Enabling and configuring authorization in a MongoDB replica set

Overview

The example uses 3 MongoDB servers in a replica set:

• example.mongo.01
• example.mongo.02
• example.mongo.03

aviso

Replica set configuration is described in Configuring a MongoDB replica set. Configuring a replica set and authorization in Docker is described in Migrating from standalone to a replica set.

Connecting to MongoDB and creating a user

Connecting to the shell

Connect to the MongoDB replica set:

Linux

shell

mongosh --host rs0/example.mongo.01:27017,example.mongo.02:27017,example.mongo.03:27017

Windows Server

If the command returns the error mongosh : The term 'mongosh' is not recognized..., the MongoDB utilities are not in PATH. Locate mongosh.exe:

shell

$mongoshPath = Get-ChildItem -Path "C:\" -Filter "mongosh.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1; $mongoshDirectory = $mongoshPath.DirectoryName; cd $mongoshDirectory

If MongoDB is installed on a non-default drive, change the path in the -Path parameter. Then connect:

shell

.\mongosh.exe --host rs0/example.mongo.01:27017,example.mongo.02:27017,example.mongo.03:27017

Creating a user

Switch to the admin database:

shell

use admin

Create a user (replace the login and the password):

shell

db.createUser({
  user: "adminuser",
  pwd: "password",
  roles: [
    { role: "root", db: "admin" }
  ],
  passwordDigestor: "server"
})

aviso

In MongoDB, do not use the following characters in the user name and password: . @ $ : % " ' / \ | — they can cause failures when the application connects to MongoDB.

Grant the clusterManager role to the adminuser user for cluster management:

shell

db.grantRolesToUser(
   "adminuser",
   [ "clusterManager" ]
)

Enabling authorization and configuring inter-node authentication

Enabling authorization in MongoDB

Configuration file location:

• Linux — /etc/mongod.conf
• Windows Server — C:\Program Files\MongoDB\Server\7.0\bin\mongod.cfg

You can check the path from the MongoDB shell:

shell

var cmdLineOpts = db.serverCmdLineOpts();
print("config: " + cmdLineOpts.parsed.config);

Open the configuration file and change or add the parameters (on every node — example.mongo.01, example.mongo.02, example.mongo.03):

security:
  authorization: enabled

aviso

Indentation in the configuration file matters for the syntax. The security parameter controls authorization, authentication, and other security settings.

info

Authorization cannot be verified at this stage yet — authentication between the replica set members has not been configured.

Configuring authentication between replica set members

Create a base64 keyfile on example.mongo.01:

Linux

shell

openssl rand -base64 756 > /var/lib/mongodb/keyfile

Windows Server

Open PowerShell as an administrator:

• Right-click the "Start" icon in the bottom-left corner of the screen;
• Select "Windows PowerShell (Admin)" from the context menu.

Commands to create the file:

shell

# Generating random bytes
$randomBytes = New-Object byte[] 756
[System.Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($randomBytes)

# Encoding to base64
$base64String = [Convert]::ToBase64String($randomBytes)

# Writing to the file
$base64String | Out-File -FilePath "C:\Program Files\MongoDB\Server\7.0\data\keyfile" -Encoding ASCII

Set the permissions on the keyfile and assign the mongodb owner:

Linux

shell

chmod 400 /var/lib/mongodb/keyfile
chown mongodb:mongodb /var/lib/mongodb/keyfile

Windows Server

No additional commands are required — the security policies of the .\data directory apply to the file.

Copy the keyfile to the remaining nodes (example.mongo.02, example.mongo.03):

Linux

shell

scp /var/lib/mongodb/keyfile [email protected]:/var/lib/mongodb/
scp /var/lib/mongodb/keyfile [email protected]:/var/lib/mongodb/

Windows Server

Transfer the keyfile manually to the remaining nodes into the directory:

shell

C:\Program Files\MongoDB\Server\7.0\data\

aviso

The keyfile must be identical on all nodes — it is used for authentication between the nodes.

On the example.mongo.02 and example.mongo.03 nodes, set the same permissions and owner:

Linux

shell

chmod 400 /var/lib/mongodb/keyfile
chown mongodb:mongodb /var/lib/mongodb/keyfile

Windows Server

shell

icacls "C:\Program Files\MongoDB\Server\7.0\data\keyfile" /reset

Open the configuration file on every node and add the keyFile parameter:

security:
  authorization: enabled
  keyFile: /var/lib/mongodb/keyfile or C:\Program Files\MongoDB\Server\7.0\data\keyfile

After making the changes, restart the MongoDB service:

Linux

shell

systemctl restart mongod.service

Windows Server

shell

net stop MongoDB
net start MongoDB

Verify the connection to the replica set with authorization:

shell

mongosh --host rs0/example.mongo.01:27017,example.mongo.02:27017,example.mongo.03:27017 -u adminuser -p password --authenticationDatabase admin

Configuring Passwork to connect to the replica set

Edit the Passwork configuration file — config.env:

shell

MONGODB_URL=mongodb://example.mongo.01:27017,example.mongo.02:27017,example.mongo.03:27017/?replicaSet=rs0
MONGODB_DB=pw
MONGODB_USERNAME=adminuser
MONGODB_PASSWORD=password

File location:

• Linux — /var/www/init/config.env
• Windows Server — C:\inetpub\wwwroot\passwork\init\config.env

Save the changes and reload the Passwork web interface page to verify the authorized connection to MongoDB.