use the sshd service file as a template, since it should’ve already been preconfigured to work with Centrify:
$ cp -v /etc/pam.d/{sshd,mongodb}
`/etc/pam.d/sshd' -> `/etc/pam.d/mongodb'
3. Start MongoDB with LDAP authentication enabled, by adjusting the config file:
$ nano /etc/mongod.conf auth=true setParameter=saslauthdPath=/var/run/saslauthd/mux setParameter=authenticationMechanisms=PLAIN $ service mongod restart
4. Try to authenticate as the user “alex” in MongoDB:
$ mongo
> db.getSiblingDB("$external").auth(
{
mechanism: "PLAIN",
user: "alex",
pwd: "xxx",
digestPassword: false
}
)
1
>
Returning a value of “1” means the authentication was successful.
Setting up MongoDB with Kerberos authentication using Centrify
Centrify agent automatically updates system Kerberos configuration (the /etc/krb5.conf file), so no manual configuration is necessary. Additionally, Centrify provides means to create Active Directory service user, service principal name and keyfile directly from the Linux server, thus making automation easier.
1. Create the “lin-client-svc” user in Active Directory with SPN and UPN for the server, and export its keytab to the “mongod_lin.keytab” file:
$ adkeytab -n -P mongodb/lin-client.mongotest.com@MONGOTEST.COM -U mongodb/lin-client.mongotest.com@MONGOTEST.COM -K /home/ec2-user/mongod_lin.keytab -c "OU=support" -V --user ldap_admin lin-client-svc ldap_admin@MONGOTEST.COM's password: $ adquery user lin-client-svc -PS userPrincipalName:mongodb/lin-client.mongotest.com@MONGOTEST.COM servicePrincipalName:mongodb/lin-client.mongotest.com
Again, the “ldap_admin” is user who is a member of the “Domain Admins” group in AD. An OU “support” will be used to create the “lin-client-svc” service user.
2. Start MongoDB with Kerberos authentication enabled, by adjusting the config file. You also need to make sure that mongod listens on the interface associated with the FQDN. For this exercise, you can just configure mongod to listen on all interfaces:
$ nano /etc/mongod.conf # Listen to local interface only. Comment out to listen on all interfaces. #bind_ip=127.0.0.1 auth=true setParameter=authenticationMechanisms=GSSAPI $ service mongod stop $ env KRB5_KTNAME=/home/ec2-user/mongod_lin.keytab mongod -f /etc/mongod.conf
3. Try to authenticate as the user “alex@MONGOTEST.COM” in MongoDB:
$ kinit alex@MONGOTEST.COM
Password for alex@MONGOTEST.COM:
$ mongo --host lin-client.mongotest.com
> db.getSiblingDB("$external").auth(
{
mechanism: "GSSAPI",
user: "alex@MONGOTEST.COM",
}
)
1
>
The return value of “1” indicates success.
Summary and more information
MongoDB supports different options for authentication, including Kerberos and LDAP external authentication. With MongoDB and Centrify integration, it is now possible to speed up enterprise deployments of MongoDB into your existing security and Active Directory infrastructure and ensure quick day-one productivity without expending days and weeks of labor dealing with open-source tools.
About Centrify
Centrify is a leading provider of unified identity management solutions that result in single sign-on (SSO) for users and a simplified identity infrastructure for IT. Centrify’s Server Suite software integrates Linux systems into Active Directory domains to enable centralized authentication, access control, privilege user management and auditing access for compliance needs. Over the last 10 years, more than 5,000 customers around the world, including nearly half of the Fortune 50, have deployed and trusted Centrify solutions across millions of servers, workstations, and applications, and have regularly reduced their identity management and compliance costs by 50% or more.
Video tutorials
Video on how to use Centrify to integrate MongoDB with Active Directory:
Video on how to enforce PAM access rights as an additional security layer for MongoDB with Centrify:
Centrify Community post and videos showcasing Active Directory integration for MongoDB: http://community.centrify.com/t5/Standard-Edition-DirectControl/MongoDB-AD-Integration-made-easy-with-Centrify/td-p/18779
MongoDB security documentation is available here: http://docs.mongodb.org/manual/security/ MongoDB user and role management tutorials: http://docs.mongodb.org/manual/administration/security-user-role-management/
原文地址：MongoDB LDAP and Kerberos Authentication with Cent, 感谢原作者分享。
