# Ops Manager LDAP/Kerberos/SAML/OIDC Federation > Source-anchored research for Ops Manager LDAP/Kerberos/SAML/OIDC Federation. Run status: COMPLETED. Parent: [MongoDB Ops Manager and Cloud Manager](https://llms-explorer.com/tree/mongodb-ops-manager-and-cloud-manager/) · 5 facets · 24 facts · page: https://llms-explorer.com/tree/ops-manager-ldap-kerberos-saml-oidc-federation/ ## Structure and components - OIDC supplies an identity layer over OAuth 2.0. Ops Manager uses an external IdP redirect flow and documents an authorization-code integration with issuer/discovery URI, client ID, client secret and PKCE settings; its OIDC groups are mapped to application roles. (high confidence) (verified as of 2026-10-14) — [source](https://openid.net/specs/openid-connect-core-1_0.html) ## How it works - Kerberos/GSSAPI for managed deployments requires MongoDB Enterprise builds, a configured Kerberos service, MongoDB service principals, and Agent principals/keytabs. A project may enable multiple client authentication mechanisms, but Agents use one selected mechanism. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-kerberos-authentication-for-group.md) - An Ops Manager user reported in March 2020 that after enabling LDAP PLAIN, the automation agent’s MongoS status check returned code 13, “command serverStatus requires authentication,” while PLAIN authentication worked and the process status remained at startup. This is a historical report, not evidence of a current defect or a generally safe workaround. (low confidence) — [source](https://stackoverflow.com/questions/60864518/opsmanager-mongodb-deployment-issue-adding-plain-auth) - For Ops Manager SAML federation, Ops Manager acts as the service provider and consumes identity-provider assertions. The integration exchanges issuer identifiers, endpoint metadata and signing certificates; the documented ACS endpoint ends in /saml/assert. This is an implementation of the SAML identity-provider/service-provider model, not a MongoDB wire-protocol authentication mechanism. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) - The Ops Manager OIDC tutorial recommends HTTPS and enables PKCE by default. It requires a Global Owner group configuration; its default group claim is groups. Existing SAML role mappings are preserved when migrating to OIDC. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-oidc-authentication.md) - For LDAP console sign-in, Ops Manager binds as a search user, searches the configured user and group bases, and authenticates the supplied password against LDAP. Group changes can take up to an hour to appear, or take effect when the affected user logs out and back in. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-ldap-authentication.md) ## Problems, failure modes and limitations - Ops Manager 8.0.17, released 2025-12-08, added OIDC authentication for Ops Manager users. Therefore an older deployment supporting database OIDC cannot be assumed to support OIDC console login. (medium confidence) (verified as of 2025-12-08) — [source](https://www.mongodb.com/docs/ops-manager/current/release-notes/application.md) - MongoDB deprecated database LDAP authentication and authorization starting in MongoDB 8.0, continued the deprecation in 9.0, and states that removal will occur in a future release. The database deprecation notice does not establish that the separately documented Ops Manager web-interface LDAP feature has already been removed. (medium confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/manual/core/LDAP-deprecation.md) ## Comparisons and alternatives - Ops Manager supports external identity-provider sign-in for console users through both SAML and OIDC. These tutorials describe authentication to the Ops Manager application, rather than database-client authentication. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) ## Facts and statements - Ops Manager distinguishes authentication to its web application from authentication by clients and Agents to managed MongoDB processes. Configuring LDAP for the web interface does not configure LDAP users for the Agents; the database identities require separate configuration. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/core/security.md) - LDAP console authentication uses a bind/search account to find the user and groups, then checks the supplied user password. LDAP groups map to Ops Manager organization and project roles. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-ldap-authentication.md) - LDAP group changes can take up to one hour to affect Ops Manager permissions; affected users can refresh permissions immediately by logging out and back in. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-ldap-authentication.md) - SAML console federation redirects unauthenticated users to an external IdP. Ops Manager acts as the service provider and maps IdP groups to organization and project roles; OIDC console federation follows the same group-to-role model. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) - SAML setup requires an IdP user and group for Global Owner, exchange of IdP/SP metadata, and configuration of the IdP certificate and group attribute. Existing authenticated sessions remain logged in after SAML activation. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) - OIDC console configuration requires an issuer or discovery URL, client ID, client secret, and Global Owner groups. PKCE is enabled by default; HTTPS is strongly recommended. SAML-to-OIDC migration preserves existing role mappings. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-oidc-authentication.md) - Ops Manager documents OIDC backchannel logout at POST /oidc/backchannel-logout using a signed logout_token JWT containing sub, with optional sid for targeted session invalidation. The same tutorial says service-provider-initiated OIDC logout is unsupported and users must log out at the IdP. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-oidc-authentication.md) - For Kerberos-authenticated database users, enabling LDAP authorization lets MongoDB resolve directory groups to MongoDB roles without local user documents in $external. Without LDAP authorization, Kerberos users must be added to $external. (low confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-kerberos-authentication-for-group.md) - The mongo-infra-docker test repository offers an Ops Manager environment with Authentik-based LDAP and SAML extras; its README marks OIDC as Maybe and Kerberos as not included. These are limits of that test harness, not Ops Manager product limits. (low confidence) (verified as of 2026-10-23) — [source](https://github.com/karl-denby/mongo-infra-docker) - OpenID Connect standardizes end-user authentication on top of OAuth 2.0 using ID Tokens and claims. Ops Manager separately maps the IdP group claim to its own roles; protocol authentication alone does not define Ops Manager authorization. (medium confidence) — [source](https://openid.net/specs/openid-connect-core-1_0.html) - A Kubernetes LDAP feature request received a MongoDB administrator response dated 2025-10-18 stating that the operator does not manage Ops Manager users except the first local user used for administrative access. Do not assume database authentication manifests configure console users. (low confidence) (verified as of 2025-10-18) — [source](https://feedback.mongodb.com/ideas/CUSTOMER-I-7321) - Ops Manager SAML setup requires signed SAML Responses and Assertions and a Global Owner group mapping. The configured issuer must match the response issuer, and the configured IdP certificate must match the certificate used to sign Responses and Assertions. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-saml-authentication.md) - Ops Manager maps external groups to organization and project roles for LDAP, SAML and OIDC. Successful identity-provider authentication therefore does not by itself establish the intended administrative access; operators must configure the corresponding group-to-role mappings. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/configure-for-ldap-authentication.md) - The documented Kerberos integration configures GSSAPI authentication for MongoDB deployments and their Agents. It requires MongoDB Enterprise, an existing Kerberos deployment, service principals and Agent credentials; it is not presented as Kerberos browser SSO to the Ops Manager console. (high confidence) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-kerberos-authentication-for-group.md) - A managed MongoDB deployment can enable multiple authentication mechanisms, but its Ops Manager Agents select one. For Kerberos on Linux, the documented Agent configuration supplies a Kerberos principal and a keytab path. Without LDAP authorization, Kerberos users must be represented in the deployment's $external database. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/ops-manager/current/tutorial/enable-kerberos-authentication-for-group.md)