Authentication mechanisms in MongoDB - Step-by-Step Execution

Concept Flow - Authentication mechanisms

Client sends credentials

↓

MongoDB receives request

↓

Check authentication method

↓

Verify credentials

↓

Grant access

↓

Respond to client

The client sends credentials, MongoDB checks the authentication method, verifies credentials, and either grants or denies access.

Execution Sample

MongoDB

db.runCommand({authenticate: 1, user: 'alice', pwd: 'pass123', mechanism: 'SCRAM-SHA-256'})

This command authenticates user 'alice' with password 'pass123' using SCRAM-SHA-256 mechanism.

Execution Table

Step	Action	Input	Check	Result	Next Step
1	Receive auth request	{user: 'alice', pwd: 'pass123', mechanism: 'SCRAM-SHA-256'}	N/A	Request accepted	Check mechanism
2	Check mechanism	SCRAM-SHA-256	Is mechanism supported?	Yes	Verify credentials
3	Verify credentials	user: alice, pwd: pass123	Does password match stored hash?	Yes	Grant access
4	Grant access	N/A	N/A	Access granted	Respond to client
5	Respond to client	N/A	N/A	Success message sent	End
6	If failure at any step	N/A	N/A	Access denied	Respond with error

💡 Authentication ends after success or failure response sent to client.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
credentials	{}	{user: 'alice', pwd: 'pass123', mechanism: 'SCRAM-SHA-256'}	{user: 'alice', pwd: 'pass123', mechanism: 'SCRAM-SHA-256'}	{user: 'alice', pwd: 'pass123', mechanism: 'SCRAM-SHA-256'}	Used for verification
mechanism_supported	false	false	true	true	true
credentials_valid	false	false	false	true	true
access_granted	false	false	false	true	true

Key Moments - 3 Insights

Why does MongoDB check the authentication mechanism before verifying credentials?

Because the mechanism determines how credentials are verified. If the mechanism is unsupported, MongoDB denies access immediately (see execution_table step 2).

What happens if the password does not match the stored hash?

MongoDB denies access and sends an error response to the client, stopping the authentication process (see execution_table step 6).

Can authentication succeed if the mechanism is correct but the password is wrong?

No, both mechanism support and correct credentials are required for access (see execution_table steps 2 and 3).

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after step 2?

A Mechanism unsupported

B Credentials verified

C Mechanism supported

D Access granted

💡 Hint

Check the 'Result' column in execution_table row for step 2.

At which step does MongoDB decide to grant access?

A Step 3

B Step 4

C Step 1

D Step 5

💡 Hint

Look for the step labeled 'Grant access' in execution_table.

If the password is incorrect, which step in the execution_table shows the outcome?

A Step 6

B Step 2

C Step 3

D Step 5

💡 Hint

Check the step that handles failure in execution_table.

Concept Snapshot

Authentication in MongoDB:
- Client sends credentials with chosen mechanism.
- MongoDB checks if mechanism is supported.
- Credentials are verified against stored data.
- Access granted if valid, denied if not.
- Common mechanisms: SCRAM-SHA-1, SCRAM-SHA-256.
- Always secure credentials during transmission.

Full Transcript

Authentication mechanisms in MongoDB start when the client sends credentials including username, password, and the authentication mechanism. MongoDB first checks if the mechanism is supported. If supported, it verifies the credentials by comparing the password with the stored hash. If the credentials match, MongoDB grants access and responds with success. If any check fails, access is denied and an error is sent. This process ensures only authorized users can access the database.

Practice

1. What is the main purpose of authentication in MongoDB?

easy

A. To create indexes on collections

B. To backup the database automatically

C. To optimize query performance

D. To verify the identity of a user before granting access

Solution

1. Step 1: Understand authentication concept

   Authentication means checking who you are before allowing access.

2. Step 2: Identify the purpose in MongoDB

   MongoDB uses authentication to verify user identity to protect data.

3. Final Answer:

   To verify the identity of a user before granting access -> Option D

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means checking who you are [OK]

Common Mistakes:

• Confusing authentication with backup
• Thinking authentication improves query speed
• Mixing authentication with indexing

2. Which of the following is the correct syntax to authenticate a user in MongoDB shell?

easy

A. db.auth('username', 'password')

B. db.authenticate('username', 'password')

C. db.login('username', 'password')

D. db.userAuth('username', 'password')

Solution

1. Step 1: Recall MongoDB authentication method

   The correct method to authenticate is db.auth().

2. Step 2: Match syntax with options

   Only db.auth('username', 'password') matches the correct syntax.

3. Final Answer:

   db.auth('username', 'password') -> Option A

4. Quick Check:

   Authenticate = db.auth() [OK]

Hint: Use db.auth() to log in with username and password [OK]

Common Mistakes:

• Using db.authenticate() which does not exist
• Using db.login() which is invalid
• Confusing method names with userAuth()

3. Consider this MongoDB shell command sequence:

use admin
var result = db.auth('alice', 'mypassword')

What will be the value of result if authentication succeeds?

medium

A. 1

B. false

C. true

D. null

Solution

1. Step 1: Understand db.auth() return value

   When authentication succeeds, db.auth() returns 1.

2. Step 2: Match return value with options

   Only 1 matches the expected numeric return value.

3. Final Answer:

   1 -> Option A

4. Quick Check:

   Success returns 1 [OK]

Hint: db.auth() returns 1 if login works [OK]

Common Mistakes:

• Expecting boolean true instead of numeric 1
• Thinking it returns false on success
• Assuming it returns null or undefined

4. You run db.auth('bob', 'wrongpass') but it always returns 1. What is the most likely cause?

medium

A. The user 'bob' does not exist

B. The password is case-insensitive

C. You are already authenticated as 'bob' or another user

D. MongoDB does not check passwords

Solution

1. Step 1: Understand db.auth() behavior when already logged in

   If already authenticated, db.auth() returns 1 without rechecking password.

2. Step 2: Analyze why wrong password still returns 1

   This happens because the session is already authenticated as 'bob' or another user.

3. Final Answer:

   You are already authenticated as 'bob' or another user -> Option C

4. Quick Check:

   Already logged in means db.auth() returns 1 [OK]

Hint: db.auth() returns 1 if already logged in [OK]

Common Mistakes:

• Assuming wrong password always returns false
• Thinking MongoDB ignores passwords
• Believing user must exist for true return

5. You want to create a user with read-only access to the sales database. Which command correctly creates this user with proper authentication roles?

hard

A. db.addUser('readonly', 'pass123', 'read')

B. db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]})

C. db.createUser({username: 'readonly', password: 'pass123', roles: ['read']})

D. db.createUser({user: 'readonly', pwd: 'pass123', roles: ['readWrite']})

Solution

1. Step 1: Identify correct syntax for creating user with roles

   The correct syntax uses db.createUser() with user, pwd, and roles as an array of objects specifying role and database.

2. Step 2: Match read-only role on 'sales' database

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) correctly assigns role 'read' on database 'sales'.

3. Final Answer:

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) -> Option B

4. Quick Check:

   Create user with roles array = db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) [OK]

Hint: Use db.createUser() with roles array for access control [OK]

Common Mistakes:

• Using deprecated db.addUser() method
• Incorrect field names like username instead of user
• Assigning wrong roles like readWrite for read-only access