Authentication mechanisms in MongoDB - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of authentication in MongoDB?

Authentication in MongoDB verifies the identity of users trying to access the database to ensure only authorized users can connect and perform actions.

beginner

Name two common authentication mechanisms supported by MongoDB.

MongoDB supports SCRAM (Salted Challenge Response Authentication Mechanism) and x.509 certificate authentication as common methods.

intermediate

How does SCRAM authentication work in MongoDB?

SCRAM uses a username and password. The password is salted and hashed. The server and client exchange challenges to verify the password without sending it directly.

intermediate

What is x.509 certificate authentication in MongoDB?

x.509 authentication uses SSL/TLS certificates to verify client identity. The client presents a certificate signed by a trusted authority to connect securely.

beginner

Why is enabling authentication important in MongoDB?

Without authentication, anyone can access the database, risking data theft or damage. Authentication protects data by allowing only verified users to connect.

Which authentication mechanism uses username and password with salted hashing in MongoDB?

A SCRAM

B x.509 certificate

C LDAP

D Kerberos

SCRAM uses username and password with salted hashing to authenticate users.

What does x.509 authentication in MongoDB rely on?

A SSL/TLS certificates

B Username only

C Password hashing

D IP address

x.509 authentication uses SSL/TLS certificates to verify client identity.

Why should authentication be enabled in MongoDB?

A To speed up queries

B To disable network access

C To allow anonymous access

D To protect data by verifying users

Authentication protects data by allowing only verified users to access the database.

Which of these is NOT a MongoDB authentication mechanism?

A SCRAM

B OAuth

C LDAP

D x.509 certificate

OAuth is not a native MongoDB authentication mechanism.

In SCRAM, what is the purpose of salting the password?

A To make password storage faster

B To prevent password reuse

C To protect against rainbow table attacks

D To encrypt the password

Salting adds random data to passwords to protect against rainbow table attacks.

Explain how SCRAM authentication works in MongoDB and why it is secure.

Think about how the password is protected during login.

Describe the role of x.509 certificates in MongoDB authentication.

Consider how certificates prove who you are.

Practice

1. What is the main purpose of authentication in MongoDB?

easy

A. To create indexes on collections

B. To backup the database automatically

C. To optimize query performance

D. To verify the identity of a user before granting access

Solution

1. Step 1: Understand authentication concept

   Authentication means checking who you are before allowing access.

2. Step 2: Identify the purpose in MongoDB

   MongoDB uses authentication to verify user identity to protect data.

3. Final Answer:

   To verify the identity of a user before granting access -> Option D

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means checking who you are [OK]

Common Mistakes:

• Confusing authentication with backup
• Thinking authentication improves query speed
• Mixing authentication with indexing

2. Which of the following is the correct syntax to authenticate a user in MongoDB shell?

easy

A. db.auth('username', 'password')

B. db.authenticate('username', 'password')

C. db.login('username', 'password')

D. db.userAuth('username', 'password')

Solution

1. Step 1: Recall MongoDB authentication method

   The correct method to authenticate is db.auth().

2. Step 2: Match syntax with options

   Only db.auth('username', 'password') matches the correct syntax.

3. Final Answer:

   db.auth('username', 'password') -> Option A

4. Quick Check:

   Authenticate = db.auth() [OK]

Hint: Use db.auth() to log in with username and password [OK]

Common Mistakes:

• Using db.authenticate() which does not exist
• Using db.login() which is invalid
• Confusing method names with userAuth()

3. Consider this MongoDB shell command sequence:

use admin
var result = db.auth('alice', 'mypassword')

What will be the value of result if authentication succeeds?

medium

A. 1

B. false

C. true

D. null

Solution

1. Step 1: Understand db.auth() return value

   When authentication succeeds, db.auth() returns 1.

2. Step 2: Match return value with options

   Only 1 matches the expected numeric return value.

3. Final Answer:

   1 -> Option A

4. Quick Check:

   Success returns 1 [OK]

Hint: db.auth() returns 1 if login works [OK]

Common Mistakes:

• Expecting boolean true instead of numeric 1
• Thinking it returns false on success
• Assuming it returns null or undefined

4. You run db.auth('bob', 'wrongpass') but it always returns 1. What is the most likely cause?

medium

A. The user 'bob' does not exist

B. The password is case-insensitive

C. You are already authenticated as 'bob' or another user

D. MongoDB does not check passwords

Solution

1. Step 1: Understand db.auth() behavior when already logged in

   If already authenticated, db.auth() returns 1 without rechecking password.

2. Step 2: Analyze why wrong password still returns 1

   This happens because the session is already authenticated as 'bob' or another user.

3. Final Answer:

   You are already authenticated as 'bob' or another user -> Option C

4. Quick Check:

   Already logged in means db.auth() returns 1 [OK]

Hint: db.auth() returns 1 if already logged in [OK]

Common Mistakes:

• Assuming wrong password always returns false
• Thinking MongoDB ignores passwords
• Believing user must exist for true return

5. You want to create a user with read-only access to the sales database. Which command correctly creates this user with proper authentication roles?

hard

A. db.addUser('readonly', 'pass123', 'read')

B. db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]})

C. db.createUser({username: 'readonly', password: 'pass123', roles: ['read']})

D. db.createUser({user: 'readonly', pwd: 'pass123', roles: ['readWrite']})

Solution

1. Step 1: Identify correct syntax for creating user with roles

   The correct syntax uses db.createUser() with user, pwd, and roles as an array of objects specifying role and database.

2. Step 2: Match read-only role on 'sales' database

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) correctly assigns role 'read' on database 'sales'.

3. Final Answer:

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) -> Option B

4. Quick Check:

   Create user with roles array = db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) [OK]

Hint: Use db.createUser() with roles array for access control [OK]

Common Mistakes:

• Using deprecated db.addUser() method
• Incorrect field names like username instead of user
• Assigning wrong roles like readWrite for read-only access