User authentication with the wire listener

You can use the following types of authentication methods with the wire listener:

SCRAM-SHA-256 two-step authentication

The wire listener authenticates users with the MongoDB SCRAM-SHA-256 authentication method outside of the HCL OneDB™ database server environment. You create users with the MongoDB API create user commands. User information and privileges are stored in the system.users collection in the admin database. Clients connect to the wire listener as MongoDB users and the wire listener authenticates the users. The wire listener connects to the database server as the user that is specified by the url parameter in the wire listener configuration file. The database server cannot access MongoDB user account information.

Database server authentication with a PAM (UNIX, Linux)

The PAM implements the MONGODB-CR challenge-response method. The wire listener connects to the database server using the user and password that is provided by clients and the database server authenticates the user through PAM. The database server controls all user accounts and privileges. You can audit user activities and configure fine-grained access control.

When connecting to the wire listener with MongoDB client drivers, you will need to specify that the authentication mechanism used as MONGODB-CR. For most Mongo drivers, you do this by specifying authMechanism=MONGODB-CR in the MongoDB url. Check the documentation for your MongoDB client driver for more information.

Which type of authentication that you can use depends on the type of client and the mongo.api.version specified in your wire listener configuration file.

MongoDB clients