@@ -624,6 +624,10 @@ Otherwise you will get a *auth failed* exception.
624624 ]);
625625 };
626626
627+
628+ --------------------------
629+
630+ TODO: Add documentation for queryable encryption configuration.
627631
628632Full Default Configuration
629633--------------------------
@@ -699,6 +703,33 @@ Full Default Configuration
699703 wTimeoutMS : ~
700704 driver_options :
701705 context : ~ # stream context to use for connection
706+ autoEncryption : # Options for client-side field-level encryption
707+ keyVaultClient : null # Service ID of a MongoDB\Driver\Manager for the key vault
708+ keyVaultNamespace : null # The namespace for the key vault collection (e.g., "encryption.__keyVault")
709+ kmsProvider : {} # Configuration for Key Management System provider (see specific examples above)
710+ # e.g., { type: "local", key: "YOUR_BASE64_KEY" }
711+ # e.g., { type: "aws", accessKeyId: "...", secretAccessKey: "..." }
712+ masterKey : ~ # Default master key to use when creating a new encrypted collection
713+ schemaMap : [] # Document schemas for explicit encryption
714+ encryptedFieldsMap : [] # Map of collections to their encrypted fields configuration
715+ extraOptions : [] # Extra options for mongocryptd
716+ # mongocryptdURI: "mongodb://localhost:27020"
717+ # mongocryptdBypassSpawn: false
718+ # mongocryptdSpawnPath: "/usr/local/bin/mongocryptd"
719+ # mongocryptdSpawnArgs: ["--idleShutdownTimeoutSecs=60"]
720+ # cryptSharedLibPath: null # Path to the crypt_shared library
721+ # cryptSharedLibRequired: false # If true, fails if the crypt_shared library cannot be loaded
722+ bypassQueryAnalysis : false # Disables automatic analysis of read and write operations for encryption
723+ bypassAutoEncryption : false # Disables auto-encryption
724+ tlsOptions : # TLS options for the Key Vault client (if keyVaultClient is not specified)
725+ tlsCAFile : null # Path to CA file, e.g., /path/to/key-vault-ca.pem
726+ tlsCertificateKeyFile : null # Path to client cert/key file, e.g., /path/to/key-vault-client.pem
727+ tlsCertificateKeyFilePassword : null # Password for client cert/key file
728+ tlsAllowInvalidCertificates : false # Bypass server certificate validation (use with caution)
729+ tlsAllowInvalidHostnames : false # Bypass server hostname validation (use with caution)
730+ tlsDisableCertificateRevocationCheck : false # Disable CRL checks
731+ tlsDisableOCSPEndpointCheck : false # Disable OCSP checks
732+ tlsInsecure : false # Allow invalid/no server cert (use with extreme caution)
702733
703734 proxy_namespace : MongoDBODMProxies
704735 proxy_dir : " %kernel.cache_dir%/doctrine/odm/mongodb/Proxies"
@@ -825,8 +856,32 @@ Full Default Configuration
825856
826857 $config->connection('id')
827858 ->server('mongodb://localhost')
828- ->driverOptions([
829- 'context' => null, // stream context to use for connection
859+ ->driverOptions(['context' => null]), // stream context to use for connection
860+ ->autoEncryption([ // Options for client-side field-level encryption
861+ 'bypassAutoEncryption' => false, // Disables auto-encryption
862+ 'keyVaultClient' => null, // Service ID of a MongoDB\Driver\Manager for the key vault
863+ 'keyVaultNamespace' => null, // The namespace for the key vault collection (e.g., "encryption.__keyVault")
864+ 'kmsProvider' => [ // Configuration for Key Management System provider
865+ // e.g., ['type' => 'local', 'key' => 'YOUR_BASE64_KEY']
866+ // e.g., ['type' => 'aws', 'accessKeyId' => '...', 'secretAccessKey' => '...']
867+ ],
868+ 'schemaMap' => [], // Document schemas for explicit encryption
869+ 'encryptedFieldsMap' => [], // Map of collections to their encrypted fields configuration
870+ 'extraOptions' => [ // Extra options for mongocryptd
871+ // 'cryptSharedLibPath' => null, // Path to the crypt_shared library
872+ // 'cryptSharedLibRequired' => false, // If true, fails if the crypt_shared library cannot be loaded
873+ ],
874+ 'bypassQueryAnalysis' => false, // Disables automatic analysis of read and write operations for encryption
875+ 'tlsOptions' => [ // TLS options for the Key Vault client (if keyVaultClient is not specified)
876+ // 'tlsCAFile' => null, // Path to CA file, e.g., /path/to/key-vault-ca.pem
877+ // 'tlsCertificateKeyFile' => null, // Path to client cert/key file, e.g., /path/to/key-vault-client.pem
878+ // 'tlsCertificateKeyFilePassword' => null, // Password for client cert/key file
879+ // 'tlsAllowInvalidCertificates' => false, // Bypass server certificate validation (use with caution)
880+ // 'tlsAllowInvalidHostnames' => false, // Bypass server hostname validation (use with caution)
881+ // 'tlsDisableCertificateRevocation' => false, // Disable CRL checks
882+ // 'tlsDisableOCSPEndpointCheck' => false, // Disable OCSP checks
883+ // 'tlsInsecure' => false, // Allow invalid/no server cert (use with extreme caution)
884+ ],
830885 ])
831886 ->options([
832887 'authMechanism' => null,
0 commit comments