Overview

Users and roles in Mongo are per databases. Meaning if you want to create a user in a certain database, you have to use that database as follows:

User Management

Like any other database we can:

Create user

Delete user

Reset password

Assign roles to user

Create User

User can be created as follows:

This command will create user called test in database hunter_dev(it will be authenticated by this database) and owner of the database.

If you want a user with a DBA owner privileges you can use the following script:

You can select all users from the database and collection: system.users as follows:

Or if you know the username you can also user:

Other way to see all the users authenticated to a certain database is to use the following command: Show users as follows:

Reset password

Password reset depends on the version:

For Mongo <3.X

For Mongo >=3.X

Authentication

Authentication is disabled by default, but you can enable it in the configuration file. Again depending on the version:

Less then 3.X: Add the “auth” parameter

Higher than 3.X: Add the following paramer:

In order to authenticate yourself you can:

Login with username and password

Authenticate once connected

Roles

Mongo has also some system roles. In nutshell, a user can be owned of a database, have readwrite accesses and have access to all databases. Roles are set during user creation:

Setting a role in the admin database, usually carries higher priority and rights and setting role in other databases. More information about roles you can check below:

Superuser Roles

Several roles provide either indirect or direct system-wide superuser access.

The following roles provide the ability to assign any user any privilege on any database, which means that users with one of these roles can assign themselves any privilege on any database:

dbOwner role, when scoped to the admin database

userAdmin role, when scoped to the admin database

userAdminAnyDatabase role

Upgrade authentication schema

In order to upgreade the authentication schema, the following requirements are needed:

Server is at least 3.4 and less than 4.0

There is a user with the “userAdminAnyDatabase” role in the admin database

If these two requirments are met, you can perform the following command from that user: