MongoDB Managing Admin Users

MongoDB uses a different type of methodology when it comes to admin users.

MongoDB contains a database named "admin" where all the admin user details are supposed to be saved. In order to make a new admin user we need to add user to this database.

Creating an Admin User

First we need to disable the auth or keyfile parameter from the mongo conf file (mongod.conf in my machine).

auth = false

Then we need to login to the mongo console and create a user.

$ mongo
MongoDB shell version: 2.4.6
connecting to: test
> db.getSiblingDB('admin')
admin
> db.addUser({user:"username",pwd:"password",roles:["role1","role2","role3"]})
{
    "user" : "USERNAME",
    "pwd" : "f897a429c19697cbd7360b5b84166ad4",
    "roles" : [
        "ROLE1",
        "ROLE2",
        "ROLE3"
    ],
    "_id" : ObjectId("523e2bd28fcbdde1ea258fb5")
}

Authenticating User

To make sure the user we created is successfully created, we can authenticate the user in mongo console:

> db.auth("username","password")

And then query the database to verify the user permissions.

> db.system.users.find()

We can then query other databases, add more users etc. using the created user even after the auth is changed to true. This would ensure that the database cannot be modified without proper credentials.

auth =true

After auth is set as true, we need to pass credentials to use mongo console:

$ mongo -u user -p password --authenticationDatabase admin

Or authenticate after starting the console:

$ mongo
MongoDB shell version: 2.4.6
connecting to: test
> use admin
switched to db admin
> db.auth("admin","admin")
1
> 

Privileges

User privileges or roles ensure the level of control each user have on the database. A superuser with all the rights of database should have following privileges:

roles:{ ["readWriteAnyDatabase", "userAdminAnyDatabase", "dbAdminAnyDatabase", "clusterAdmin"] }

A user with above roles would usually be used to login to an administration tool (e.g. RockMongo) to ensure all the functionality is available.