## LDAP Proxy Authority Authentication 

MongoDB Enterprise 14 supports proxy authentication through a Lightweight Directory Access Protocol (LDAP) ser- vice. See Authenticate Using SASL and LDAP with OpenLDAP (page 369) and Authenticate Using SASL and LDAP with ActiveDirectory (page 366). 

MongoDB Enterprise for Windows does not include LDAP support for authentication. However, MongoDB Enterprise for Linux supports using LDAP authentication with an ActiveDirectory server. 

MongoDB does not support LDAP authentication in mixed sharded cluster deployments that contain both version 2.4 and version 2.6 shards. 

## Authentication Behavior 

## Client Authentication 

Clients can authenticate using the challenge and response (page 322), x.509 (page 322), LDAP Proxy (page 323) and Kerberos (page 322) mechanisms. 

Each client connection should authenticate as exactly one user. If a client authenticates to a database as one user and later authenticates to the same database as a different user, the second authentication invalidates the first. While clients can authenticate as multiple users if the users are defined on different databases, we recommend authenticating as one user at a time, providing the user with appropriate privileges on the databases required by the user. 

See Authenticate to a MongoDB Instance or Cluster (page 378) for more information. 

## Authentication Between MongoDB Instances 

You can authenticate members of replica sets and sharded clusters . To authenticate members of a single MongoDB deployment to each other, MongoDB can use the keyFile and x.509 (page 322) mechanisms. Using keyFile authentication for members also enables authorization. 

Always run replica sets and sharded clusters in a trusted networking environment. Ensure that the network permits only trusted traffic to reach each mongod and mongos instance. 

Use your environment’s firewall and network routing to ensure that traffic only from clients and other members can reach your mongod and mongos instances. If needed, use virtual private networks (VPNs) to ensure secure connec- tions over wide area networks (WANs). 

Always ensure that: 

• Your network configuration will allow every member of the replica set or sharded cluster to contact every other member. 

• If you use MongoDB’s authentication system to limit access to your infrastructure, ensure that you configure a keyFile on all members to permit authentication. 

See Generate a Key File (page 379) for instructions on generating a key file and turning on key file authentication for members. For an example of using key files for sharded cluster authentication, see Enable Authentication in a Sharded Cluster (page 358). 

