Authentication

SCRAM, X.509 and MongoDB's other mechanisms, with one-round-trip authentication.

Authorization is always on except with --insecure. Drivers authenticate with the same mechanisms as in MongoDB.

Requirements

A user created with createUser.
For MONGODB-X509, a client certificate signed by a CA the node trusts.

Mechanisms

Mechanism	Use
`SCRAM-SHA-256`	User and password; the default
`SCRAM-SHA-1`	User and password for older clients
`MONGODB-X509`	Client certificate
`PLAIN`	LDAP
`GSSAPI`	Kerberos
`MONGODB-AWS`	AWS credentials
`MONGODB-OIDC`	OIDC provider

With speculativeAuthenticate, current drivers authenticate in the same round trip as the initial handshake.

Stored credentials

TeselaDB stores the keys derived by SCRAM (salt, iterations, StoredKey and ServerKey), never the password. Neither passwords nor private keys appear in the logs or the metrics.

With a client certificate

mongodb://node-01:27017/?tls=true&tlsCAFile=./ca.pem&tlsCertificateKeyFile=./app.pem&authMechanism=MONGODB-X509

The user of a certificate lives in the $external database and is named after the certificate subject.

Check

In mongosh, run db.runCommand({ connectionStatus: 1 }). The answer carries in authInfo.authenticatedUsers the user you authenticated as, with its authentication database.

Common problems

A certificate connection does not authenticate because the $external user does not have the same name as the subject of the certificate.