MongoDB Connector

Overview

Used for OneTrust Data Discovery, the MongoDB connector helps search and scan data stored in documents and files across platforms held with MongoDB.

Pod Residency

nosql-scanner

Connection Method

URL connection via API

MongoDB driver has compatibility with different deployments:

  • MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud

  • MongoDB Enterprise: The subscription-based, self-managed version of MongoDB

  • MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB

Supported Scan Actions

Scan Type

Description

Catalog

This will fetch the list of shares and folder/files present in those shares. It collects the metadata also for these objects and send back to the main OneTrust app.

Catalog & Scan

This will fetch the list of Shares and Folder/Files present in those Shares. We collect the metadata and go for content extraction after that. It will return personally identifiable information (PII), data elements (DE), and Terms as per the classification label identified.

Credentials and System Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

The main credential will be a username/password combination with a TLS/SSL protocol specified. Read permissions will need to be applied to grant adequate access to specific database/collection being scanned as set in the scan profile.

Sample JSON - MongoDB Atlas

JSON 
{
  "connectionUrl": "mongodb+srv://your_user:your_password@hosthere/?ssl=true"
}

Sample JSON - MongoDB Enterprise and MongoDB Community

JSON 
{
    "connectionUrl": "mongodb://your_user:your_password@hosthere:27017/your_database_name"
}

TLS / mTLS Connections

Ensure the network connection between worker node to MongoDB server is allowed.

Connection Type

Required Fields

TLS only (server certificate validation)

connectionUrl (with tls=true), serverRootCaCertificatePath (or caCertificateBase64), sslRequired

mTLS (mutual TLS, client + server)

All of the above + clientCertificatePath (or clientCertificate + privateKey)

Users need to upload ca.cert and client.pem files to the worker node's extlib directory and reference them by path:

  • serverRootCaCertificatePath: Path to CA root certificate

  • clientCertificatePath: Path to client certificate (includes private key)

  • sslRequired: "true"

  • Connection URL must include tls=true

To upload your ca.crt/client.pem to your worker node

  1. Download the installer file for the worker node that will be used to connect to this data source by clicking "Launch Install" in your environment, copy the curl command, paste in your deploy machine, and run the command.

  2. Once the installer.sh file is created, run the file and once the folder dependencies are created, navigate to extlib folder and add the ca.crt or client.pem file.

  3. Navigate within the k8s-deployment/onebox-deployment or k8s-deployment/inventory folder and run the below command to sync the certificates to the deployment:

    CODE 
    ./deploy.sh sync-extlib

    Once the sync is complete all scanner pods should return to running state.

  4. Optional: To verify whether the certificates were uploaded successfully, complete the following:

    • Exec into the NoSQL Scanner Pod:

      CODE 
      kubectl exec -it <nosql-scanner-pod-name> -n <namespace> -c <nosql-scanner> -- /bin/bash

    • List out the contents of /home/ot-service/extlib folder to see if ca.crt and client.pem is present:

      CODE 
      ls /home/ot-service/extlib

  5. The certificates can now be used by setting path = "serverRootCaCertificatePath": "/home/ot-service/extlib/ca.crt" and "clientCertificatePath": "/home/ot-service/extlib/client.pem"

JSON Example

JSON 
{
  "connectionUrl": "mongodb://your_user:your_password@hosthere:27017/your_database_name?authSource=admin&tls=true",
  "serverRootCaCertificatePath": "<path-to-ca.crt>",
  "clientCertificatePath": "<path-to-client.pem>",
  "sslRequired": "true"
}
Note:

The tls=true parameter in the connection URL and sslRequired in the credential JSON are both required. The URL parameter tells the MongoDB driver to use TLS, while sslRequired tells the OneTrust scanner to enforce the TLS configuration.

Adjust authSource=admin to match your actual authentication database if it differs.

Method 2: Inline Certificate Strings

Users need to provide certificate content directly in the credential JSON:

  • caCertificateBase64: CA certificate with PEM header/footer

  • clientCertificate: Client certificate with PEM header/footer

  • privateKey: Private key with PEM header/footer

  • privateKeyPassword: (optional) Private key password

  • sslRequired: "true"

JSON Example

JSON 
{
  "connectionUrl": "mongodb://your_user:your_password@hosthere:27017/your_database_name?authSource=admin&tls=true",
  "caCertificateBase64": "<ca-certificate-with-header>",
  "clientCertificate": "<client-certificate-with-header>",
  "privateKey": "<private-key-certificate-with-header>",
  "privateKeyPassword": "<private-key-password>",
  "sslRequired": "true"
}
Attention:

When pasting certificates, ensure the newline character "/n" is an actual newline character and not a literal backslash + n. This is a common error.

CODE 
Valid
Hex: 0a = (actual newline character)

Invalid
Hex: 5c6e = (literal backslash + 'n')

Use this method only when:

  • The caCertificateBase64 is a single certificate, not a key chain

  • PrivateKey and clientCertificate are separated.

Scan Profile Support

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

  • Number of databases

  • Collections per database

  • Documents per collection

Include Path Configuration

  • Database: database name

  • Collection: collection name

Collected Objects and Fields

Objects

Object

Description

Database

A physical container for collections. Each database has its own set of files on the file system. A single MongoDB server typically has multiple databases.

Collection

A grouping of MongoDB documents. A collection is the equivalent of an RDBMS table. A collection exists within a single database. Collections do not enforce a schema. Documents within a collection can have different fields. Typically, all documents in a collection have a similar or related purpose.

Document (Row)

A record in a MongoDB collection and the basic unit of data in MongoDB. Documents are analogous to JSON objects but exist in the database in a more type-rich format known as BSON.

Field (Column)

A name-value pair in a document. A document can have zero or more fields. Fields are analogous to columns in relational databases.

Metadata Collected

  • Name

  • Path

  • Content Type (Fields)

  • Rows Calculated (Collections)

Note:

The remaining fields will be unique to each document structure and can be anything defined by the customer.