Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-96249

Accept multiple passwords in security.ldap.bind.queryPassword config file option

    • Type: Icon: Task Task
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Server Security
    • Security 2024-11-11, Security 2025-01-20, Security 2025-02-17

      Currently, the ldapQueryPassword setParameter is runtime-settable only and accepts either one or multiple LDAP passwords to use when binding as the query user. Multiple bind passwords are provided when credentials are being rotated on the LDAP server so that MongoDB does not temporarily lose authorization to query the LDAP server. 

      The security.ldap.bind.queryPassword config file option controls the exact same setting but is only settable at startup and persists across server restarts. However, it only accepts a single password, meaning it is impossible to supply multiple LDAP query bind passwords that will persist across restart. Updating this to match ldapQueryPassword will allow users to continue with LDAP credential rotation without worrying about MongoDB disconnecting from LDAP after a restart.

            Assignee:
            shreyas.kalyan@mongodb.com Shreyas Kalyan
            Reporter:
            varun.ravichandran@mongodb.com Varun Ravichandran
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: