IAM Based Authentication with Mongoid

[VishalRightHand]

Hello Folks,

Any one has implemented IAM based authentication with Mongoid in rails? would be great help if one can show us how has that done.

[alexbevi]

Hey @VishalRightHand, Mongoid wraps the MongoDB Ruby driver which supports AWS IAM. Is this what you're looking for or did you have something else in mind?

[VishalRightHand]

Hey @alexbevi thanks for your response! Yes, I've gone through that document but bit confused between mongoid and mongo, mongo is being instructed all over the documents.

[jamis]

Sorry for the confusion, @VishalRightHand. I hope I can try to clarify:

• mongo is the lower-level Ruby driver for MongoDB. It exposes the lower-level MongoDB abstractions directly (clients, connections, databases, collections, etc.).
• mongoid is a higher-level library that provides a way to map documents in MongoDB to objects (using the "active record" pattern). It provides a similar interface to the "ActiveRecord" library in Ruby on Rails. It is built on top of the mongo Ruby driver, so anything you can do in Mongoid you can do with the driver directly (it just might take more steps to accomplish with the driver).

If you're familiar with Rails, the difference is analogous to the database adapter (e.g. the Ruby adapters for MySQL or PostgreSQL or SQLite) versus ActiveRecord, which is built on top of them.

You can access any of the driver abstractions via Mongoid. For example, to access the collection corresponding to a given model class, you can do e.g. Model.collection. That would then let you drop down and invoke the driver APIs directly.

[VishalRightHand]

Hi @jamis thanks for explaining it. Actually I've configured IAM based authentication for Mongo Atlas in Rails with Mongoid, by default IAM based authentication token gets expired after an hour, after it expires mongoid is not refreshing the connection by itself that resulting Authentication failure. any insight?

[johnnyshields]

@VishalRightHand this should be assumed to be a driver problem. It's reasonable to assume that Mongoid (which is built on-top of the driver) is not the problem, because the driver itself manages connection state including IAM.

Can you make a simple Mongo-Ruby-Driver only app which demonstrates the issue?

[jamis]

It looks like this is a general limitation of nearly all the current official MongoDB drivers. There's a forum post (here) where others have encountered it, and one user's recommendation is:

I recommend adding the IAM role of your EC2 instance or ECS Task as a database user directly to the MongoDB Atlas cluster.

I wish I had better news for you. This definitely sounds like an opportunity for the official drivers to improve their IAM support.