community.mongodb.mongodb_atlas_oidc_user module – Manage OIDC database users in Atlas

Note

This module is part of the community.mongodb collection (version 1.8.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.mongodb.

To use it in a playbook, specify: community.mongodb.mongodb_atlas_oidc_user.

Synopsis

  • Manage OIDC-authenticated database users (human users and IdP groups) in MongoDB Atlas.

  • Uses OAuth2 client_credentials (Service Account) for authentication.

  • For oidc_auth_type USER the database_name must be $external.

  • For oidc_auth_type IDP_GROUP the database_name must be admin.

  • API Documentation

Parameters

Parameter

Comments

api_password

aliases: apiPassword

string

Atlas API private key. Alternative to service_account_secret.

api_username

aliases: apiUsername

string

Atlas API public key. Alternative to service_account_id.

database_name

aliases: databaseName

string

Database against which Atlas authenticates the user.

Must be $external for USER and admin for IDP_GROUP.

Choices:

  • "admin"

  • "$external" ← (default)

group_id

aliases: groupId

string / required

Unique identifier of the Atlas project (group).

oidc_auth_type

aliases: oidcAuthType

string

OIDC authentication type.

USER for individual human users authenticated via OIDC.

IDP_GROUP for IdP groups mapped to MongoDB roles.

Choices:

  • "USER"

  • "IDP_GROUP" ← (default)

roles

list / elements=dictionary / required

Array of roles and the databases on which the roles apply.

database_name

aliases: databaseName

string / required

Database on which the user has the specified role.

role_name

aliases: roleName

string / required

Name of the role. Can be a built-in or custom role.

service_account_id

aliases: serviceAccountId

string

MongoDB Atlas Service Account client ID (OAuth2).

Mutually exclusive with api_username.

service_account_secret

aliases: serviceAccountSecret

string

MongoDB Atlas Service Account client secret (OAuth2).

Mutually exclusive with api_password.

state

string

Desired state of the user.

Choices:

  • "present" ← (default)

  • "absent"

username

string / required

Username for OIDC USER or IdP group identifier for IDP_GROUP.

For IDP_GROUP format is <idp_id>/<group_name>.

Examples

- name: Create OIDC IDP_GROUP database user
  community.mongodb.mongodb_atlas_oidc_user:
    service_account_id: "mdb_sa_id_xxxx"
    service_account_secret: "mdb_sa_sk_xxxx"
    group_id: "6991db0a32bf1b56dbb63d62"
    oidc_auth_type: "IDP_GROUP"
    database_name: "admin"
    username: "69d4192c57e96607c7180011/SG-DB-ROLE-APPOPS"
    roles:
      - database_name: admin
        role_name: readViewOnboardingCustomerList

- name: Create OIDC USER database user
  community.mongodb.mongodb_atlas_oidc_user:
    service_account_id: "mdb_sa_id_xxxx"
    service_account_secret: "mdb_sa_sk_xxxx"
    group_id: "6991db0a32bf1b56dbb63d62"
    oidc_auth_type: "USER"
    database_name: "$external"
    username: "69d4192c57e96607c7180011/karol.murawski@d360.com"
    roles:
      - database_name: admin
        role_name: dbAdminAnyDatabase

Authors

  • Karol Murawski (@kazz3m)