> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up a MongoDB Atlas connector
> C1 provides identity governance and just-in-time provisioning for MongoDB Atlas. Integrate your MongoDB Atlas instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
## Capabilities
| Resource | Sync | Provision |
| :------------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts | | |
| Organizations | | |
| Teams | | |
| Projects | | |
| Clusters | | |
| Databases | | |
| Database users | | |
The MongoDB Atlas connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).
When a new account is created using the default `SCRAM-SHA` authentication type, the account's password is sent to a [vault](/product/admin/vaults).
## Account provisioning
When C1 provisions a new account through the MongoDB Atlas connector, the connector creates a **database user** in the specified MongoDB Atlas project. By default, the connector also sends an **organization invitation** to the user's email address, granting them access to the MongoDB Atlas console. You can disable this behavior by turning off the **Create invite** setting on the connector.
### Provisioning fields
| Field | Required | Description |
| :------------------ | :----------------------------------------- | :---------------------------------------------------------------------------------------------- |
| Email | Yes (unless **Create invite** is disabled) | The email address for the organization invitation. |
| Username | Yes | The username for the new database user. The required format depends on the authentication type. |
| Organization ID | Yes | The ID of the MongoDB Atlas organization. |
| Group ID | Yes | The 24-character hex string that identifies the MongoDB Atlas project. |
| Roles | No | Organization-level roles to assign to the invited user (for example, `ORG_MEMBER`). |
| Team IDs | No | IDs of organization teams to add the invited user to. |
| Authentication Type | No | The authentication method for the database user. Defaults to `SCRAM-SHA`. |
### Database user authentication types
The **Authentication Type** field determines how the provisioned database user authenticates to MongoDB databases. If not specified, this defaults to `SCRAM-SHA`.
| Authentication type | Description | Username format |
| :------------------ | :------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------- |
| `SCRAM-SHA` | Password-based authentication (default). A random password is generated and stored in a C1 [vault](/product/admin/vaults). | Alphanumeric string (special characters such as `@` are not supported; email addresses are invalid) |
| `AWS_IAM_USER` | AWS IAM user authentication. | AWS user ARN |
| `X509_CUSTOMER` | Customer-managed X.509 certificate authentication. | RFC 2253 Distinguished Name |
| `X509_MANAGED` | MongoDB Atlas-managed X.509 certificate authentication. | RFC 2253 Distinguished Name |
| `LDAP_USER` | LDAP user authentication. | RFC 2253 Distinguished Name |
| `OIDC_WORKLOAD` | OIDC workload identity authentication. | `/` |
When using `SCRAM-SHA`, the provisioned user retrieves their database password from the C1 [vault](/product/admin/vaults). For all other authentication types, no password is generated. Instead, the database user is created in the `$external` database, and the user authenticates using their external identity provider.
### How provisioning works
When account provisioning runs, the connector performs these steps:
1. **Organization invitation** (optional): If **Create invite** is enabled (the default), the connector invites the user to the MongoDB Atlas organization. If the user already exists in the organization, this step is skipped.
2. **Database user creation**: The connector creates a database user in the specified project with the chosen authentication type. The new database user is assigned a default `read` role on the `admin` database. You can grant additional database roles (such as `readWrite` or `dbAdmin`) through C1 entitlements after the account is provisioned.
## Gather MongoDB Atlas credentials
Configuring the connector requires you to pass in credentials generated in MongoDB Atlas. Gather these credentials before you move on.
A user with **Organization Owner** access in MongoDB Atlas must perform this task.
### Generate an API key in the MongoDB Atlas organization
Navigate to the MongoDB Atlas organization you wish to integrate and click **Apps**.
Click **Add new** and then select **API Key**.
Give the new API key a description, such as "C1 integration".
In the **Organization Permissions** area, select the relevant permissions:
* To provision accounts: One of **Project Owner**, **Project Charts Admin**, **Project Stream Processing Owner**, or **Project Database Access Admin**
* To provision teams and projects, create invitations to the org for newly provisioned users, and sync data: **Organization Owner**
* To sync data with no other capabilities: **Organization Read Only**
Click **Next**.
Under **API Access List**, click **Add Access List Entry**. Add the IP addresses listed on the [C1 Baton FAQ page](/baton/faq#which-ip-addresses-does-conductorone-use-for-connectors), then click **Save**.
