PSMDB-1438-OIDC-8.0 #997

nastena1606 · 2025-03-03T15:44:29Z

new file: docs/_images/OIDC-flow.png
modified: docs/authentication.md
new file: docs/oidc.md
modified: docs/psmdb-pro.md
modified: mkdocs-base.yml

new file: docs/_images/OIDC-flow.png modified: docs/authentication.md new file: docs/oidc.md modified: docs/psmdb-pro.md modified: mkdocs-base.yml

radoslawszulgo · 2025-03-05T11:10:31Z

docs/authentication.md

@@ -113,6 +111,19 @@ Kerberos authentication in Percona Server for MongoDB is implemented the same wa

    MongoDB Documentation: [Kerberos Authentication](https://docs.mongodb.com/manual/core/kerberos/)

+## OIDC / OAuth 2.0 authentication and authorization
+
+Percona Server for MongoDB supports OpenID Connect (OIDC) as an authentication mechanism which extends the OAuth 2.0 authorization framework. You can configure SSO for Percona Server for MongoDB using an external IP provider so that users and applications are authenticated and authorized without sharing their credentials. As a result you streamline authentication and authorization flow and increase security within your system.  


Suggested change

Percona Server for MongoDB supports OpenID Connect (OIDC) as an authentication mechanism which extends the OAuth 2.0 authorization framework. You can configure SSO for Percona Server for MongoDB using an external IP provider so that users and applications are authenticated and authorized without sharing their credentials. As a result you streamline authentication and authorization flow and increase security within your system.

Percona Server for MongoDB supports OpenID Connect (OIDC) as an authentication mechanism that extends the OAuth 2.0 authorization framework. You can configure SSO for Percona Server for MongoDB using an external Identity Provider (IdP) so that users and applications are authenticated and authorized without sharing their credentials with MongoDB clients. As a result, you streamline authentication and authorization flow and increase security within your system.

docs/authentication.md

radoslawszulgo · 2025-03-05T11:21:47Z

docs/oidc.md

+
+OpenID Connect (OIDC) is an identity authentication protocol built on top of the OAuth 2.0 framework. OIDC is designed to verify user identities and provide authentication, ensuring that users are who they claim to be. OAuth 2.0 is used for user authorization to access resources. 
+
+With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP). 


Suggested change

With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP).

With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize your infrastructure without sharing their credentials in the MongoDB client. Single Sign-On (SSO) requires an external Identity Provider (IdP) for Percona Server for MongoDB.

But it's not just about sharing creds in MongoDB client, They are also not saved in PSMDB, correct @ktrushin ?

radoslawszulgo · 2025-03-05T11:22:57Z

docs/oidc.md

+
+* **Authorization code**: a `mongo` client (for example, `mongosh` or Compass) opens a browser and redirects a user to the login portal of an external identity provider to pass authentication. This is the default authentication workflow.
+
+* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the  authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords. 


Suggested change

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a MongoDB client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when a MongoDB client and Percona Server for MongoDB run in a cloud environment, and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.

Suggested change

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a MongoDB client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a MongoDB client runs in an environment without a browser being available (e.g. Docker container or cloud infrastructure).

docs/authentication.md

docs/oidc.md

ktrushin · 2025-04-03T15:23:28Z

docs/oidc.md

+
+* **Authorization code**: a `mongo` client (for example, `mongosh` or Compass) opens a browser and redirects a user to the login portal of an external identity provider to pass authentication. This is the default authentication workflow.
+
+* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the  authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords. 


Suggested change

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a MongoDB client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a MongoDB client runs in an environment without a browser being available (e.g. Docker container or cloud infrastructure).

ktrushin · 2025-04-03T15:30:44Z

docs/oidc.md

+
+With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP). 
+
+The IdP is a centralized place to authenticate and authorize humans and applications to access multiple resources in your infrastructure. User credentials, access policies and roles are stored centralized on the IdP side. You can configure different access policies and tailor permissions for a group of users of a specific user. 


roles are stored centralized on the IdP side.

