-
Notifications
You must be signed in to change notification settings - Fork 81
DOCSP-24594-Compass-auth-examples #708
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 12 commits
8eb2bce
920f171
3ae93e3
901e4e8
c04f4e8
b5b58e4
7f29522
50e6844
48540de
3fbc615
de6caac
0b680bd
44087c3
4ae08c2
9359bf8
9238a00
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -54,6 +54,7 @@ Procedure | |
| Username / Password | ||
| ~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
|
|
||
| Provide the following information: | ||
|
|
||
| - Username | ||
|
|
@@ -237,6 +238,13 @@ Procedure | |
| LDAP | ||
| ~~~~ | ||
|
|
||
| .. note:: | ||
|
|
||
| See the :ref:`Examples | ||
| <authentication-username-password-example>` section on this | ||
| page for an example of the authentication tab configured for | ||
| username and password authentication. | ||
|
|
||
| Select :guilabel:`LDAP` if the deployment uses :manual:`LDAP | ||
| </core/security-ldap-external/>` as its authentication mechanism. | ||
|
|
||
|
|
@@ -273,3 +281,32 @@ Procedure | |
| .. seealso:: | ||
|
|
||
| To disconnect from your deployment, see :ref:`<disconnect-tab>`. | ||
|
|
||
| Examples | ||
| -------- | ||
|
|
||
| .. _authentication-username-password-example: | ||
|
|
||
| Username and Password Authentication | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| The following example specifies a connection with username and | ||
| password authentication with :manual:`SCRAM-SHA-256 | ||
| </core/security-scram/>` in the :guilabel:`Authentication` tab. | ||
|
|
||
| .. figure:: /images/authentication/authentication-configuration.png | ||
| :figwidth: 662px | ||
| :alt: Screenshot of Compass configured to authenticate with username and password | ||
|
|
||
| .. _authentication-ldap-example: | ||
|
|
||
| LDAP Authentication | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sorry, I realized after I suggested that we add this example that LDAP is actually deprecated. I wonder if we should remove this or replace with a different auth example? Happy to defer to product for their opinion here. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @betsybutton Do you have thoughts here? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Even though LDAP is deprecated, this is an area that has caused a lot of pain in the past, so I think it's worth including here. Some larger customers take much longer to upgrade to the latest MongoDB version, and we might as well provide the assistance. |
||
| ~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Alternatively, the following example specifies a connection with | ||
| :manual:`LDAP </core/security-ldap-external/>` authentication in the | ||
| :guilabel:`Authentication` tab. | ||
|
|
||
| .. figure:: /images/authentication/ldap-configuration.png | ||
| :figwidth: 662px | ||
| :alt: Screenshot of Compass configured to authenticate with LDAP | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -52,14 +52,31 @@ Procedure | |
| * - mongodb | ||
| - :manual:`Standard Connection String Format </reference/connection-string/>`. | ||
| The standard format of the MongoDB connection URI is used to | ||
| connect to a MongoDB deployment by specifying its hosts directly. | ||
| connect to a MongoDB deployment by specifying its hosts | ||
| directly. | ||
|
|
||
| Use this option to connect to standalone, replica set, | ||
| or a sharded cluster | ||
|
|
||
| .. note:: | ||
|
|
||
| If you use the standard connection string format to | ||
| connect to an `Atlas | ||
| <https://www.mongodb.com/cloud/atlas>`__ deployment, | ||
| you must turn on TLS/SSL in the | ||
| :guilabel:`TLS/SSL` tab of the :guilabel:`New | ||
| Connection` modal. | ||
|
|
||
| * - mongodb+srv | ||
| - :manual:`DNS Seed List Connection Format | ||
| </reference/connection-string/#dns-seed-list-connection-format>`. | ||
| The ``+srv`` indicates to |compass| that the hostname that follows | ||
| corresponds to a DNS SRV record. | ||
|
|
||
| .. note:: | ||
|
|
||
| The mongodb+srv automatically enables TLS/SSL. | ||
|
|
||
| b) Enter a Hostname. | ||
|
|
||
| In the :guilabel:`Host` field, enter the hosts or hostname of the server | ||
|
|
@@ -93,3 +110,15 @@ Procedure | |
| .. seealso:: | ||
|
|
||
| To disconnect from your deployment, see :ref:`<disconnect-tab>`. | ||
|
|
||
| Example | ||
| ------- | ||
|
|
||
| The following example specifies a connection with :manual:`SCRAM-SHA-256 | ||
| </core/security-scram/>` in the :guilabel:`General` tab. Since the | ||
| connection uses the ``mongodb`` connection string scheme to connect to | ||
| an Atlas cluster, the connection also enables TLS/SSL. | ||
|
|
||
| .. figure:: /images/authentication/new-atlas-connection.png | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I noticed the other figures specified a figwidth of 662px. Should we add that here as well? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks for catching this! Done! |
||
| :figwidth: 662px | ||
| :alt: Screenshot of Compass configured to connect to an example Atlas cluster | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,6 +16,12 @@ The :guilabel:`TLS / SSL` tab allows you to connect deployments with TLS / SSL. | |
| For more information on :guilabel:`TLS / SSL`, see :manual:`TLS Options | ||
| </reference/connection-string/#tls-options>` | ||
|
|
||
| .. note:: | ||
|
|
||
| If you connect to an Atlas cluster with the :manual:`standard | ||
| connection string format </reference/connection-string/>`, you must | ||
| enable TLS/SSL. | ||
|
|
||
| Procedure | ||
| --------- | ||
|
|
||
|
|
@@ -105,7 +111,8 @@ Procedure | |
| .. warning:: | ||
|
|
||
| Enabling ``tlsInsecure``, ``tlsAllowInvalidHostnames``, and | ||
| ``tlsAllowInvalidCertificates`` may cause a security vulnerabilty. | ||
| ``tlsAllowInvalidCertificates`` may cause a security | ||
| vulnerabilty. | ||
|
|
||
| .. step:: (Optional) For advanced connection configuration options, click the :ref:`Advanced <advanced-connection-tab>` tab. | ||
|
|
||
|
|
@@ -114,3 +121,17 @@ Procedure | |
| .. seealso:: | ||
|
|
||
| To disconnect from your deployment, see :ref:`<disconnect-tab>`. | ||
|
|
||
| Example | ||
| ------- | ||
|
|
||
| The following example specifies a connection with TLS/SSL enabled in the | ||
| :guilabel:`TLS / SSL` tab. This connection uses :manual:`X.509 | ||
| </core/security-x.509/>` authentication which requires a client | ||
| certificate. | ||
|
Comment on lines
+128
to
+131
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The screenshot doesn't showcase selecting a .pem file right now - could we update it to mirror what a successful x509 setup would look like? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Done! |
||
|
|
||
| .. figure:: /images/authentication/tls-ssl-configuration.png | ||
| :figwidth: 662px | ||
| :alt: Screenshot of Compass configured to connect to an example cluster with TLS/SSL | ||
|
|
||
| 1 | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[q] Is there a reason to list these examples all the way at the bottom, instead of including them in the sections pertinent to each connection method above? And if it's truly better to have these at the bottom, can we link to them from above? I'm worried they won't be very visible down here since they're hidden & not linked.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added a note in the username/password and ldap sections linking to the according examples. The reason they are at the bottom is to make a dedicated ToC item on this page with the examples (see this comment from Jeff)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it, thanks for adding the link!