community.mongodb.mongodb_atlas_federation_role_mapping module – Manage Atlas Federation role mappings for SAML/OIDC groups

Note

This module is part of the community.mongodb collection (version 1.8.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.mongodb.

To use it in a playbook, specify: community.mongodb.mongodb_atlas_federation_role_mapping.

Synopsis

  • Manage role mappings between external IdP groups and MongoDB Atlas org/project roles.

  • Used to grant Atlas Console access to SAML/SSO groups (e.g. ORG_OWNER, GROUP_READ_ONLY).

  • Uses OAuth2 client_credentials (Service Account) for authentication.

  • API Documentation

Parameters

Parameter

Comments

api_password

aliases: apiPassword

string

Atlas API private key. Alternative to service_account_secret.

api_username

aliases: apiUsername

string

Atlas API public key. Alternative to service_account_id.

external_group_name

aliases: externalGroupName

string / required

Name of the external IdP group (e.g. AD/SAML group name).

federation_settings_id

aliases: federationSettingsId

string / required

Unique identifier of the federation settings.

org_id

aliases: orgId

string / required

Unique identifier of the Atlas organization.

role_assignments

list / elements=dictionary / required

List of Atlas role assignments for this group.

group_id

aliases: groupId

string

Atlas project ID for project-level role assignment. Mutually exclusive with org_id.

org_id

aliases: orgId

string

Atlas org ID for org-level role assignment. Mutually exclusive with group_id.

role

string / required

Atlas role name (e.g. ORG_OWNER, ORG_MEMBER, GROUP_READ_ONLY).

service_account_id

aliases: serviceAccountId

string

MongoDB Atlas Service Account client ID (OAuth2).

Mutually exclusive with api_username.

service_account_secret

aliases: serviceAccountSecret

string

MongoDB Atlas Service Account client secret (OAuth2).

Mutually exclusive with api_password.

state

string

Desired state of the role mapping.

Choices:

  • "present" ← (default)

  • "absent"

Examples

- name: Map AD group to ORG_OWNER in Atlas
  community.mongodb.mongodb_atlas_federation_role_mapping:
    service_account_id: "mdb_sa_id_xxxx"
    service_account_secret: "mdb_sa_sk_xxxx"
    federation_settings_id: "69d3f63fd91aa77b74a930a0"
    org_id: "694ec9ddbaecce170ffe8b62"
    external_group_name: "SG-OCI-INFRA-ADMINS"
    role_assignments:
      - org_id: "694ec9ddbaecce170ffe8b62"
        role: "ORG_OWNER"

- name: Map AD group to project read-only
  community.mongodb.mongodb_atlas_federation_role_mapping:
    service_account_id: "mdb_sa_id_xxxx"
    service_account_secret: "mdb_sa_sk_xxxx"
    federation_settings_id: "69d3f63fd91aa77b74a930a0"
    org_id: "694ec9ddbaecce170ffe8b62"
    external_group_name: "SG-OCI-DB-Family"
    role_assignments:
      - org_id: "694ec9ddbaecce170ffe8b62"
        role: "ORG_MEMBER"
      - group_id: "6991db0a32bf1b56dbb63d62"
        role: "GROUP_READ_ONLY"

Authors

  • Karol Murawski (@kazz3m)