Skip to content

Commit ae96421

Browse files
kyuan-mongodbkyuan-mongodb
authored
DOCSP-19652 X509 connection (#213)
* added X509 steps
1 parent e3f68d7 commit ae96421

7 files changed

+219
-6
lines changed

‎source/includes/fact-read-read-write-actions.rst

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
When applied to a collection, the ``read`` and ``readWrite`` roles in
2+
|service| differ slightly from the
3+
:manual:`built-in </reference/built-in-roles/>` MongoDB ``read`` and
4+
``readWrite`` roles.
5+
6+
In |service|, ``read`` provides the following collection-level
7+
:manual:`actions </reference/privilege-actions/>`:
8+
9+
- :manual:`collStats </reference/privilege-actions/#collStats/>`
10+
11+
- :manual:`dbHash </reference/privilege-actions/#dbHash>`
12+
13+
- :manual:`find </reference/privilege-actions/#find/>`
14+
15+
- :manual:`listIndexes </reference/privilege-actions/#listIndexes>`
16+
17+
In |service|, ``readWrite`` provides the same actions
18+
as ``read``, as well as the following
19+
additional collection-level
20+
:manual:`actions </reference/privilege-actions/>`:
21+
22+
- :manual:`convertToCapped
23+
</reference/privilege-actions/#convertToCapped>`
24+
25+
- :manual:`createCollection
26+
</reference/privilege-actions/#createCollection>`
27+
28+
- :manual:`createIndex
29+
</reference/privilege-actions/#createIndex>`
30+
31+
- :manual:`dropCollection
32+
</reference/privilege-actions/#dropCollection>`
33+
34+
- :manual:`dropIndex
35+
</reference/privilege-actions/#dropIndex>`
36+
37+
- :manual:`insert <reference/privilege-actions/#insert>`
38+
39+
- :manual:`remove </reference/privilege-actions/#remove>`
40+
41+
- :manual:`update </reference/privilege-actions/#update>`

‎source/includes/steps-add-self-managed-x509-user.yaml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
title: "Open the :guilabel:`Add New Database User` dialog."
2+
level: 4
3+
ref: go-users-view
4+
content: |
5+
a. In the :guilabel:`Security` section of the left navigation, click
6+
:guilabel:`Database Access`. The :guilabel:`Database Users` tab
7+
displays.
8+
9+
#. Click :icon-fa5:`plus` :guilabel:`Add New Database User`.
10+
11+
---
12+
title: "Select :guilabel:`CERTIFICATE`."
13+
level: 4
14+
ref: select-self-managed
15+
16+
---
17+
title: "Enter user information."
18+
level: 4
19+
ref: enter-self-managed-user-info
20+
content: |
21+
.. list-table::
22+
:widths: 20 80
23+
:header-rows: 1
24+
25+
* - Field
26+
27+
- Description
28+
29+
* - :guilabel:`Common Name`
30+
31+
- The user's Common Name (CN) protected by the TLS/SSL
32+
certificate. For more information, see
33+
`RFC 2253 <https://tools.ietf.org/html/rfc2253>`_.
34+
35+
.. example::
36+
37+
If your common name is "Jane Doe", your organization is
38+
"MongoDB", and your country is "US", insert the following
39+
into the :guilabel:`Common Name` field:
40+
41+
.. code-block:: none
42+
:copyable: false
43+
44+
CN=Jane Doe,O=MongoDB,C=US
45+
46+
* - :guilabel:`User Privileges`
47+
48+
- You can assign roles in one of the following ways:
49+
50+
- Select :atlasrole:`Atlas admin`, which provides the user
51+
with :atlasrole:`readWriteAnyDatabase` as well as a number
52+
of administrative privileges.
53+
54+
- Select :atlasrole:`Read and write to any database`, which
55+
provides the user with privileges to read and write to any
56+
database.
57+
58+
- Select :atlasrole:`Only read any database` which provides
59+
the user with privileges to read any database.
60+
61+
- Select :guilabel:`Select Custom Role` to select a custom
62+
role previously created in |service|. You can create custom
63+
roles for database users in cases where the
64+
:manual:`built-in database user roles </reference/built-in-roles/#database-user-roles>`
65+
cannot describe the desired set of
66+
privileges. For more information on custom roles, see
67+
:ref:`mongodb-roles`.
68+
69+
- Click :guilabel:`Add Default Privileges`. When you
70+
click this option, you can select
71+
individual roles and specify the database on which the
72+
roles apply. Optionally, for the ``read`` and ``readWrite``
73+
roles, you can also specify a collection. If you do not
74+
specify a collection for ``read`` and ``readWrite``, the
75+
role applies to all non-``system`` collections in the
76+
database.
77+
78+
.. note::
79+
80+
.. include:: /includes/fact-read-read-write-actions.rst
81+
82+
For information on the built-in |service| privileges, see
83+
:ref:`atlas-user-privileges`.
84+
85+
For more information on authorization, see :manual:`Role-Based
86+
Access Control </core/authorization>` and :manual:`Built-in
87+
Roles </core/security-built-in-roles>` in the MongoDB manual.
88+
89+
---
90+
title: "Click :guilabel:`Add User`."
91+
level: 4
92+
ref: save-user
93+
...

