security-scram.txt

.. _authentication-scram:

.. _authentication-scram-sha-1:

=====
SCRAM
=====

.. default-domain:: mongodb

.. contents:: On this page
   :local:
   :backlinks: none
   :depth: 1
   :class: singlecol

.. versionadded:: 3.0

Salted Challenge Response Authentication Mechanism (SCRAM) is the
default authentication mechanism for MongoDB. SCRAM is based on the
IETF `RFC 5802 <https://tools.ietf.org/html/rfc5802>`_ standard that
defines best practices for implementation of challenge-response
mechanisms for authenticating users with passwords.

Using SCRAM, MongoDB verifies the supplied user credentials against the
user's :data:`name <admin.system.users.user>`, :data:`password
<admin.system.users.credentials>` and :data:`authentication database
<admin.system.users.db>`. The authentication database is the database
where the user was created, and together with the user's name, serves
to identify the user.

MongoDB's implementation of SCRAM uses the SHA-1 hashing function.

.. _scram-advantages:

SCRAM Advantages
----------------

MongoDB's implementation of SCRAM represents an improvement in security
over the MongoDB challenge response authentication mechanism, providing:

- A tunable work factor (``iterationCount``),
- Per-user random salts rather than server-wide salts,
- A cryptographically stronger hash function (``SHA-1`` rather than ``MD5``),
  and
- Authentication of the server to the client as well as the client to the
  server.

MongoDB-CR User Credentials and SCRAM
-------------------------------------

.. include:: /includes/fact-mongodb-cr-users.rst

Driver Support
--------------

To use SCRAM, you must upgrade your driver if your current driver
version does not support ``SCRAM``.

The minimum driver versions that support ``SCRAM`` are:

.. |driver-compatibility-heading| replace:: Version

.. include:: /includes/list-table-3.0-driver-compatibility.rst

Additional Information
----------------------

- `Blog Post: Improved Password-Based Authentication in MongoDB 3.0: SCRAM
  Explained (Part 1)
  <https://www.mongodb.com/blog/post/improved-password-based-authentication-mong
  odb-30-scram-explained-part-1?jmp=docs>`_

- `Blog Post: Improved Password-Based Authentication in MongoDB 3.0: SCRAM
  Explained (Part 2)
  <https://www.mongodb.com/blog/post/improved-password-based-authentication-mong
  odb-30-scram-explained-part-2?jmp=docs>`_