Skip to content

Commit 9bf2076

Browse files
davidhou17jwilliams-mongo
davidhou17
and
jwilliams-mongo
authored
(DOCSP-45035): Backport DOCSP-44329 to v7.0 (#501)
Co-authored-by: John Williams <[email protected]>
1 parent 702527a commit 9bf2076

20 files changed

+1575
-133
lines changed

‎snooty.toml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@ intersphinx = [ "https://docs.mongodb.com/manual/objects.inv",
88
"https://www.mongodb.com/docs/mongodb-shell/objects.inv",
99
"https://www.mongodb.com/docs/datalake/objects.inv",
1010
"https://www.mongodb.com/docs/atlas/app-services/objects.inv",
11-
"https://www.mongodb.com/docs/cluster-to-cluster-sync/current/objects.inv"
11+
"https://www.mongodb.com/docs/cluster-to-cluster-sync/current/objects.inv",
12+
"https://www.mongodb.com/docs/languages/python/pymongo-driver/objects.inv",
13+
"https://www.mongodb.com/docs/drivers/java/sync/current/objects.inv",
14+
"https://www.mongodb.com/docs/drivers/node/current/objects.inv"
1215
]
1316

1417
toc_landing_pages = [
@@ -31,6 +34,7 @@ toc_landing_pages = [
3134
"/tutorial/configure-local-mode",
3235
"/tutorial/slack-integration",
3336
"/tutorial/configure-public-api-access",
37+
"/tutorial/enable-oidc-authentication-for-group",
3438
"/tutorial/manage-users",
3539
"/tutorial/manage-alert-configurations",
3640
"/tutorial/nav/access-control",
@@ -88,12 +92,15 @@ mdbagent-version-cloud = "11.11.0.7355"
8892
mdbagent-version-opsmgr = "10.14.31.6566"
8993
mdbagent-wa = "MongoDB Agent with Automation"
9094
mongosh = ":binary:`~bin.mongosh`"
95+
oauth2 = "OAuth 2.0"
9196
onprem = "Ops Manager"
9297
onprem-full = "MongoDB Ops Manager"
9398
opsmgr-example-url = "<OpsManagerHost>:<Port>"
9499
opsmgr-url = "<OpsManagerHost>:<Port>"
100+
pkce = ":abbr:`PKCE (Proof Key of Code Exchange)`"
95101
version = "7.0"
96102
wif = "Workforce Identity Federation"
103+
workload = "Workload Identity Federation"
97104

98105
[substitutions]
99106
2fa = ":abbr:`2FA (two-factor authentication)`"
@@ -110,6 +117,7 @@ application-s = "Ops Manager Applications"
110117
application = "Ops Manager Application"
111118
aws = ":abbr:`AWS (Amazon Web Services)`"
112119
azure = ":abbr:`Azure (Microsoft Azure)`"
120+
azure-ad = "Microsoft Entra ID"
113121
gcp = ":abbr:`GCP (Google Cloud Platform)`"
114122
bic-full = ":bic:`MongoDB Connector for BI </>`"
115123
bic-short = ":bic:`BI Connector </>`"
@@ -151,6 +159,7 @@ https = ":abbr:`HTTPS (Hypertext Transfer Protocol Secure)`"
151159
iam = ":abbr:`IAM (Identity and Access Management)`"
152160
iana = ":abbr:`IANA (Internet Assigned Numbers Authority)`"
153161
idp = ":abbr:`IdP (Identity Provider)`"
162+
idp-full = "Identity Provider"
154163
idps = ":abbr:`IdPs (Identity Providers)`"
155164
ietf = ":abbr:`IETF (Internet Engineering Task Force)`"
156165
index-page-title = "MongoDB Ops Manager"
@@ -170,6 +179,7 @@ jedec = ":abbr:`JEDEC (Joint Electron Device Engineering Council Solid State Tec
170179
jira = "`Jira <https://jira.mongodb.org>`__"
171180
json = ":abbr:`JSON (Javascript Object Notation)`"
172181
jvm = ":abbr:`JVM (Java Virtual Machine)`"
182+
jwt = ":abbr:`JWT (JSON Web Token)`"
173183
k8s-configmap = "`ConfigMap <https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/>`__"
174184
k8s-configmaps = "`ConfigMaps <https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/>`__"
175185
k8s-crd = "`CustomResourceDefinition <https://kubernetes.io/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions/>`__"
@@ -274,5 +284,6 @@ vm = ":abbr:`VM (Virtual Machine)`"
274284
vmg = ":abbr:`VMG (Virtual Machine Group)`"
275285
vmg-full = "Virtual Machine Group"
276286
win-http-service = "MongoDB Ops Manager HTTP Service"
287+
workload = "Workload Identity Federation"
277288
xml = ":abbr:`XML (eXtensible Markup Language)`"
278289
yaml = ":abbr:`YAML (Yet Another Markup Language)`"

