Domain verification
Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15
↓ Facts as markdownall context files
Depth-first rabbithole dossier for Domain verification; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- [medium] When a single domain is mapped to multiple Identity Providers (IdPs), users logging in via the MongoDB Cloud console are automatically redirected to the IdP associated with the first SAML IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md [source]
- [low] To use an alternative Identity Provider (IdP) when a domain is mapped to multiple IdPs, users must log in through an SP-initiated or IdP-initiated login URL. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]
Problems, failure modes and limitations
- [high] To map a domain to an Identity Provider (IdP) in Atlas Federated Authentication, you must verify domain ownership using either an HTML file upload or a DNS TXT record, and the chosen verification method cannot be modified without deleting and recreating the domain mapping. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md, https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-MongoDB-Cloud.html [source]
- [low] The Domains screen displays both unverified and verified domains mapped to an IdP, and Atlas indicates verification success or failure via a banner at the top of the screen. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]
- [low] You cannot delete a domain mapping if it is associated with an Identity Provider (IdP). Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]
Facts and statements
- [medium] To avoid potential security vulnerabilities, you must delete the provided verification record file after domain verification completes. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md [source]
- [low] DNS TXT records used for domain verification are public and can be exploited by security researchers to map companies using Atlas by searching for "mongodb-site-verification". Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8703 [source]
- [medium] For HTML file verification, you must download the `mongodb-site-verification.html` file from Atlas, upload it to your domain, and ensure it is accessible at `<https://host.domain>/mongodb-site-verification.html`. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md [source]
- [low] Once an IdP is linked to Atlas, it appears as Inactive in the Federation Management Console until at least one domain is mapped to it. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
- [low] Atlas routes users with email addresses using mapped domains to the associated Identity Provider (IdP). Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md [source]
- [low] If a domain is mapped correctly, users are redirected to the Identity Provider (IdP) for authentication and then back to Atlas upon successful authentication. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]
- [low] To test domain mapping, enter a username (usually an email address) with the verified domain, such as `[email protected]` for the domain `mongodb.com`. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]
Related concepts
- Domain — is a part of Domain verification
- verification — is a part of Domain verification
Children
- No children recorded.