MongoDB initial setup

The following applies to both initial load and continuous replication.

You need to establish proper network connectivity between your Striim environment and MongoDB. This involves configuring network access, firewall rules, and connection parameters to ensure reliable communication.

Ensure that the Striim server can connect to MongoDB. You need to configure security groups to allow access from your Striim instance.

Also consider network latency and bandwidth requirements, especially for high-volume CDC scenarios. For optimal performance, minimize the network latency between Striim and MongoDB.

For secure connections, you can configure SSL/TLS encryption between Striim and MongoDB. This requires setting up SSL certificates and configuring both MongoDB and Striim to use encrypted connections.

Security configuration for MongoDB integration involves multiple layers, including authentication, authorization, network security, and data protection measures.

You must implement proper authentication mechanisms between Striim and MongoDB. This includes creating dedicated database users with minimal required privileges following the principle of least privilege. You should avoid using administrative accounts and instead create specific users for Striim operations with only the necessary permissions for the tables and operations required.

You should implement access control at multiple levels, including database-level permissions, schema-level access controls, and table-level privileges. You should regularly review and audit the permissions granted to Striim users and implement proper password policies and rotation procedures for service accounts.

If you have an on-premise MongoDB deployment with your own certificate authority, set the Security Config properties as discussed below.

To set up SSL in MongoDB, see MongoDB Manual > Configure mongod and mongos for TLS/SSL.

To set up Kerberos in MongoDB, see MongoDB Manual > Kerberos Authentication.

To set up X.509 in MongoDB, see MongoDB Manual > Use x.509 Certificates to Authenticate Clients.

To secure your authentication parameters, store the entire Security Config string in a vault (see use Using vaults). For example, assuming your Kerberos realm is MYREALM.COM, its Key Distribution Center (KDC) is kerberos.realm.com, the path to the SSL trust store is /cacerts, the path to the SSL keystore file is /client.pkcs12, and the password for both stores is MyPassword, the Striim console commands to store the Security Config string with the key SSLKerberos in a vault named MongoDBVault would be:

CREATE VAULT MongoDBVault;
WRITE INTO MongoDBVault (
  vaultKey: "SSLKerberos",
  vaultValue: "RealmName:MYREALM.COM;
    KDC:kerberos.myrealm.com;
    KeyStore:/keystore.pkcs12;
    TrustStore:/cacerts;
    trustStorePassword:MyPassword;
    KeyStorePassword:MyPassword"
);

Enter READ ALL FROM MongoDBVault; to verify the contents.

In TQL or the Flow Designer, you would then specify the Security Config as [[MongoDBVault.SSLKerberos]].

The following are examples for each authentication option.

Kerberos authentication

Without SSL:

CREATE VAULT MongoDBVault;
WRITE INTO MongoDBVault (
  vaultKey: "Kerberos",
  vaultValue : "RealmName:MYREALM.COM;
  KDC:kdc.myrealm.com"
);

With SSL:

CREATE VAULT MongoDBVault;
WRITE INTO MongoDBVault (
  vaultKey: "KerberosSSL",
  vaultValue : "RealmName:MYREALM.COM;
  KDC:kdc.myrealm.com;
  KeyStore:UploadedFiles/keystore.ks;
  KeyStorePassword:MyPassword;
  TrustStore:Platform/UploadedFiles/truststore.ks;
  TrustStorePassword:MyPassword"
);

If required, also specify:

SSL

If you are using MongoDB on premise with SSL, use Security Config to configure key store and trust stores.

CREATE VAULT MongoDBVault;
WRITE INTO MongoDBVault (
  vaultKey: "SSL",
  vaultValue : "KeyStore:UploadedFiles/keystore.ks;
  TrustStore:UploadedFiles/truststore.ks;
  TrustStorePassword:MyPassword;
  KeyStorePassword:MyPassword"
);

If required, also specify:

X.509 authentication

CREATE VAULT MongoDBVault;
WRITE INTO MongoDBVault (
  vaultKey: "X509",
  vaultValue : "KeyStore:UploadedFiles/keystore.ks;
  KeyStorePassword:MyPassword"
);

If required, also specify:

Striim provides support for connecting to MongoDB Atlas clusters using private endpoints or network peering.

There are no Striim-specific configuration steps required; the configuration steps you need to perform are in MongoDB Atlas.

See the following MongoDB Atlas doc topics: