Authorize Users with Workload Identity Federation

Create MongoDB roles

In the admin database, use the db.createRole() method to create roles that map the identity provider group roles to MongoDB roles.

Use the following format to create roles:

<authNamePrefix>/<authorizationClaim>

The oidcIdentityProviders parameter provides the authNamePrefix field and the authorizationClaim field. For example:

db.createRole( {
   role: "okta/Everyone",
   privileges: [ ],
   roles: [ "readWriteAnyDatabase" ]
} )

Switch to the $external database

When you create a user, you must create it in the $external database. To switch to the $external database, run the following command:

use $external

Create a user

To create users and add them to your MongoDB database, use the db.createUser() command.

Use the following format for the user field, where the authNamePrefix and authorizationClaim values come from the oidcIdentityProviders parameter:

<authNamePrefix>/<authorizationClaim>

To create a user in MongoDB with the authNamePrefix of okta and an authorizationClaim of jane.doe, run the following:

db.createUser( {
   user: "okta/jane.doe",
   roles: [
      {
         role: "readWriteAnyDatabase",
         db: "admin"
      }
   ]
} )