Show
1. For each node in the replica set, I set up sslClusterFile and sslPEMKeyFile to be "server.pem":
mongod --replSet testReplSet --sslOnNormalPorts --sslClusterFile jstests/libs/server.pem --clusterAuthMode x509 --sslPEMKeyFile jstests/libs/server.pem --sslCRLFile jstests/libs/crl_client_revoked.pem --sslCAFile jstests/libs/ca.pem --auth
2. I connect with mongo using the same certificate:
mongo --ssl --sslPEMKeyFile jstests/libs/server.pem
3. Create the user & authenticate:
> db.getSiblingDB("$external").addUser(
... { user:"CN=client,OU=kerneluser,O=10Gen,L=New York City,ST=New York,C=US",
... roles: [
... {name: 'clusterAdmin', source: 'admin', hasRole: true, 'canDelegate': true},
... {name: 'userAdminAnyDatabase', source: 'admin', hasRole: true, 'canDelegate': true},
... {name: 'readWriteAnyDatabase', source: 'admin', hasRole: true, 'canDelegate': true},
... {name: 'dbAdminAnyDatabase', source: 'admin', hasRole: true, 'canDelegate': true}]
... });
> db.getSiblingDB("$external").auth({ user:"emailAddress=root@lazarus,CN=server,OU=Kernel,O=10Gen,L=New York City,ST=New York,C=US",
... mechanism:"MONGODB-X509"});
1
4. Check in the system.users collection:
> db.getSiblingDB("admin").system.users.findOne()
{
"_id" : "$external.emailAddress=root@lazarus,CN=server,OU=Kernel,O=10Gen,L=New York City,ST=New York,C=US",
"name" : "emailAddress=root@lazarus,CN=server,OU=Kernel,O=10Gen,L=New York City,ST=New York,C=US",
"source" : "$external",
"roles" : [
{
"name" : "clusterAdmin",
"source" : "admin",
"hasRole" : true,
"canDelegate" : true
},
{
"name" : "userAdminAnyDatabase",
"source" : "admin",
"hasRole" : true,
"canDelegate" : true
},
{
"name" : "readWriteAnyDatabase",
"source" : "admin",
"hasRole" : true,
"canDelegate" : true
},
{
"name" : "dbAdminAnyDatabase",
"source" : "admin",
"hasRole" : true,
"canDelegate" : true
}
]
}
SERVER-45938 Allow matching O/OU/DC in client x509 cert if clusterMode:keyFile