‎source/includes/authentication-oidc-intro.rst‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
`MongoDB Enterprise
22
<https://www.mongodb.com/products/mongodb-enterprise-advanced>`_
33
allows authentication using OIDC. To authenticate with `OIDC
4-
<https://openid.net/>`__, you must first register your |oidc|
5-
or OAuth application with an |idp| that supports |oidc| standard,
6-
such as as :abbr:`Azure AD (Azure Active Directory)`, Okta, and Ping
4+
<https://openid.net/>`__, complete the steps on this page.
5+
You must first :ref:`register <register-oidc>`
6+
your |oidc| or OAuth application with an |idp| that supports the |oidc| standard,
7+
such as as |azure-ad|, Okta, and Ping
78
Identity.

‎source/includes/steps-configure-oidc-azure.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,14 +127,14 @@ content: |
127127
:guilabel:`OpenID Connect metadata document` |url| and
128128
copying the value for ``issuer``.
129129
130-
The following table shows what these :abbr:`Azure AD (Azure Active
131-
Directory)` UI values map to in our |mms| Configuration Properties:
130+
The following table shows what these |azure-ad|
131+
UI values map to in our |mms| Configuration Properties:
132132
133133
.. list-table::
134134
:header-rows: 1
135135
:widths: 50 50
136136
137-
* - :abbr:`Azure AD (Azure Active Directory)` UI
137+
* - |azure-ad| UI
138138
- |mms| Configuration Property
139139
140140
* - :guilabel:`Application (client) ID`

‎source/includes/steps-configure-oidc-user-group.rst‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
.. procedure::
2+
:style: normal
3+
4+
.. step:: Navigate to the :guilabel:`MongoDB Roles` tab for your deployment.
5+
6+
a. Select the organization that
7+
contains your project from the |ui-org-menu| in the
8+
navigation bar.
9+
10+
#. Select your project
11+
from the :guilabel:`Projects` menu in the navigation bar.
12+
13+
#. Click :guilabel:`Deployment` in
14+
the sidebar.
15+
16+
#. Click the :guilabel:`Security` tab.
17+
#. Click the :guilabel:`MongoDB Roles` tab.
18+
19+
.. step:: Click :guilabel:`Add New Role`.
20+
21+
.. step:: Create the OIDC role.
22+
23+
a. Enter the following fields:
24+
25+
.. list-table::
26+
:header-rows: 1
27+
:widths: 20 20 60
28+
29+
* - Field
30+
- Necessity
31+
- Description
32+
33+
* - :guilabel:`Identifier`
34+
- Required
35+
- In the :guilabel:`Database` box, enter ``admin``.
36+
37+
In the :guilabel:`Name` box, enter your |oidc| |idp| configuration
38+
name and the group name from your external identity provider,
39+
separated by a slash ``/``:
40+
41+
.. code-block:: none
42+
43+
{configuration_name}/{group_name}
44+
45+
* - :guilabel:`Inherits From`
46+
- Optional
47+
- A list of role name and database pairs. The format for these
48+
pairs are ``roleName@dbName``.
49+
50+
* - :guilabel:`Authentication Restrictions`
51+
- Optional
52+
- A list of IP addresses or CIDR notations that you want to
53+
restrict from your |idp|.
54+
55+
* - :guilabel:`Privilege Actions by Resource`
56+
- Optional
57+
- Actions permitted on the resource.
58+
59+
To learn more, see :manual:`Privilege Actions </reference/privilege-actions/>`.
60+
61+
#. Click :guilabel:`Add Role`.
62+

