The administrator of the database is the right person for the task of granting, or denying, permissions to users for doing operations with database resources. By using roles, we can specify what action can be done with a resource. Therefore, a role is a privilege granted to a user to do specific tasks with specific resources. Before you enable access control, you should create a user that can then create users and assign roles to them once access control is enabled.This user-admin will then be used to create and maintain other users and roles, so needs to be assigned a suitable role to enable it to do so.
I assume you already have admin user set up within you system if not refer hare before proceeding.
The role userAdminAnyDatabase in MongoDB gives ability to create users and assign roles to them, but by itself it doesn’t allow the user to do anything else. The superuser role in MongoDB is the root.
In the this post i will show how to create, show and delete a user in MongoDB. I will also show how to create a user with root (superuser) privileges on the all databases in MongoDB.
Shell into mongodb with the admin user
mongo -u admin -p --authenticationDatabase admin --host 192.168.0.250
MongoDB shell version v4.0.10
Enter password:
> use admin
switched to db admin
> show users -- Show users in the current database:
{
"_id" : "admin.admin",
"userId" : UUID("6e316f61-9cf3-42f5-9998-dcd5da0559f4"),
"user" : "admin",
"db" : "admin",
"roles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
}
],
"mechanisms" : [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}Create user called
farmtest, with read access to database farm, read and write access to farm-dev
> use farm-dev -- Switch to the database in which you would like to create a common user
switched to db farm-dev
> db.createUser(
... {
... user: "farmtest",
... pwd: "pass123",
... roles: [
... { role: "read", db: "farm" }, --- different permissions on different databases.
... { role: "readWrite", db: "farm-dev" }
... ]
... }
... );
Successfully added user: {
"user" : "farmtest",
"roles" : [
{
"role" : "read",
"db" : "farm"
},
{
"role" : "readWrite",
"db" : "farm-dev"
}
]
}connect to remote MongoDB server from the command line using mongo shell with the
farmtest user.
mongo -u farmtest -p --authenticationDatabase farm-dev --host 192.168.0.250
MongoDB shell version v4.0.10
Enter password:
connecting to: mongodb://192.168.0.250:27017/?authSource=farm-dev&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("564c14a4-52ac-407c-98a3-670a9fc95697") }
MongoDB server version: 4.0.10
>Note: if you want to use MongoDB client, we must use a connection string like this:
module.exports = {mongoURI: 'mongodb://farmtest:pass123@192.168.0.250/farm-dev'}Create
mongo-root user:
use admin
switched to db admin
> db.createUser(
... {
... user: "mgroot",
... pwd: "Passw0rd",
... roles: [ { role: "root", db: "admin" } ]
... }
... )
Successfully added user: {
"user" : "mgroot",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
]
}Delete a user from the current database:
> db.dropUser("user1")