# Atlas WIF built-in vs callback authentication > Depth-first rabbithole dossier for Atlas WIF built-in vs callback authentication; source-anchored research pack. Parent: [Atlas Identity Federation and Resource Policy Boundaries](https://llms-explorer.com/tree/mongodb-atlas-identity-policy-frontier-20261001/) · 5 facets · 31 facts · page: https://llms-explorer.com/tree/atlas-wif-built-in-vs-callback-authentication/ ## How it works - [low] MongoDB Drivers support two types of authentication flow for Workload Identity Federation: Built-in Authentication and Callback Authentication. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The MONGODB-OIDC authentication mechanism requires MongoDB Server v7.0 or later running on a Linux platform and is only available when authenticating to MongoDB Atlas or MongoDB Enterprise Advanced. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The Atlas user identifier is the UAMI Object ID, while the Service Account annotation or Azure Identity is the Client ID; confusing these results in Authentication failures despite valid tokens. Sources: https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#troubleshooting` - [low] When creating role mappings in Atlas, the Azure group data sent in the SAML response must exactly match the configured Atlas role mapping name. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` ## Measurements and reference values - [low] For Azure VMs, set authMechanismProperties to `ENVIRONMENT:azure,TOKEN_RESOURCE:`; for GCP VMs, use `ENVIRONMENT:gcp,TOKEN_RESOURCE:`; and for Kubernetes, use `ENVIRONMENT:k8s`. Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The Node.js driver's `ENVIRONMENT:k8s` mode reads the `AZURE_FEDERATED_TOKEN_FILE` environment variable for AKS, `AWS_WEB_IDENTITY_TOKEN_FILE` for EKS, or the default `/var/run/secrets/kubernetes.io/serviceaccount/token` file for other Kubernetes environments like GKE. Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] If built-in authentication methods cannot be used, callback authentication can be used with any OAuth 2.0 authorization service. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] Setting the Atlas Audience to the Application ID URI while Entra issues v2 tokens results in a 200 response from Entra but an Authentication failure at Atlas finishAuthentication. Sources: https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#troubleshooting` - [low] Using an HTTP URL with Postman returns a 301 status code, but Postman may automatically retry with HTTPS while stripping the header and body, resulting in a 401 status code that obscures the original failure reason. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#troubleshooting` ## Comparisons and alternatives - [low] For Workload Identity Federation, select the Workload identity type rather than Workforce, as Workforce is intended for human SSO into the Atlas UI while Workload is for applications. Sources: https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [medium] When selecting Group ID in Azure, the security group's Object ID is sent rather than the human-readable group name, and Entra ID supports writing group names in the `memberOf` claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` ## Facts and statements - [low] With callback authentication, the MongoDB driver calls a provided callback method to obtain a JWT token for database access. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The Node.js driver supports built-in Workload Identity Federation for applications running on Azure VMs, Google Compute Engine VMs, and Kubernetes clusters, but not for all platforms like Azure Functions which require a custom callback. Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] For machine authentication using callback, assign the callback function to the `authMechanismProperties.OIDC_CALLBACK` property. Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The Node.js callback function receives an OIDCCallbackParams object (timeoutContext, an AbortSignal that aborts after 30 seconds; version; idpInfo; username; and an optional refreshToken). It returns an OIDCResponse with accessToken, optional expiresInSeconds, and optional refreshToken. Sources: https://www.mongodb.com/docs/drivers/node/current/security/authentication/oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] To manage federated authentication, you must have Organization Owner access to organizations delegating federation settings and at least Cloud App Administrator and User Administrator privileges in your Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The MongoDB Atlas Terraform provider supports Service Account JWT Token and Service Account as credentials for authentication. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#tools` - [low] Before testing federated authentication, save the Bypass SAML Mode URL to use if locked out of the Atlas organization, and keep the session logged in to the Federation Management Console to prevent lockouts. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#troubleshooting` - [high] MongoDB Atlas supports Workload Identity Federation only on dedicated clusters (M10 and above) running MongoDB version 7.0.11 or later, and only via selected drivers. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [high] The Atlas Issuer URI is `https://login.microsoftonline.com//v2.0`, which is the OpenID Connect metadata document value without the `/.well-known/openid-configuration` suffix. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] To create a service account or API keys for an organization, you must have Organization Owner access to that organization. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] To grant API keys access to a project, you must have Project Owner access for that project. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] If an organization service account is assigned to a project, the Project Owner can manage the service account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits include 100 database users, 500 Atlas users, 500 API keys, 250 users per team, 100 teams per project, 250 teams per organization, 100 teams per user, 250 organizations per user, 250 linked organizations, 25 clusters, 250 projects, 100 custom roles, 100 assigned roles per user, $50 hourly billing, 25 federated instances, 50 total network peering connections, 25 pending peering connections, and 1 Free cluster per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] Configure the SAML assertion to set the Name to `memberOf`, clear 'Emit groups as role claims', use HTTP POST for Request Binding, and SHA-256 for Response Signature Algorithm. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] You can bypass the Atlas login page by navigating directly to your Identity Provider's Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] In the Customize token properties section, ensure only Group ID is selected, set the requestedAccessTokenVersion from null to 2 to ensure the token is a JWT that MongoDB understands, and do not modify the default `sub` value. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] Select `Group Membership` to grant authorization based on group membership (specifying the field with default value `groups`) or `User ID` to authorize an individual user. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The Application (client) ID maps to the Client ID, and the Application ID URI maps to the Audience in the configuration. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#core` - [low] The C#/.NET driver supports Workload Identity Federation from version 2.25+, and PyMongo from version 4.7+. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#tools` - [low] If you download the certificate before setting the Identifier and Reply URL, the certificate is not unique and must be re-downloaded after updating these values, as the thumbprint and expiration date change. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-wif-built-in-vs-callback-authentication-031564f4fa/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Atlas — is a part of Atlas WIF built-in vs callback authentication - authentication — is a part of Atlas WIF built-in vs callback authentication - callback — is a part of Atlas WIF built-in vs callback authentication - built-in — is a part of Atlas WIF built-in vs callback authentication