0

I have an Azure Cosmos DB API for MongoDB account and i can connect to it using the primary or secondary connection string from MongoDB Compass by entering the connection string directly.

Multiple users will need to connect to it and I don't want to share the connection string with all of them (if i need to remove the access to somebody i would need to rotate the connection string and share with the remaining people requiring the access).

I would like to use RBAC with Azure Active Directory to connect to the Cosmo DB from Compass, but when i change the username(email)/password on the connection string to use my Azure AD account it doesn't work because it seems it is trying to authenticate my account to the "Admin" database on Cosmos DB.

This is my connection string:

mongodb://userfullemail:password@cosmos-instance-name-001.mongo.cosmos.azure.com:10255/?authSource=admin&replicaSet=globaldb&maxIdleTimeMS=120000&readPreference=primary&appname=%40cosmos-instance-name-001%40&retryWrites=false&ssl=true

I get the error: connection x.x.x.x:10255 closed

I have already tried removing the "Authentication Database" and then i get the error "Invalid key"

Changing the Authentication Mechanism from "Default" to "SCRAM-SHA-1" and multiple other Authentication Methods and nothing works.

Are there any specific settings to get this connection working?

David Makogon
  • 69,407
  • 21
  • 141
  • 189
Camilo Torres
  • 1
  • 1
    Welcome! Please be mindful of tags, and check their descriptions. `cosmos` has nothing to do with Cosmos DB, and `compass` has nothing to do with Mongo DB. I fixed these, accordingly. – David Makogon Jun 25 '22 at 02:04
  • As for using Compass: Compass will have no idea about Azure AD, and will require a connection string. Maybe revisit the topic of why you're ever giving end-users access to a database, vs controlling access via an app? (or let your users create their own Cosmos DB instances?) – David Makogon Jun 25 '22 at 02:09
  • David, thanks for your reply. This is my first post, so sorry for the tag issue. – Camilo Torres Jun 25 '22 at 11:39
  • My use case is that multiple developers would like to have access to the data during development time to see how the records are actually created, so it is not really end-users that would access the corresponding data from the app. That is why i would like to control the access with AD for the developers. Any ideas? – Camilo Torres Jun 25 '22 at 11:42

0 Answers0