## Prerequisites 

Setting up and configuring a Kerberos deployment is beyond the scope of this document. This tutorial assumes you have configured a Kerberos service principal (page 332) for each mongod and mongos instance in your MongoDB deployment, and you have a valid keytab file (page 332) for for each mongod and mongos instance. 

To verify MongoDB Enterprise binaries: 

mongod --version 

In the output from this command, look for the string modules: subscription or modules: enterprise to confirm your system has MongoDB Enterprise. 

## Procedure 

The following procedure outlines the steps to add a Kerberos user principal to MongoDB, configure a standalone mongod instance for Kerberos support, and connect using the mongo shell and authenticate the user principal. 

Step 1: Start mongod without Kerberos. For the initial addition of Kerberos users, start mongod without Kerberos support. 

If a Kerberos user is already in MongoDB and has the privileges required to create a user , you can start mongod with Kerberos support. 

Step 2: Connect to mongod . Connect via the mongo shell to the mongod instance. If mongod has --auth enabled, ensure you connect with the privileges required to create a user . 

Step 3: Add Kerberos Principal(s) to MongoDB. Add a Kerberos principal, <username>@<KERBEROS REALM> or <username>/<instance>@<KERBEROS REALM> , to MongoDB in the $external database. Specify the Kerberos realm in all uppercase. The $external database allows mongod to consult an external source (e.g. Kerberos) to authenticate. To specify the user’s privileges, assign roles (page 324) to the user. 

The following example adds the Kerberos principal application/reporting@EXAMPLE.NET with read-only access to the records database: 

use $external db.createUser( { user: "application/reporting@EXAMPLE.NET", roles: [ { role: "read", db: "records" } ] } ) 

Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. For more information about creating and managing users, see http://docs.mongodb.org/manual/reference/command/nav-user-management . 

Step 4: Start mongod with Kerberos support. To start mongod with Kerberos support, set the environmental variable KRB5_KTNAME to the path of the keytab file and the mongod parameter authenticationMechanisms to GSSAPI in the following form: 