If you're using a self-hosted connector, add the IP address of your connector host instead.
**Optional.** To sync databases and collections, for each project, add the IP addresses listed on the [C1 Baton FAQ page](/baton/faq#which-ip-addresses-does-conductorone-use-for-connectors) to **Database & Network Access** > **IP Access List**. See the **Sync databases** and **Enable Mongo driver** configuration options below.
Carefully copy and save the public key and private key.
**Done.** Next, move on to the connector configuration instructions.
## Configure the MongoDB Atlas connector
To complete this task, you'll need:
* The **Connector Administrator** or **Super Administrator** role in C1
* Access to the set of MongoDB Atlas credentials generated by following the instructions above
**Follow these instructions to use a built-in, no-code connector hosted by C1.**
In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
Search for **MongoDB Atlas** and click **Add**.
Choose how to set up the new MongoDB Atlas connector:
* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
* Add the connector to a managed app (select from the list of existing managed apps)
* Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
Click **Next**.
Find the **Settings** area of the page and click **Edit**.
Paste the public key into the **Public key** field.
Paste the private key into the **Private key** field.
**Optional.** If desired, click to enable **Create invite**, which will create email invitations for new MongoDB accounts provisioned by C1.
**Optional.** If desired, click to enable **Sync databases** and **Enable Mongo driver**. The combination of these two settings allows the connector to discover and sync databases and collections from MongoDB Atlas clusters.
**Optional.** If desired, click to enable **Enable delete database user**. This tells the connector to delete database users that only have the `read@admin` role when revoking access.
Click **Save**.
The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
**Done.** Your MongoDB Atlas connector is now pulling access data into C1.
**Follow these instructions to use the MongoDB connector, hosted and run in your own environment.**
When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
### Resources
* [Official download center](https://dist.conductorone.com/ConductorOne/baton-mongodb-atlas): For stable binaries (Windows/Linux/macOS) and container images.
* [GitHub repository](https://github.com/conductorone/baton-mongodb-atlas): Access the source code, report issues, or contribute to the project.
### Step 1: Set up a new MongoDB Atlas connector
In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
Search for **Baton** and click **Add**.
Choose how to set up the new MongoDB Atlas connector:
* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
* Add the connector to a managed app (select from the list of existing managed apps)
* Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
Click **Next**.
In the **Settings** area of the page, click **Edit**.
Click **Rotate** to generate a new Client ID and Secret.
Carefully copy and save these credentials. We'll use them in Step 2.
### Step 2: Create Kubernetes configuration files
Create two Kubernetes manifest files for your MongoDB Atlas connector deployment:
#### Secrets configuration
```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
# baton-mongodb-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-mongodb-secrets
type: Opaque
stringData:
# C1 credentials
BATON_CLIENT_ID:
BATON_CLIENT_SECRET:
# MongoDB Atlas credentials
BATON_PRIVATE_KEY:
BATON_PUBLIC_KEY:
# Optional: include if you want C1 to provision access using this connector
BATON_PROVISIONING: true
# Optional: include if you want invitation emails to be created for newly created user accounts
BATON_CREATE_INVITE_KEY: true
# Optional: include if you want to sync databases and roles
BATON_ENABLE_SYNC_DATABASES: true
BATON_ENABLE_MONGO_DRIVER: true
# Optional: include if you want to delete database users that only have the read@admin role when revoking access
BATON_DELETE_DATABASE_USER_WITH_READ_ONLY: true
```
See the connector's README or run `--help` to see all available configuration flags and environment variables.
#### Deployment configuration
```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
# baton-mongodb.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: baton-mongodb
labels:
app: baton-mongodb
spec:
selector:
matchLabels:
app: baton-mongodb
template:
metadata:
labels:
app: baton-mongodb
baton: true
baton-app: mongodb
spec:
containers:
- name: baton-mongodb
image: ghcr.io/conductorone/baton-mongodb:latest
imagePullPolicy: IfNotPresent
env:
- name: BATON_HOST_ID
value: baton-mongodb
envFrom:
- secretRef:
name: baton-mongodb-secrets
```
### Step 3: Deploy the connector
Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the MongoDB Atlas connector to. MongoDB Atlas data should be found on the **Entitlements** and **Accounts** tabs.
**Done.** Your MongoDB Atlas connector is now pulling access data into C1.