X.509 internal authorization alongside LDAP authorization
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for X.509 internal authorization alongside LDAP authorization. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- The setting applies to mongod and mongos and affects only X.509. LDAP- and Kerberos-authenticated clients continue using LDAP authorization when LDAP authorization is enabled. (high confidence) [source]
- The MongoDB master authentication README says useInternalAuthzForX509 is configurable at startup and runtime. It is accepted in Community but has no effect there, because Community lacks LDAP authorization; the mixed LDAP/internal deployment requires Enterprise LDAP support. (high confidence) (verified as of 2026-10-27) [source]
Problems, failure modes and limitations
- The usersInfo reference says that omitting authenticatedMechanism looks up $external users through LDAP and SCRAM users through local authorization. The field cannot be supplied when viewing all users. Mechanism-aware inspection matters when X.509 users are internally authorized alongside LDAP users. (low confidence) [source]
- MongoDB documents LDAP authentication and authorization as deprecated starting with 8.0 and continuing in 9.0, with removal in a future release. The 9.0 X.509 routing addition does not rescind that deprecation. (high confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- MongoDB 9.0 introduces useInternalAuthzForX509. Setting it to true lets MONGODB-X509 clients use internal authorization while LDAP authorization remains configured for other clients. This concerns client authorization, rather than enabling X.509 authentication between cluster members. (high confidence) [source]
- X.509 authentication combined with LDAP authorization predates the internal-backend override: Percona Server for MongoDB 7.0 documents certificate authentication with LDAP-managed users and group-named MongoDB roles, without creating user documents in $external. This corroborates the distinction between authenticating with a certificate and obtaining authorization from LDAP, rather than independently verifying MongoDB 9.0 behavior. (high confidence) [source]
Facts and statements
- useInternalAuthzForX509 defaults to false. With LDAP authorization configured, false routes X.509 clients to LDAP; true uses internal authorization and local roles for the user in $external. Without LDAP, X.509 uses internal authorization regardless of this parameter. (high confidence) [source]
- MongoDB 9.0 adds the optional usersInfo.authenticatedMechanism string to select the authorization backend used for a user-information lookup. It describes lookup routing, not a switch that changes how an existing client authenticated. (high confidence) [source]
- Atlas documents a separate boundary: LDAP authorization prevents connections using Atlas-managed X.509 certificates. Self-managed X.509 certificates can coexist with LDAP authorization subject to the documented certificate Common Name matching the LDAP user Distinguished Name. Do not assume the self-managed server parameter changes Atlas policy. (high confidence) (verified as of 2026-10-14) [source]
- RFC 4513 separates authentication identity from authorization identity and leaves LDAP authorization policy and identity mapping to the implementation. This standards context explains why certificate identity alone does not establish which MongoDB authorization backend supplies privileges; it does not specify MongoDB backend selection. (low confidence) [source]
Children
- No children recorded.