‎source/includes/steps-configure-oidc-user.yaml‎

Lines changed: 71 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,101 @@
11
---
22
stepnum: 1
3-
ref: oidc-user-mongodb-roles
3+
ref: oidc-user-mongodb-users
44
level: 4
5-
title: "Navigate to the :guilabel:`MongoDB Roles` tab for your deployment."
5+
title: "Navigate to the :guilabel:`MongoDB Users` tab for your deployment."
66
content: |
77
8-
a. If it is not already displayed, select the organization that
9-
contains your desired project from the |ui-org-menu| in the
8+
a. Select the organization that
9+
contains your project from the |ui-org-menu| in the
1010
navigation bar.
1111
12-
#. If it is not already displayed, select your desired project
12+
#. Select your project
1313
from the :guilabel:`Projects` menu in the navigation bar.
1414
15-
#. If it is not already displayed, click :guilabel:`Deployment` in
15+
#. Click :guilabel:`Deployment` in
1616
the sidebar.
1717
1818
#. Click the :guilabel:`Security` tab.
19-
#. Click the :guilabel:`MongoDB Roles` tab.
19+
#. Click the :guilabel:`MongoDB Users` tab.
2020
2121
---
22-
stepnum: 2
23-
ref: oidc-user-click-create
22+
stepnum: 3
23+
ref: oidc-click-add-user
2424
level: 4
25-
title: "Click :guilabel:`Add New Role`."
26-
25+
title: "Click :guilabel:`Add New User`."
2726
---
28-
stepnum: 3
29-
ref: oidc-user-create-role
27+
stepnum: 4
28+
ref: oidc-add-user
3029
level: 4
31-
title: "Create the OIDC role."
30+
title: "Add the OIDC user."
3231
content: |
3332
34-
a. Enter the following fields:
33+
.. note::
34+
35+
Before you add users, ensure that you've
36+
:ref:`created any roles <om-custom-roles>`
37+
that you want to assign to the users.
38+
39+
a. Complete the user account fields:
3540
3641
.. list-table::
37-
:header-rows: 1
38-
:widths: 20 20 60
42+
:widths: 20 80
43+
:header-rows: 1
44+
45+
* - Field
46+
- Description
3947
40-
* - Field
41-
- Necessity
42-
- Description
48+
* - :guilabel:`Identifier`
4349
44-
* - :guilabel:`Identifier`
45-
- Required
46-
- In the :guilabel:`database` box, enter ``admin``.
47-
48-
In the :guilabel:`name` box, enter your ``projectId`` and
49-
group name from your |idp| separated by a slash ``/``:
50+
-
51+
- In the first field, enter the ``$external`` database.
52+
53+
- In the second field, enter a username using your |oidc| |idp| configuration
54+
name and the user principal claim from your configuration separated by a slash ``/``:
5055
5156
.. code-block:: none
5257
53-
{projectId}/{group_name}
58+
{configuration_name}/{user_principal_claim}
59+
60+
* - :guilabel:`Roles`
61+
62+
- Enter any available user-defined roles and :manual:`built-in
63+
roles </reference/built-in-roles>` into this box. The combo
64+
box provides a list of existing roles when you click in it.
65+
66+
* - :guilabel:`Authentication Restrictions`
67+
68+
-
69+
a. Click :guilabel:`Add Entry`.
5470
55-
* - :guilabel:`Inherits From`
56-
- Optional
57-
- A list of role name and database pairs. The format for these
58-
pairs are ``roleName@dbName``.
71+
b. Add one or more |ipaddr| addresses and/or |cidr| blocks in
72+
either the :guilabel:`Client Source` or :guilabel:`Server
73+
Address` boxes. Separate multiple addresses or blocks with
74+
commas.
5975
60-
* - :guilabel:`Authentication Restrictions`
61-
- Optional
62-
- A list of IP addresses or CIDR notations that you want to
63-
restrict from your |idp|.
76+
- :guilabel:`Client Source` restricts which addresses this
77+
user can authenticate and use the given roles.
6478
65-
#. Click :guilabel:`Add Role`.
79+
- :guilabel:`Server Address` restricts the addresses this
80+
user can authenticate and has the given roles.
81+
82+
c. Click :guilabel:`Save`.
83+
84+
d. To add another entry, click :guilabel:`Add Entry`.
85+
86+
#. Click :guilabel:`Add User`.
87+
88+
---
89+
level: 4
90+
stepnum: 5
91+
source:
92+
file: steps-source-deployment-page.yaml
93+
ref: review-deployment
94+
---
95+
level: 4
96+
stepnum: 6
97+
source:
98+
file: steps-source-deployment-page.yaml
99+
ref: confirm-deployment
66100
...
101+

