-
Type: Task
-
Resolution: Unresolved
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Security 2024-11-11, Security 2025-01-20, Security 2025-02-17
Currently, the ldapQueryPassword setParameter is runtime-settable only and accepts either one or multiple LDAP passwords to use when binding as the query user. Multiple bind passwords are provided when credentials are being rotated on the LDAP server so that MongoDB does not temporarily lose authorization to query the LDAP server.
The security.ldap.bind.queryPassword config file option controls the exact same setting but is only settable at startup and persists across server restarts. However, it only accepts a single password, meaning it is impossible to supply multiple LDAP query bind passwords that will persist across restart. Updating this to match ldapQueryPassword will allow users to continue with LDAP credential rotation without worrying about MongoDB disconnecting from LDAP after a restart.