MongoDB LDAP and Kerberos Authentication with Cent

By Alex Komyagin at MongoDB with the help of Felderi Santiago at Centrify and Robertson Pimentel at Centrify Overview Centrify provides unified identity management solutions that result in single sign-on (SSO) for users and a simplified id

By Alex Komyagin at MongoDB with the help of Felderi Santiago at Centrify and Robertson Pimentel at Centrify

Overview

Centrify provides unified identity management solutions that result in single sign-on (SSO) for users and a simplified identity infrastructure for IT. Centrify’s Server Suite integrates Linux systems into Active Directory domains to enable centralized authentication, access control, privilege user management and auditing access for compliance needs.

Since version 2.4, MongoDB Enterprise allows authentication with Microsoft Active Directory Services using LDAP and Kerberos protocols. On Linux systems it is now possible to leverage Centrify’s Server Suite solution for integrating MongoDB with Active Directory.

The use of Centrify’s Active Directory integration with MongoDB greatly simplifies setup process and allows MongoDB to seamlessly integrate into the most complex Active Directory environments found at enterprise customer sites with hundreds or thousands of employees.

Requirements

• Existing Active Directory domain
• MongoDB Enterprise 2.4 or greater
• Centrify Suite

All further MongoDB commands in this paper are given for the current latest stable release, MongoDB 2.6.5. The Linux OS used is RHEL6.4. The Centrify Server Suite version is 2014.1.

Setup procedure

Preparing a new MongoDB Linux server

In existing Enterprise environments that are already using Centrify and MongoDB there are usually specific guidelines on setting up Linux systems. Here we will cover the most basic steps needed, that can be used as a quick reference:

1. Configure hostname and DNS resolution

For Centrify and MongoDB to function properly you must set a hostname on the system and make sure it’s configured to use the proper Active Directory-aware DNS server instance IP address. You can update the hostname using commands that resemble the following:

$ nano /etc/sysconfig/network
HOSTNAME=lin-client.mongotest.com
$ reboot
$ hostname -f
lin-client.mongotest.com

Next, verify the DNS settings and add additional servers, if needed:

$ nano /etc/resolv.conf
search mongotest.com
nameserver 10.10.42.250

2. Install MongoDB Enterprise

The installation process is well outlined in our Documentation. It’s recommended to turn SELinux off for this exercise:

$ nano /etc/selinux/config
SELINUX=disabled

Since MongoDB grants user privileges through role-based authorization, there should be an LDAP and a Kerberos user created in mongodb:

$ service mongod start
$ mongo
> db.getSiblingDB("$external").createUser(
    {
      user : "alex",
      roles: [ { role: "root" , db : "admin"} ]
    }
)
> db.getSiblingDB("$external").createUser(
   {
     user: "[e-mail]",
     roles: [ { role: "root", db: "admin" } ]
   }
)

“alex” is a user listed in AD and who is a member of the “Domain Users” group and has “support” set as its Organizational Unit.

3. Install Centrify agent

Unpack the Centrify suite archive and install the centrify-dc package. Then join the server to your domain as a workstation:

$ rpm -ihv centrifydc-5.2.0-rhel3-x86_64.rpm
$ adjoin -V -w -u ldap_admin mongotest.com
[e-mail]'s password:

Here “ldap_admin” is user who is a member of the “Domain Admins” group in AD.

Setting up MongoDB with LDAP authentication using Centrify

Centrify agent manages all communications with Active Directory, and MongoDB can use the Centrify PAM module to authenticate LDAP users.

1. Configure saslauthd, which is used by MongoDB as an interface between the database and the Linux PAM system.

a. Verify that “MECH=pam” is set in /etc/sysconfig/saslauthd:

$ grep ^MECH /etc/sysconfig/saslauthd
MECH=pam

b. Turn on the saslauthd service and ensure it is started upon reboot:

$ service saslauthd start
Starting saslauthd:                                     [  OK  ]
$ chkconfig saslauthd on
$ chkconfig --list saslauthd
saslauthd  0:off   1:off   2:on    3:on 4:on    5:on    6:off

2. Configure PAM to recognize the mongodb service by creating an appropriate PAM service file. We will use the sshd service file as a template, since it should’ve already been preconfigured to work with Centrify:

$ cp -v /etc/pam.d/{sshd,mongodb}
`/etc/pam.d/sshd' -> `/etc/pam.d/mongodb'

3. Start MongoDB with LDAP authentication enabled, by adjusting the config file:

$ nano /etc/mongod.conf
auth=true
setParameter=saslauthdPath=/var/run/saslauthd/mux
setParameter=authenticationMechanisms=PLAIN
$ service mongod restart

4. Try to authenticate as the user “alex” in MongoDB:

$ mongo
> db.getSiblingDB("$external").auth(
   {
     mechanism: "PLAIN",
     user: "alex",
     pwd:  "xxx",
     digestPassword: false
   }
)
1
>

Returning a value of “1” means the authentication was successful.

Setting up MongoDB with Kerberos authentication using Centrify

Centrify agent automatically updates system Kerberos configuration (the /etc/krb5.conf file), so no manual configuration is necessary. Additionally, Centrify provides means to create Active Directory service user, service principal name and keyfile directly from the Linux server, thus making automation easier.

1. Create the “lin-client-svc” user in Active Directory with SPN and UPN for the server, and export its keytab to the “mongod_lin.keytab” file:

$ adkeytab -n -P mongodb/[e-mail] -U mongodb/[e-mail] -K /home/ec2-user/mongod_lin.keytab -c "OU=support" -V --user ldap_admin lin-client-svc
[e-mail]'s password:
$ adquery user lin-client-svc -PS
userPrincipalName:mongodb/[e-mail]
servicePrincipalName:mongodb/lin-client.mongotest.com

Again, the “ldap_admin” is user who is a member of the “Domain Admins” group in AD. An OU “support” will be used to create the “lin-client-svc” service user.

2. Start MongoDB with Kerberos authentication enabled, by adjusting the config file. You also need to make sure that mongod listens on the interface associated with the FQDN. For this exercise, you can just configure mongod to listen on all interfaces:

$ nano /etc/mongod.conf
# Listen to local interface only. Comment out to listen on all interfaces.
#bind_ip=127.0.0.1
auth=true
setParameter=authenticationMechanisms=GSSAPI
$ service mongod stop
$ env KRB5_KTNAME=/home/ec2-user/mongod_lin.keytab mongod -f /etc/mongod.conf

3. Try to authenticate as the user “[e-mail]” in MongoDB:

$ kinit [e-mail]
Password for [e-mail]:
$ mongo --host lin-client.mongotest.com
> db.getSiblingDB("$external").auth(
   {
     mechanism: "GSSAPI",
     user: "[e-mail]",
   }
)
1
>

The return value of “1” indicates success.

Summary and more information

MongoDB supports different options for authentication, including Kerberos and LDAP external authentication. With MongoDB and Centrify integration, it is now possible to speed up enterprise deployments of MongoDB into your existing security and Active Directory infrastructure and ensure quick day-one productivity without expending days and weeks of labor dealing with open-source tools.

About Centrify

Centrify is a leading provider of unified identity management solutions that result in single sign-on (SSO) for users and a simplified identity infrastructure for IT. Centrify’s Server Suite software integrates Linux systems into Active Directory domains to enable centralized authentication, access control, privilege user management and auditing access for compliance needs. Over the last 10 years, more than 5,000 customers around the world, including nearly half of the Fortune 50, have deployed and trusted Centrify solutions across millions of servers, workstations, and applications, and have regularly reduced their identity management and compliance costs by 50% or more.

Video tutorials

Video on how to use Centrify to integrate MongoDB with Active Directory:

Video on how to enforce PAM access rights as an additional security layer for MongoDB with Centrify:

Centrify Community post and videos showcasing Active Directory integration for MongoDB: http://community.centrify.com/t5/Standard-Edition-DirectControl/MongoDB-AD-Integration-made-easy-with-Centrify/td-p/18779

MongoDB security documentation is available here: http://docs.mongodb.org/manual/security/ MongoDB user and role management tutorials: http://docs.mongodb.org/manual/administration/security-user-role-management/

原文地址：MongoDB LDAP and Kerberos Authentication with Cent, 感谢原作者分享。