‎source/includes/steps-delete-oidc-configuration.rst‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
.. procedure::
2+
:style: normal
3+
4+
.. step:: Navigate to the :guilabel:`Security Settings` dialog for your deployment.
5+
6+
a. Select the organization that
7+
contains your project from the |ui-org-menu| in the
8+
navigation bar.
9+
10+
#. Select your project
11+
from the :guilabel:`Projects` menu in the navigation bar.
12+
13+
#. Click :guilabel:`Deployment` in
14+
the sidebar.
15+
#. Click the :guilabel:`Security` tab.
16+
#. Click the :guilabel:`Settings` tab.
17+
18+
.. step:: Remove the configuration.
19+
20+
a. Scroll to the :guilabel:`OIDC Connection and Authorization
21+
(Required for OIDC)` section.
22+
23+
#. For the configuration that you want to delete, click the
24+
:guilabel:`REMOVE` button.
25+
26+
#. In the :guilabel:`Removing OIDC IdP configuration?` dialog box,
27+
click :guilabel:`Remove`.

‎source/includes/steps-edit-oidc-configuration.rst‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
.. procedure::
2+
:style: normal
3+
4+
.. step:: Navigate to the :guilabel:`Security Settings` dialog for your deployment.
5+
6+
a. Select the organization that
7+
contains your project from the |ui-org-menu| in the
8+
navigation bar.
9+
10+
#. Select your project
11+
from the :guilabel:`Projects` menu in the navigation bar.
12+
13+
#. Cick :guilabel:`Deployment` in
14+
the sidebar.
15+
#. Click the :guilabel:`Security` tab.
16+
#. Click the :guilabel:`Settings` tab.
17+
18+
.. step:: Edit the configuration.
19+
20+
a. Scroll to the :guilabel:`OIDC Connection and Authorization
21+
(Required for OIDC)` section.
22+
23+
#. For the configuration that you want to edit, click the
24+
:guilabel:`EDIT` button.
25+
26+
#. Make changes to the configuration.
27+
28+
.. step:: Click :guilabel:`Save Configuration`.
29+
.. step:: Click :guilabel:`Save Settings`.
30+
.. step:: Click :guilabel:`Review & Deploy` to review your changes.
31+
.. step:: Click :guilabel:`Confirm & Deploy` to deploy your changes.
32+
33+
Otherwise, click :guilabel:`Cancel` and you can make
34+
additional changes.

0 commit comments

Comments
 (0)