Kerberos authentication does not work in Mongodb Enterprise 3.2 - mongodb

Question

Environment Windows 2012 R2. MongoDB Enterprise 3.2.0, this is an evaluation version.
I am logged in as muser1.
Why it is looking for a field pwd?
How can I fix it?
c:\MongoDB\scripts>mongo.exe --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username muser1#TEST.MNG
MongoDB shell version: 3.2.0
connecting to: test
2016-01-14T14:03:37.572-0800 E QUERY [thread1] Error: Missing expected field "pwd" :
DB.prototype._authOrThrow#src/mongo/shell/db.js:1395:16
#(auth):6:1
#(auth):1:2
exception: login failed
The user exists:
MongoDB Enterprise > user = db.system.users.findOne({user: "muser1#TEST.MNG"})
{
"_id" : "$external.muser1#TEST.MNG",
"user" : "muser1#TEST.MNG",
"db" : "$external",
"credentials" : {
"external" : true
},
"roles" : [
{
"role" : "readWrite",
"db" : "test"
}
]
}
Kerberos is correctly configured based on 3.2 documentation. DNS configured correctly.
MongoDB service is running with a domain account. SPN is there for the default and for the named service also. Tried to have just one of them configured alone then the other one, no luck.
c:\MongoDB\scripts>setspn -L m1svr
Registered ServicePrincipalNames for CN=Mongo1,CN=Users,DC=test,DC=mng:
mongodb/m1.test.mng
MongoDB_M1_D1/m1.test.mng
Here is the startup config file:
# Data Node, with minimal oplog and no jurnal
net:
port: 27017
systemLog:
verbosity: '0' #Debug level from 0-5
destination: file
path: C:\MongoDB\logs\m1-d1.log
logAppend: false
storage:
dbPath: C:\MongoDB\data\m1\D1
journal:
enabled: false
directoryPerDB : true
wiredTiger:
engineConfig:
cacheSizeGB: 1
statisticsLogDelaySecs: 1
journalCompressor: snappy
directoryForIndexes: true
collectionConfig:
blockCompressor: snappy
indexConfig:
prefixCompression: true
#replication:
# oplogSizeMB: 10
# replSetName: RSTest
security:
authorization: enabled
# sasl:
# hostName: m1.test.mng
# serviceName: MongoDB_M1_D1
# keyFile: F:\config\key1.txt
# clusterAuthMode: keyFile
setParameter:
authenticationMechanisms: GSSAPI,SCRAM-SHA-1
I tried to add a pwd field to the user document (just in case), but no luck.
I am out of ideas.

Answer 1

When using Kerberos Authentication, you need to define the fully qualified domain name for the server you are connecting to as part of the connection string. Note that the domain portion also needs to be in all caps. eg:
mongo.exe --host servername.TEST.MNG --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username muser1#TEST.MNG