Atlas LDAPS (Deprecated 8.0)
Parent: MongoDB Atlas IAM and RBAC · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-59597c811d2a
↓ Facts as markdownall context files
Source-anchored research for Atlas LDAPS (Deprecated 8.0). Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- When authentication succeeds but authorization fails, the provider guides recommend testing the group query with ldapsearch. Enabling LDAP authorization removes access for users configured only for LDAP authentication until their group access is configured. (high confidence) [source]
- One LDAPS configuration applies to every cluster in an Atlas project. The setup guide recommends separate projects when LDAP role mappings must target different deployment environments. (low confidence) [source]
- The Atlas LDAP guide says LDAP authorization prevents OIDC connections and Atlas-managed X.509 user connections. It permits self-managed X.509 users only when the certificate Common Name matches an LDAP-authorized user distinguished name. Validate these restrictions for the target Atlas deployment during migration. (low confidence) (verified as of 2026-10-14) [source]
Problems, failure modes and limitations
- LDAP authentication and authorization were deprecated starting in MongoDB 8.0. Atlas documentation says they continue operating unchanged throughout MongoDB 8; deprecation does not mean removal in 8.0. (high confidence) (verified as of 2026-10-14) [source]
- Atlas cannot use OIDC authentication while LDAP authorization is enabled; disable LDAP authorization before attempting OIDC connections. (low confidence) (verified as of 2026-10-14) [source]
- URI-reserved password characters need escaping. A 2019 Atlas LDAP Compass issue reported an unescaped at-sign error and a workaround of replacing @ with %40; the issue was closed as a duplicate, so it does not establish a current Compass defect. (high confidence) [source]
- MongoDB deprecated LDAP authentication and authorization starting in 8.0. Atlas documentation says the feature continues to operate unchanged throughout MongoDB 8; the manual says deprecation continues in 9.0 and removal occurs in a future release. These pages do not establish a removal release. (high confidence) (verified as of 2026-10-14) [source]
- For Atlas migration, MongoDB recommends Workforce Identity Federation for human users, and AWS-IAM or Workload Identity Federation for programmatic users. It recommends X.509 when those programmatic options cannot be used. (low confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- Atlas LDAPS authenticates database users, rather than Atlas administrative users. One project-wide configuration uses an LDAP server over TLS. (high confidence) [source]
- LDAP clients must select authSource=$external and authenticationMechanism=PLAIN; User to DN Mapping can let clients supply an email or username instead of the full distinguished name. (high confidence) [source]
- Okta LDAP Interface is a cloud proxy translating LDAP commands into Okta API calls against Universal Directory. Atlas integrates with this interface; it differs from the Okta LDAP Agent that synchronizes an existing directory. (high confidence) [source]
Facts and statements
- The LDAP alternatives page says deprecation continues in MongoDB 9.0 and removal is planned for a future release; it names no removal version or date. (low confidence) (verified as of 2026-10-14) [source]
- Authentication-only mode assigns database roles to individual LDAP users in Atlas. With LDAP authorization enabled, users inherit privileges through LDAP groups mapped to MongoDB roles; users without a qualifying group receive no database roles. (high confidence) [source]
- The provider guides require M10 or larger clusters and describe LDAP as an Atlas Enterprise feature; Free and Flex clusters do not support it. (high confidence) (verified as of 2026-10-14) [source]
- MongoDB recommends Workforce Identity Federation for human Atlas users. For applications it recommends AWS IAM on AWS or Workload Identity Federation on Azure/GCP, with X.509 as a fallback. (low confidence) (verified as of 2026-10-14) [source]
- In its August 7, 2025 response to Atlas LDAP deprecation, Percona committed to retaining LDAP in Percona Server for MongoDB 9 and beyond. This is a separate deployment option, not continued LDAP support inside Atlas. (low confidence) (verified as of 2025-08-07) [source]
- Atlas LDAPS authenticates database users against an external LDAP server over TLS. It is distinct from authentication to the Atlas administrative interface. (high confidence) [source]
- The Atlas Okta LDAP guide requires M10 or larger clusters; the general LDAP guide excludes Free and Flex deployments. Managing LDAP users or groups requires Organization Owner or Project Owner access. (high confidence) (verified as of 2026-10-14) [source]
- LDAP database clients must use authSource=$external and authenticationMechanism=PLAIN. Atlas normally uses the LDAP user full distinguished name; the Okta guide offers a User to DN Mapping to accept an email address instead. (high confidence) [source]
- Atlas requires network access to a TLS-enabled LDAP server. For a public LDAP endpoint, its guide requires allowing both cluster-node public IP addresses and Atlas Gateway IP addresses; changes to cluster public IP addresses can interrupt access until the LDAP allowlist is updated. (low confidence) [source]
- For the Atlas Okta integration, use a dedicated bind user with Read Only Administrator privileges for LDAP searches. Okta documents LDAPS on port 636, and both guides identify groupofUniqueNames/uniqueMember group queries; both warn that memberOf lookups can be slower. (high confidence) [source]
Children
- No children recorded.