That is not completely true. For OIDC to work, one has to set up either roles or users on MongoDB side as the manual suggests.
Statement that credentials are not stored on MongoDB is still true.

ktrushin · 2025-04-03T15:32:58Z

docs/oidc.md

+The use of OIDC and OAuth 2.0 provides the following benefits:
+
+* streamlines authentication and authorization flow, 
+* simplifies user management and configuration: everything is done in a single place


I'd exclude this point, please see the comment about roles above.

ktrushin · 2025-04-03T15:44:54Z

docs/oidc.md

+1. A user connects to Percona Server for MongoDB using a `mongo` client. The client must support OIDC.
+2. The `mongo` client requests authentication from the IdP.
+3. The IdP generates the authorization code. A user is redirected to the login portal of an external identity provider (IdP).
+4.	The user is requested to authenticate. For example, using two-factor authentication or by entering an authentication code.
+5. A user is redirected back to the `mongo` client with single-use authorization code. 
+6.	The IdP verifies the authorization code, user's client ID and credentials.
+5.	Upon success, the IdP returns the access and ID tokens to the `mongo` client.
+6.	The `mongo` client uses the access token to access Percona Server for MongoDB.


I suggest doing the following changes:

replace "mongo client" with "MongoDB client" because mongo is a name of a particular utility

In the point 2, replace the IdP with an external identity provider (IdP). In point 3, do the opposite replacement: reduce an external identity provider (IdP) to just the IdP. That way, we introduce the acronym IdP at the time it is first used (i.e. in point 2)

Fix the point numbering. Now we have: 4, 5, 6, 5, 6. It probably should be 4, 5, 6, 7, 8.

Replace a tab character between the point number and its text; applies to all points starting from 4.

Co-authored-by: Konstantin Trushin <[email protected]>

PSMDB-1438-OIDC-8.0

1d9135f

new file: docs/_images/OIDC-flow.png modified: docs/authentication.md new file: docs/oidc.md modified: docs/psmdb-pro.md modified: mkdocs-base.yml

nastena1606 deployed to PSMDB-1438-OIDC-support-8.0 - psmdb-docs-8.0 PR #997 March 3, 2025 15:44 — with Render View deployment

radoslawszulgo reviewed Mar 5, 2025

View reviewed changes

docs/authentication.md Outdated Show resolved Hide resolved

radoslawszulgo reviewed Mar 5, 2025

View reviewed changes

ktrushin requested changes Apr 3, 2025

View reviewed changes

Update docs/oidc.md

21d3f57

Co-authored-by: Konstantin Trushin <[email protected]>

nastena1606 deployed to PSMDB-1438-OIDC-support-8.0 - psmdb-docs-8.0 PR #997 April 7, 2025 18:06 — with Render View deployment

Updated after the review

5af3f3e

nastena1606 deployed to PSMDB-1438-OIDC-support-8.0 - psmdb-docs-8.0 PR #997 April 7, 2025 19:37 — with Render View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PSMDB-1438-OIDC-8.0 #997

PSMDB-1438-OIDC-8.0 #997

nastena1606 commented Mar 3, 2025

radoslawszulgo Mar 5, 2025

radoslawszulgo Mar 5, 2025

nastena1606 Apr 7, 2025

radoslawszulgo Mar 5, 2025

ktrushin Apr 3, 2025

ktrushin Apr 3, 2025

ktrushin Apr 3, 2025

ktrushin Apr 3, 2025

nastena1606 Apr 7, 2025

ktrushin Apr 3, 2025

nastena1606 Apr 7, 2025


		OpenID Connect (OIDC) is an identity authentication protocol built on top of the OAuth 2.0 framework. OIDC is designed to verify user identities and provide authentication, ensuring that users are who they claim to be. OAuth 2.0 is used for user authorization to access resources.

		With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP).


		* Authorization code: a `mongo` client (for example, `mongosh` or Compass) opens a browser and redirects a user to the login portal of an external identity provider to pass authentication. This is the default authentication workflow.

		* Device authentication: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.


		With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP).

		The IdP is a centralized place to authenticate and authorize humans and applications to access multiple resources in your infrastructure. User credentials, access policies and roles are stored centralized on the IdP side. You can configure different access policies and tailor permissions for a group of users of a specific user.

PSMDB-1438-OIDC-8.0 #997

Are you sure you want to change the base?

PSMDB-1438-OIDC-8.0 #997

Conversation

nastena1606 commented Mar 3, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment