UserSecurity

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/mongodb/main/json-schema/mongodb-user-security-schema.json",
  "title": "UserSecurity",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/mongodb-ldap-configuration-api-openapi.yml#/components/schemas/UserSecurity",
  "properties": {
    "customerX509": {
      "$ref": "#/$defs/DBUserTLSX509Settings"
    },
    "ldap": {
      "$ref": "#/$defs/LDAPSecuritySettings"
    },
    "links": {
      "description": "List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.",
      "items": {
        "$ref": "#/$defs/Link"
      },
      "readOnly": true,
      "type": "array"
    }
  },
  "type": "object",
  "$defs": {
    "DBUserTLSX509Settings": {
      "description": "Settings to configure TLS Certificates for database users.",
      "properties": {
        "cas": {
          "description": "Concatenated list of customer certificate authority (CA) certificates needed to authenticate database users. MongoDB Cloud expects this as a PEM-formatted certificate.",
          "type": "string"
        },
        "links": {
          "description": "List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.",
          "items": {
            "$ref": "#/$defs/Link"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "title": "Database User TLS Certificate Settings",
      "type": "object"
    },
    "LDAPSecuritySettings": {
      "description": "Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration details that apply to the specified project.",
      "properties": {
        "authenticationEnabled": {
          "description": "Flag that indicates whether users can authenticate using an Lightweight Directory Access Protocol (LDAP) host.",
          "type": "boolean"
        },
        "authorizationEnabled": {
          "description": "Flag that indicates whether users can authorize access to MongoDB Cloud resources using an Lightweight Directory Access Protocol (LDAP) host.",
          "type": "boolean"
        },
        "authzQueryTemplate": {
          "default": "{USER}?memberOf?base",
          "description": "Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud runs to obtain the LDAP groups associated with the authenticated user. MongoDB Cloud uses this parameter only for user authorization. Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query according to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).",
          "type": "string"
        },
        "bindPassword": {
          "description": "Password that MongoDB Cloud uses to authenticate the `bindUsername`.",
          "type": "string",
          "writeOnly": true
        },
        "bindUsername": {
          "description": "Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.",
          "pattern": "^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$",
          "type": "string"
        },
        "caCertificate": {
          "description": "Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `\"caCertificate\": \"\"`.",
          "type": "string"
        },
        "hostname": {
          "description": "Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.",
          "pattern": "^([0-9]{1,3}\\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\\.){1,10}[a-z]+)?$",
          "type": "string"
        },
        "links": {
          "description": "List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.",
          "items": {
            "$ref": "#/$defs/Link"
          },
          "readOnly": true,
          "type": "array"
        },
        "port": {
          "default": 636,
          "description": "Port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.",
          "format": "int32",
          "type": "integer"
        },
        "userToDNMapping": {
          "description": "User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.",
          "items": {
            "$ref": "#/$defs/UserToDNMapping"
          },
          "type": "array"
        }
      },
      "title": "LDAP Security Settings",
      "type": "object"
    },
    "Link": {
      "properties": {
        "href": {
          "description": "Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.",
          "type": "string"
        },
        "rel": {
          "description": "Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "UserToDNMapping": {
      "description": "User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.",
      "properties": {
        "ldapQuery": {
          "description": "Lightweight Directory Access Protocol (LDAP) query template that inserts the LDAP name that the regular expression matches into an LDAP query Uniform Resource Identifier (URI). The formatting for the query must conform to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).",
          "type": "string"
        },
        "match": {
          "description": "Regular expression that MongoDB Cloud uses to match against the provided Lightweight Directory Access Protocol (LDAP) username. Each parenthesis-enclosed section represents a regular expression capture group that the substitution or `ldapQuery` template uses.",
          "type": "string"
        },
        "substitution": {
          "description": "Lightweight Directory Access Protocol (LDAP) Distinguished Name (DN) template that converts the LDAP username that matches regular expression in the *match* parameter into an LDAP Distinguished Name (DN).",
          "type": "string"
        }
      },
      "required": [
        "match"
      ],
      "title": "User to Distinguished Name Mapping",
      "type": "object"
    }
  }
}