04 Apr 2018

Enabling Authentication by Adding Users to MongoDB

MongoDB 0 Comment

Enabling access control on a MongoDB deployment enforces authentication, requiring users to identify themselves. When accessing a MongoDB deployment that has access control enabled, users can only perform actions as determined by their roles.

With access control enabled, ensure you have a user with userAdmin or userAdminAnyDatabase role in the admin database. This user can administrate users and roles such as: create users, grant or revoke roles from users, and create or modify customs roles.

You can create users either before or after enabling access control. If you enable access control before creating any user, MongoDB provides a localhost exception which allows you to create a user administrator in the admin database.

Once created, you must authenticate as the user administrator to create additional users as needed.

First we will look at starting the MongoDB server and client without access control:

Starting MongoDB Server:

Starting MongoDB client:

Note: If we want to provide any command line options, for example port number, host etc., we can provide. For more command line options check here or type mongod –help from command prompt to get options.

Creating User Administrator:

In the admin database, add a user with the userAdminAnyDatabase role. For example, the following creates the user myUserAdmin in the admin database

Start the MongoDB instance with access control:

Start the mongod instance with the –auth command line option or, if using a configuration file, the security.authorization setting.

Note: Clients that connect to this instance must now authenticate themselves as a MongoDB user. Clients can only perform actions as determined by their assigned roles.

Connect and authenticate as the user administrator:

Using the mongo shell, you can:

  • Connect with authentication by passing in user credentials, or
  • Connect first without authentication, and then issue the db.auth() method to authenticate.

To authenticate during connection:

Start a mongo shell with the -u <username>, -p <password>, and the –authenticationDatabase <database> command line options:

To authenticate after connecting:

Connect the mongo shell:

Switch to the authentication database (in this case, admin):

and use db.auth(<username>,<pwd>) method to authenticate as following:

Create additional users as needed for your deployment:

Once authenticated as the user administrator, we can create any number of users. Use db.createUser() to create additional users. You can assign any built-in roles or user-defined roles to the users.

The myUserAdmin user only has privileges to manage users and roles. As myUserAdmin, if you attempt to perform any other operations, such as read from a foo collection in the test database, MongoDB returns an error.

The following operation adds a user myTester to the test database who has readWrite role in the test database as well as read role in the reporting database.

We can connect to test database with the myTester user like as we discussed for admin database.

Note: The database where you create the user is the user’s authentication database. Although the user would authenticate to this database, the user can have roles in other databases; i.e. the user’s authentication database does not limit the user’s privileges.

Thank You 🙂