STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must map the PKI-authenticated identity to an associated user account.

DISA Rule

SV-279352r1179459_rule

Vulnerability Number

V-279352

Group Title

SRG-APP-000177-DB-000069

Rule Version

MD8X-00-004000

Severity

CAT II

CCI(s)

CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

Fix Recommendation

Add x.509 certificate subject as an authorized user.

To authenticate with a client certificate, first add the value of the subject from the client certificate as a MongoDB user.

Each unique x.509 client certificate corresponds to a single MongoDB user; meaning a single client certificate cannot authenticate more than one MongoDB user.

Note: The RDNs in the subject string must be compatible with the RFC2253 standard.

Retrieve the RFC2253 formatted subject from the client certificate with the following command:

$ openssl x509 -in <pathToClient PEM> -inform PEM -subject -nameopt RFC2253

The command returns the subject string as well as certificate:

subject= CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry
-----BEGIN CERTIFICATE-----
# ...
-----END CERTIFICATE-----

Add the RFC2253 compliant value of the subject as a user. Omit spaces as needed.

For example, in the mongo shell, to add the user with both the "readWrite" role in the test database and the "userAdminAnyDatabase" role, which is defined only in the admin database:

> db.getSiblingDB("$external").runCommand(
{
createUser: "CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry",
roles: [
{ role: 'readWrite', db: 'test' },
{ role: 'userAdminAnyDatabase', db: 'admin' }
],
writeConcern: { w: "majority" , wtimeout: 5000 }
}
)

In the above example, to add the user with the "readWrite" role in the test database, the role specification document specified "test" in the "db" field.

To add "userAdminAnyDatabase" role for the user, the above example specified "admin" in the "db" field.

Note: Some roles are defined only in the admin database, including clusterAdmin, readAnyDatabase, readWriteAnyDatabase, dbAdminAnyDatabase, and userAdminAnyDatabase.

To add a user with these roles, specify "admin" in the "db" field. Refer to Manage Users and Roles for details on adding a user with roles.

To remove a user that is not authorized, run the following command:

> use $external
> db.dropUser("<RDN of user>")

Check Contents

Note: This is not applicable if using LDAP for authentication.

Each unique x.509 client certificate corresponds to a single MongoDB user; meaning a single client certificate cannot authenticate more than one MongoDB user.

Log in to MongoDB and run the following command:

> db.runCommand( {connectionStatus: 1} );

Example output:

> db.runCommand({connectionStatus:1}).authInfo
{
"authenticatedUsers" : [
{
"user" : "CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry",
"db" : "mydb1"
}
],
"authenticatedUserRoles" : [
{
"role" : "dbOwner",
"db" : "mydb1"
}
]
}

If the authenticated MongoDB user displayed does not have a user value equal to the x.509 certificate subject name, this is a finding.

Vulnerability Number

V-279352

Documentable

False

Rule Version

MD8X-00-004000

Severity Override Guidance

Check Content Reference

Target Key

5728