Authentication
SCRAM, X.509 and MongoDB's other mechanisms, with one-round-trip authentication.
Authorization is always on except with --insecure. Drivers authenticate with the same mechanisms as in MongoDB:
| Mechanism | Use |
|---|---|
SCRAM-SHA-256 | User and password; the default |
SCRAM-SHA-1 | User and password for older clients |
MONGODB-X509 | Client certificate |
PLAIN | LDAP |
GSSAPI | Kerberos |
MONGODB-AWS | AWS credentials |
MONGODB-OIDC | OIDC provider |
With speculativeAuthenticate, current drivers authenticate in the same round trip as the initial handshake.
Stored credentials
TeselaDB stores the keys derived by SCRAM (salt, iterations, StoredKey and ServerKey), never the password. Neither
passwords nor private keys appear in the logs or the metrics.
With a client certificate
mongodb://node-01:27017/?tls=true&tlsCAFile=./ca.pem&tlsCertificateKeyFile=./app.pem&authMechanism=MONGODB-X509The user of a certificate lives in the $external database and is named after the certificate subject.