Incorporate Additional Authentication Mechanisms Kerberos authentication ( GSSAPI (page 322) (Kerberos)) can work alongside MongoDB’s challenge/response authentication mechanisms ( SCRAM-SHA-1 (page 321) and MONGODB-CR (page 322)), MongoDB’s authentication mechanism for LDAP ( PLAIN (page 323) (LDAP SASL)), and MongoDB’s authentication mechanism for x.509 ( MONGODB-X509 (page 322)). Specify the mechanisms as follows: 

--setParameter authenticationMechanisms=GSSAPI,SCRAM-SHA-1 

Only add the other mechanisms if in use. This parameter setting does not affect MongoDB’s internal authentication of cluster members. 

## Additional Resources 

• MongoDB LDAP and Kerberos Authentication with Dell (Quest) Authentication Services 64 

• MongoDB with Red Hat Enterprise Linux Identity Management and Kerberos 65 

## Configure MongoDB with Kerberos Authentication on Windows 

New in version 2.6. 

## Overview 

MongoDB Enterprise supports authentication using a Kerberos service (page 331). Kerberos is an industry standard authentication protocol for large client/server system. Kerberos allows MongoDB and applications to take advantage of existing authentication infrastructure and processes. 

## Prerequisites 

Setting up and configuring a Kerberos deployment is beyond the scope of this document. This tutorial assumes have configured a Kerberos service principal (page 332) for each mongod.exe and mongos.exe instance. 

## Procedures 

Step 1: Start mongod.exe without Kerberos. For the initial addition of Kerberos users, start mongod.exe without Kerberos support. 

If a Kerberos user is already in MongoDB and has the privileges required to create a user , you can start mongod.exe with Kerberos support. 

Step 2: Connect to mongod . Connect via the mongo.exe shell to the mongod.exe instance. If mongod.exe has --auth enabled, ensure you connect with the privileges required to create a user . 

