Set up a MongoDB Atlas connector

C1 provides identity governance and just-in-time provisioning for MongoDB Atlas. Integrate your MongoDB Atlas instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

Resource	Sync	Provision
Accounts
Organizations
Teams
Projects
Clusters
Databases
Database users

The MongoDB Atlas connector supports automatic account provisioning and deprovisioning.

When a new account is created using the default SCRAM-SHA authentication type, the account’s password is sent to a vault.

Account provisioning

When C1 provisions a new account through the MongoDB Atlas connector, the connector creates a database user in the specified MongoDB Atlas project. By default, the connector also sends an organization invitation to the user’s email address, granting them access to the MongoDB Atlas console. You can disable this behavior by turning off the Create invite setting on the connector.

Provisioning fields

Field	Required	Description
Email	Yes (unless Create invite is disabled)	The email address for the organization invitation.
Username	Yes	The username for the new database user. The required format depends on the authentication type.
Organization ID	Yes	The ID of the MongoDB Atlas organization.
Group ID	Yes	The 24-character hex string that identifies the MongoDB Atlas project.
Roles	No	Organization-level roles to assign to the invited user (for example, ORG_MEMBER).
Team IDs	No	IDs of organization teams to add the invited user to.
Authentication Type	No	The authentication method for the database user. Defaults to SCRAM-SHA.

Database user authentication types

The Authentication Type field determines how the provisioned database user authenticates to MongoDB databases. If not specified, this defaults to SCRAM-SHA.

Authentication type	Description	Username format
SCRAM-SHA	Password-based authentication (default). A random password is generated and stored in a C1 vault.	Any string
AWS_IAM_USER	AWS IAM user authentication.	AWS user ARN
X509_CUSTOMER	Customer-managed X.509 certificate authentication.	RFC 2253 Distinguished Name
X509_MANAGED	MongoDB Atlas-managed X.509 certificate authentication.	RFC 2253 Distinguished Name
LDAP_USER	LDAP user authentication.	RFC 2253 Distinguished Name
OIDC_WORKLOAD	OIDC workload identity authentication.	<Atlas OIDC IdP ID>/<IdP user identifier>

When using SCRAM-SHA, the provisioned user retrieves their database password from the C1 vault. For all other authentication types, no password is generated. Instead, the database user is created in the $external database, and the user authenticates using their external identity provider.

How provisioning works

When account provisioning runs, the connector performs these steps:

1. Organization invitation (optional): If Create invite is enabled and an email address is provided, the connector invites the user to the MongoDB Atlas organization. If the user already exists in the organization, this step is skipped.

2. Database user creation: The connector creates a database user in the specified project with the chosen authentication type. The new database user is assigned a default read role on the admin database. You can grant additional database roles (such as readWrite or dbAdmin) through C1 entitlements after the account is provisioned.

Gather MongoDB Atlas credentials

Configuring the connector requires you to pass in credentials generated in MongoDB Atlas. Gather these credentials before you move on.

A user with Organization Owner access in MongoDB Atlas must perform this task.

Generate an API key in the MongoDB Atlas organization

1. Navigate to the MongoDB Atlas organization you wish to integrate and click Apps.

2. Click Add new and then select API Key.

3. Give the new API key a description, such as “C1 integration”.

4. In the Organization Permissions area, select the relevant permissions:

   • To provision accounts: One of Project Owner, Project Charts Admin, Project Stream Processing Owner, or Project Database Access Admin

   • To provision teams and projects, create invitations to the org for newly provisioned users, and sync data: Organization Owner

   • To sync data with no other capabilities: Organization Read Only

5. Click Next.

6. Under API Access List, click Add Access List Entry. Add the IP addresses listed on the C1 Baton FAQ page, then click Save.

   If you’re using a self-hosted connector, add the IP address of your connector host instead.

7. Optional. To sync databases and collections, for each project, add the IP addresses listed on the connector FAQ page to Database & Network Access > IP Access List. See the Sync databases and Enable Mongo driver configuration options below.

8. Carefully copy and save the public key and private key.

Done. Next, move on to the connector configuration instructions.

Configure the MongoDB Atlas connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in C1
• Access to the set of MongoDB Atlas credentials generated by following the instructions above

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for MongoDB Atlas and click Add.

3. Choose how to set up the new MongoDB Atlas connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Paste the public key into the Public key field.

8. Paste the private key into the Private key field.

9. Optional. If desired, click to enable Create invite, which will create email invitations for new MongoDB accounts provisioned by C1.

10. Optional. If desired, click to enable Sync databases and Enable Mongo driver. The combination of these two settings allows the connector to discover and sync databases and collections from MongoDB Atlas clusters.

11. Optional. If desired, click to enable Enable delete database user. This tells the connector to delete database users that only have the read@admin role when revoking access.

12. Click Save.

13. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your MongoDB Atlas connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the MongoDB connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

• Official download center: For stable binaries (Windows/Linux/macOS) and container images.

• GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new MongoDB Atlas connector

1. In C1, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new MongoDB Atlas connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your MongoDB Atlas connector deployment:

Secrets configuration

# baton-mongodb-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-mongodb-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # MongoDB Atlas credentials
  BATON_PRIVATE_KEY: <MongoDB private key>
  BATON_PUBLIC_KEY: <MongoDB public key>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

  # Optional: include if you want invitation emails to be created for newly created user accounts
  BATON_CREATE_INVITE_KEY: true

  # Optional: include if you want to sync databases and roles
  BATON_ENABLE_SYNC_DATABASES: true
  BATON_ENABLE_MONGO_DRIVER: true

  # Optional: include if you want to delete database users that only have the read@admin role when revoking access
  BATON_DELETE_DATABASE_USER_WITH_READ_ONLY: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-mongodb.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-mongodb
  labels:
    app: baton-mongodb
spec:
  selector:
    matchLabels:
      app: baton-mongodb
  template:
    metadata:
      labels:
        app: baton-mongodb
        baton: true
        baton-app: mongodb
    spec:
      containers:
      - name: baton-mongodb
        image: ghcr.io/conductorone/baton-mongodb:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-mongodb
        envFrom:
        - secretRef:
            name: baton-mongodb-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the MongoDB Atlas connector to. MongoDB Atlas data should be found on the Entitlements and Accounts tabs.

Done. Your MongoDB Atlas connector is now pulling access data into C1.