Azure Question posted in
The official documentation to get you started can be found here.

Azure – 'Authentication Failed' Error using MongoDB OIDC

I am trying to connect to a MongoDB Atlas cluster via pymongo using the MongoDB-OIDC authentication method, with Azure as the identity provider.

I already setup the Azure provider and connected it to the Atlas org.

I have an Azure VM with a small python app to test this feature. Below is a code snippet from it:


def connect():
    properties = {"ENVIRONMENT": "azure", "TOKEN_RESOURCE": "<AUDIENCE_URI>"}
    client = MongoClient(
        "<CONNECTION_STRING>",
        username="<MANAGED_IDENTITY_CLIENT_ID>",
        authMechanism="MONGODB-OIDC",
        authMechanismProperties=properties
    )
    print("Created client")
    try:
        client.admin.command("ping")
        print("Successfully pinged")
    except Exception as e:
        print(e)

However, I keep getting this Authentication failed error.

I’ve tried using both a system assigned and user assigned managed identity for the VM and also creating the corresponding database user in Atlas using their Client IDs but no luck yet.

Does anyone here have any experience with setting up MongoDB-OIDC with Azure? GCP was successfully setup using the documentation so not sure why Azure has been unsuccessful.

I described what I was expecting above.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    This was resolved by removing the api:// prefix from the audience URI in the configured identity provider and token resource.


  2. 0

    Could u share the tips for GCP OIDC with mongodb? I am getting "MongoServerError: Authentication failed." This is all that is required for the App connection right? What about specifying the user that we create in Mongodb with Federated Auth? Would be great if u could offer some insights or examples. Thank you!

    const uri = "mongodb+srv://clustername.xxx.mongodb.net/?authMechanism=MONGODB-OIDC"
            + "&authMechanismProperties=ENVIRONMENT:gcp,TOKEN_RESOURCE:<aud>";
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search