Find the host ID for the process.¶

Use the Get One Host by Hostname and Port resource to find the process and retrieve the id value.

curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \
     --request GET "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/hosts/byName/{HOSTNAME}:{PORT}"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

{
  "alertsEnabled" : true,
  "aliases": [ "server1.example.com:27017", "203.0.113.3:27017" ],
  "authMechanismName" : "SCRAM-SHA-1",
  "clusterId" : "<cluster-ID-1>",
  "created" : "2021-04-22T19:56:50Z",
  "groupId" : "<project-ID-1>",
  "hasStartupWarnings" : false,
  "hidden" : false,
  "hostEnabled" : true,
  "hostname" : "server1.example.com",
  "id" : "{HOST-ID}",
  "ipAddress": "203.0.113.3",
}

Stop monitoring the process that matches the host ID.¶

Use the Stop Monitoring One Host resource to stop monitoring the host.

curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \
     --request DELETE "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/hosts/{HOST-ID}"

Verify that Cloud Manager no longer monitors the process.¶

Use the Get One Host by Hostname and Port resource again to attempt to find the process using its hostname and port. Then, verify that details returns No host with hostname and port {HOSTNAME}:{PORT} exists in group {PROJECT-ID} .

curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \
     --request GET "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/hosts/byName/{HOSTNAME}:{PORT}"

Click Settings , then Project Settings .¶

Toggle the Collect Logs For All Hosts option to Yes or No , as desired.¶

Click Deployment , then the Agents tab, then Agent Logs .¶

The page displays logs for the type of agent selected in the View drop-down list. The page filters logs according to any filters selected in through the gear icon.

Filter the log entries.¶

To display logs for a different type of agent, use the View drop-down list.

To display logs for a specific hosts or MongoDB processes, click the gear icon and make your selections.

To clear filters, click the gear icon and click Remove Filters .

To download the selected logs, click the gear icon and click Download as CSV File .

Add a new application to your Okta account¶

1. In the Okta top navigation, click the Applications tab.
2. Click the Add Application button.
3. Click the Create New App button.
4. Select Web for the Platform field.
5. Select SAML 2.0 for the Sign on method field.
6. Click the Create button.

Create Okta SAML integration¶

1. Fill in the App name text field with your desired application name.
2. Optionally, add a logo image and set app visibility.
3. Click the Next button.

Download Okta certificate¶

1. Click the Download Okta Certificate button.
2. Rename the downloaded file to have a .cer extension instead of .cert .

Navigate to the Federation Management Console¶

1. Log in to Cloud Manager.
2. Use the dropdown at the top-left of Cloud Manager to select the organization for which you want to manage federation settings.
3. Click Settings in the left navigation pane.
4. In Manage Federation Settings , click Visit Federation Management App .

Create a new Identity Provider¶

1. In the FMC dashboard, click the Manage Identity Providers button.
2. Click the Setup Identity Provider button.

Enter SAML settings¶

1. In the FMC dashboard, fill in the data fields with the following values:

   Field	Value
   Configuration Name	A descriptive name of your choosing.
   Issuer URI and Single Sign-On URL	Click the Fill With Placeholder Values button to the right of the text fields. You will get the real values from Okta in a later step.
   Identity Provider Signature Certificate	Click the Choose File button to upload the .cer file you received from Okta earlier. You can either: Upload the certificate from your computer, or Paste the contents of the certificate into a text box.
   Request Binding	HTTP POST
   Response Signature Algorithm	SHA-256

2. Click the Next button.

Create SAML Integration¶

1. In this step, copy values from the Cloud Manager FMC to the Okta Create SAML Integration page.

   Okta Data Field	Value
   Single sign on URL	Use the Assertion Consumer Service URL from the Cloud Manager FMC. Checkboxes: Use this for Recipient URL and Destination URL : checked Allow this app to request other SSO URLs : unchecked
   Audience URI (SP Entity ID)	Use the Audience URI from the Cloud Manager FMC.
   Default RelayState	Optionally, add a RelayState URL to your IdP to send users to a URL you choose and avoid unnecessary redirects after login. You can use: Destination RelayState URL MongoDB MongoDB Atlas The Login URL that was generated for your identity provider configuration in the MongoDB Atlas Federation Management App . MongoDB Support Portal copy copied https://auth.mongodb.com/app/salesforce/exk1rw00vux0h1iFz297/sso/saml MongoDB University copy copied https://university.mongodb.com MongoDB Community Forums copy copied https://auth.mongodb.com/home/mongodbexternal_communityforums_3/0oa3bqf5mlIQvkbmF297/aln3bqgadajdHoymn297 MongoDB Feedback Engine copy copied https://auth.mongodb.com/home/mongodbexternal_uservoice_1/0oa27cs0zouYPwgj0297/aln27cvudlhBT7grX297 MongoDB JIRA copy copied https://auth.mongodb.com/app/mongodbexternal_mongodbjira_1/exk1s832qkFO3Rqox297/sso/saml
   Name ID format	Unspecified
   Application username	Email
   Update application username on	Create and update

2. Click the Click Show Advanced Settings link in the Okta configuration page and ensure that the following values are set:

   Okta Data Field	Value
   Response	Signed
   Assertion Signature	Signed
   Signature Algorithm	RSA-SHA256
   Digest Algorithm	SHA256
   Assertion Encryption	Unencrypted

3. Leave the remaining Advanced Settings fields in their default state.

4. Scroll down to the Attribute Statements (Optional) section and create three attributes with the following values:

   Name	Name Format	Value
   email	Unspecified	user.email
   firstName	Unspecified	user.firstName
   lastName	Unspecified	user.lastName

   Important

   The values in the Name column are case-sensitive. Enter them exactly as shown.

   Note

   These values may be different if Okta is connected to an Active Directory. For the appropriate values, use the Active Directory fields that contain a user’s first name, last name, and full email address.

5. Click the Next button in the Okta configuration.

6. Select the radio button marked I’m an Okta customer adding an internal app .

7. Click the Finish button.

Copy information back to the Cloud Manager FMC¶

1. On the Okta application page, click the View Setup Instructions button in the middle of the page.

   Note

   The Okta setup instructions appear in a new browser tab.

2. In the Cloud Manager FMC , click the Finish button to return to the Identity Providers page. Click the Modify button for your newly created IdP .

3. Fill in the following text fields:

   FMC Data Field	Value
   Issuer URI	Use the Identity Provider Issuer value from the Okta Setup Instructions page.
   Single Sign-on URL	Use the Identity Provider Single Sign-On URL value from the Okta Setup Instructions page.

4. Close the Okta setup instructions browser tab.

5. Click the Next button on the Cloud Manager FMC page.

6. Click the Finish button the FMC Edit Identity Provider page.

Assign users to your Okta application¶

1. On the Okta application page, click the Assignments tab.
2. Ensure that all your Cloud Manager organization users who will use the Okta service are enrolled.