‎source/includes/steps-configure-self-managed-x509.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
title: "Turn on Self-Managed X.509 Authentication."
2+
level: 4
3+
ref: toggle-on-self-managed-x509
4+
content: |
5+
a. In the :guilabel:`Security` section of |service|'s left
6+
navigation panel, click :guilabel:`Advanced`.
7+
8+
b. Toggle :guilabel:`Self-Managed X.509 Authentication` to
9+
:guilabel:`ON`.
10+
11+
---
12+
title: "Provide a PEM-encoded Certificate Authority."
13+
level: 4
14+
ref: add-pem
15+
content: |
16+
17+
You can provide a Certificate Authority (CA) by:
18+
19+
- Clicking :guilabel:`Upload` and selecting a ``.pem`` file from
20+
your filesystem.
21+
22+
- Copying the contents of a ``.pem`` file into the provided text
23+
area.
24+
25+
You can concatenate multiple CAs in the same ``.pem`` file or in the
26+
text area. Users can authenticate with certificates generated by any
27+
of the provided CAs.
28+
29+
When you upload a CA, a project-level alert is
30+
automatically created to send a notification 30 days before
31+
the CA expires, repeating every 24 hours. You can view and
32+
edit this alert from |service|'s :guilabel:`Alert Settings` page. For
33+
more information on configuring alerts, see
34+
:ref:`<configure-alerts>`.
35+
36+
---
37+
title: "Click :guilabel:`Save`."
38+
level: 4
39+
ref: save-pem
40+
...

‎source/includes/steps-source-privatelink.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ ref: create-private-endpoint
1919
title: "Click the :guilabel:`Private Endpoint` tab and then the
2020
following tab for the resource."
2121
replacement:
22-
22+
2323
dedicatedCluster: |
2424
Click :guilabel:`Dedicated Cluster` to manage the private endpoint
2525
for your dedicated |service| cluster. (default)
@@ -52,6 +52,7 @@ title: "Configure your private endpoint."
5252
content: |
5353
5454
a. Enter the following details about your |aws| |vpc|:
55+
5556
.. list-table::
5657
:widths: 20 80
5758
@@ -73,7 +74,7 @@ content: |
7374
7475
#. Copy the command the dialog displays and run it using the |aws|
7576
CLI.
76-
77+
7778
#. Click :guilabel:`Next`.
7879
7980
...

‎source/index.txt

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,9 @@ Privilege actions define the operations that you can perform on your
112112
Authentication Options
113113
----------------------
114114

115-
|data-lake| uses :manual:`SCRAM-SHA </core/security-scram/>` for
116-
authentication. It doesn't support :atlas:`x509
117-
</security-self-managed-x509/>` or :atlas:`LDAP
118-
</security-ldaps/>`.
115+
|data-lake| uses :manual:`SCRAM-SHA </core/security-scram/>` or
116+
:ref:`x509 <self-managed-x509-adl>` for authentication. It doesn't
117+
support :atlas:`LDAP </security-ldaps/>`.
119118

120119
.. _atlas-data-lake-regions:
121120

‎source/tutorial/configure-connection.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ data lake <gst-connect-adl>`.
3333
/tutorial/add-ip-address
3434
/tutorial/config-private-endpoint
3535
/tutorial/create-mongodb-user
36+
/tutorial/security-self-managed-x509

‎source/tutorial/security-self-managed-x509.txt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
.. _self-managed-x509-adl:
2+
3+
========================================
4+
Set up Self-Managed X.509 Authentication
5+
========================================
6+
7+
.. default-domain:: mongodb
8+
9+
.. contents:: On this page
10+
:local:
11+
:backlinks: none
12+
:depth: 1
13+
:class: singlecol
14+
15+
Self-managed X.509 certificates provide database users access to the
16+
database deployments in their project. Database users are separate from |service|
17+
users. Database users have access to MongoDB databases, while |service|
18+
users have access to the |service| application itself.
19+
20+
Prerequisites
21+
-------------
22+
23+
In order to use self-managed X.509 certificates, you must have a
24+
Public Key Infrastructure to integrate with |service-fullname|.
25+
26+
Configure a Project to use a Public Key Infrastructure
27+
------------------------------------------------------
28+
29+
.. include:: /includes/steps/configure-self-managed-x509.rst
30+
31+
To edit your CA once uploaded, click the
32+
:guilabel:`Self-Managed X.509 Authentication Settings`
33+
:icon-fa5:`pencil-alt` icon.
34+
35+
Add a Database User using Self-Managed X.509 Authentication
36+
-----------------------------------------------------------
37+
38+
.. include:: /includes/steps/add-self-managed-x509-user.rst

0 commit comments

Comments
 (0)