Steps 1. User "uid=alice,ou=Users,dc=mongodb,dc=com" created in ldap. ldapadd -x -D "cn=Manager,dc=mongodb,dc=com" -w password -H ldapi: /// <<EOF dn: uid=alice,ou=Users,dc=mongodb,dc=com changetype: add objectclass: person objectclass: inetOrgPerson cn: alice sn: Alice uid: alice userPassword: secret EOF 2. Following is the ldap configuration in mongod.conf security: authorization: "enabled" ldap: transportSecurity: none servers: "127.0.0.1" bind: queryUser: "cn=Manager,dc=mongodb,dc=com" queryPassword: "password" setParameter: authenticationMechanisms: PLAIN 3. Using mongo shell, connect using a local userAdmin then create user in $external using internal authz by first using a local admin: db.getSiblingDB( "$external" ).createUser( { user: "uid=alice,ou=Users,dc=mongodb,dc=com" , roles: [ { role: "readWriteAnyDatabase" , db: "admin" }] } ) 4. Now using mongo shell connect to this mongod instance using ldap user: mongodb-linux-x86_64-enterprise-rhel62-3.4.13/bin/mongo --authenticationDatabase '$external' -u "uid=alice,ou=Users,dc=mongodb,dc=com" -p --authenticationMechanism PLAIN 5. Perform some CRUD operations using this user to confirm access. 6. From another ssh session, delete the user from ldap server: ldapmodify -x -D "cn=Manager,dc=mongodb,dc=com" -w password -H ldapi: /// <<EOF dn: uid=alice,ou=Users,dc=mongodb,dc=com changetype: delete EOF 6.. Authentication fails for any new sessions using this deleted ldap user: Failed to bind to LDAP server at default : Invalid credentials. Bind parameters were: {BindDN: uid=alice,ou=Users,dc=mongodb,dc=com, authenticationType: simple} 2018-04-03T10:56:49.321+0000 I ACCESS [conn29] PLAIN authentication failed for uid=alice,ou=Users,dc=mongodb,dc=com on $external from client 192.168.19.100:34012 ; OperationFailed: LDAP bind failed with error: Invalid credentials 7. Go back to the mongo shell with authenticated session (created in step4.) and the ldap user can still perform CRUD operations for almost infinite time.