Skip to content

Commit 9df6f43

Browse files
kennethdyerkennethdyer
authored
DOCSP-34392 Expands auth config (#6568) (#9429)
* DOCSP-34392 Convert Standalone to RS with Auth
1 parent 056f228 commit 9df6f43

File tree

2 files changed

+136
-44
lines changed

2 files changed

+136
-44
lines changed

‎source/includes/configure-rs-members.rst‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
2+
Configure member authentication for each server in the replica set.
3+
4+
.. tabs::
5+
6+
.. tab:: X.509 Authentication
7+
:tabid: convert-config-rs-x509
8+
9+
Configure the replica set to use X.509 certificates for internal member
10+
authentication.
11+
12+
.. list-table::
13+
:header-rows: 1
14+
15+
* - Setting
16+
- Option
17+
- Description
18+
19+
* - :setting:`net.tls.mode`
20+
- :option:`--tlsMode <mongod --tlsMode>`
21+
- Sets the TLS mode to use in authentication. To configure the server
22+
to require X.509 certificate authentication, set this option to
23+
``requireTLS``.
24+
* - :setting:`net.tls.certificateKeyFile`
25+
- :option:`--tlsCertificateKeyFile <mongod --tlsCertificateKeyFile>`
26+
- Sets the path to the ``.pem`` file that contains the TLS certificate
27+
for client connections.
28+
* - :setting:`net.tls.CAFile`
29+
- :option:`--tlsCAFile <mongod --tlsCAFile>`
30+
- Sets the path to the file that contains the root certificate chain
31+
for the Certificate Authority (CA).
32+
* - :setting:`net.tls.clusterFile`
33+
- :option:`--tlsClusterFile <mongod --tlsClusterFile>`
34+
- Sets the path to the ``.pem`` file that contains the TLS certificate
35+
for cluster member connections.
36+
* - :setting:`security.clusterAuthMode`
37+
- :option:`--clusterAuthMode <mongod --clusterAuthMode>`
38+
- Sets the mode used to authenticate cluster members. To use X.509
39+
authentication, set this option to ``x509``.
40+
41+
For example:
42+
43+
.. code-block:: yaml
44+
45+
replication:
46+
replSetName: "rs0"
47+
security:
48+
clusterAuthMode: x509
49+
net:
50+
tls:
51+
mode: requireTLS
52+
certificateKeyFile: /etc/mongodb/client.pem
53+
CAFile: /etc/mongodb/ca.pem
54+
clusterFile: /etc/mongodb/member.pem
55+
56+
.. tab:: Keyfile Authentication
57+
:tabid: config-rs-keyfile
58+
59+
Configure the replica set to use keyfiles for internal member authentication.
60+
To authenticate, each member must have a copy of the same keyfile.
61+
62+
.. list-table::
63+
:header-rows: 1
64+
65+
* - Setting
66+
- Option
67+
- Description
68+
* - :setting:`security.keyFile`
69+
- :option:`--keyFile <mongod --keyFile>`
70+
- Sets the path to the replica set keyfile.
71+
72+
For example:
73+
74+
.. code-block:: yaml
75+
76+
replication:
77+
replSetName: "rs0"
78+
security:
79+
keyFile: /etc/mongodb/keyfile
80+
81+
.. tab:: No Authentication
82+
:tabid: config-rs-noauth
83+
84+
Configures a replica set without authorization.
85+
86+
.. warning::
87+
88+
You should only use this configuration for internal replica sets that
89+
are **not** accessible through the network.
90+
91+
.. list-table::
92+
:header-rows: 1
93+
94+
* - Setting
95+
- Option
96+
- Description
97+
98+
* - :setting:`net.bindIp`
99+
- :option:`--bind_ip <mongod --bind_ip>`
100+
- Sets the hostnames or IP addresses that MongoDB listens on for client
101+
connections. To block network access to the server, set this option
102+
to ``localhost``.
103+
104+
For example:
105+
106+
.. code-block:: yaml
107+
108+
replication:
109+
replSetName: "rs0"
110+
net:
111+
bindIp: localhost

‎source/tutorial/convert-standalone-to-replica-set.txt‎

Lines changed: 25 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ production, convert the standalone server to a replica set first.
2727
Before You Begin
2828
----------------
2929

30+
Cluster Type
31+
~~~~~~~~~~~~
32+
3033
Before you convert your standalone instance, consider whether a
3134
:ref:`replica set <replication>` or a :ref:`sharded cluster
3235
<sharding-background>` is more appropriate for your workload.
@@ -36,6 +39,17 @@ provides redundancy and availability; it also distributes data across
3639
:ref:`shards <shards-concepts>`. Shards are usually hosted on multiple
3740
servers and allow for horizontal scaling.
3841

42+
Authorization
43+
~~~~~~~~~~~~~
44+
45+
To use authorization with a replica set, you must also configure
46+
replica set members to use X.509 certificates or keyfiles to
47+
perform internal authentication.
48+
49+
For more information, see:
50+
51+
- :ref:`x509-internal-authentication`
52+
- :ref:`deploy-repl-set-with-keyfile`
3953

4054
Procedure
4155
---------
@@ -64,56 +78,23 @@ Procedure
6478
}
6579
)
6680

67-
.. step:: Name the replica set.
68-
69-
If you configure your ``mongod`` instance from the command line,
70-
use the :option:`--replSet <mongod --replSet>` option to set a
71-
name for your replica set.
81+
.. step:: Configure Replica Set Members
7282

73-
A typical command line invocation might include:
83+
Update the configuration file on each server and to set
84+
the :setting:`~replication.replSetName` setting.
7485

75-
.. list-table::
76-
:header-rows: 1
77-
78-
* - Purpose
79-
- Option
80-
81-
* - Cluster name
82-
- :option:`--replSet <mongod --replSet>`
83-
84-
* - Network details
85-
- :option:`--port <mongod --port>`
86-
87-
* - Data path
88-
- :option:`--dbpath <mongod --dbpath>`
89-
90-
* - Authentication details
91-
- :option:`--authenticationDatabase <mongosh
92-
--authenticationDatabase>`, :option:`--username
93-
<mongosh --username>`, :option:`--password <mongosh
94-
--password>`
95-
96-
Update the example code with the settings for your deployment.
86+
.. code-block:: yaml
9787

98-
.. code-block:: shell
99-
100-
mongod --replSet rs0 \
101-
--port 27017 \
102-
--dbpath /path/to/your/mongodb/dataDirectory \
103-
--authenticationDatabase "admin" \
104-
--username "adminUserName" \
105-
--password
106-
107-
If you use a configuration file to start ``mongodb``, add a
108-
``replication`` section to your configuration file. Edit the
109-
``replSetName`` value to set the name of your replica set.
88+
replication:
89+
replSetName: "rs0"
11090

111-
.. code-block:: shell
91+
.. step:: Configure Member Authentication
11292

113-
replication:
114-
replSetName: rs0
93+
.. include:: /includes/configure-rs-members
11594

116-
.. include:: /includes/tip-repl-set-config.rst
95+
.. step:: Start MongoDB
96+
97+
Start :program:`mongod` for each member.
11798

11899
.. step:: Initialize the replica set.
119100

0 commit comments

Comments
 (0)