Externally Sourced Configuration File Values in MongoDB

Since version 4.2, MongoDB provides a new interesting feature called Externally Sourced Configuration File Values. It allows administrators to specify that particular variables will have their values loaded from an external resource.

The external resources that are supported, at this time, are:

• REST APIs, which will cause MongoDB to perform HTTP GET requests to a given URL
• Processes, which will cause MongoDB to run a specified binary and use the returned value

This feature has a lot of use cases, and providing the x509 certificate password without having it stored in the file is one of them. It can easily achieve it with the following configuration:

or by using REST API:

Within the scope of Externally Sourced Configuration File Values, MongoDB also introduces a unique feature, allowing users to use only the expected value. For instance, if someone wants to protect from the external resource mistakenly returning a wrong value, the user can provide a SHA256-HMAC digest of the expected value. By using that, the value is known to an administrator, can be used by MongoDB, and it’s still not stored in the configuration file.

Let’s consider the trivial example of:

The /usr/local/bin/getPort is a simple script that returns a single integer:

The digest key was chosen randomly, and the digest itself is sha256-hmac of literal 21010:

After starting it, MongoDB works fine, and it uses 21010/tcpAs defined in the provider script:

After changing the returned value to 201011, but leaving the expected digest unchanged, MongoDB refuses to start and returns an error:

As the expected and received value digest changed, MongoDB decided not to trust the received value. This could be used for passwords and tokens in real-life scenarios as the data won’t be stored in the config file, but MongoDB will still accept only a single expected value. This provides integrity of the critical configuration data but still allows MongoDB to be more flexible in fetching data from remote endpoints.

Complete the 2021 Percona Open Source Data Management Software Survey

Have Your Say!