updateUser

Definition

updateUser

Updates the user's profile on the database on which you run the command. An update to a field completely replaces the previous field's values, including updates to the user's roles and authenticationRestrictions arrays.

Tip

In mongosh, this command can also be run through the db.changeUserPassword() helper method.

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.

Warning

When you update the roles array, you completely replace the previous array's values. To add or remove roles without replacing all the user's existing roles, use the grantRolesToUser or revokeRolesFromUser commands.

To update a user, you must specify the updateUser field and at least one other field, other than writeConcern.

Compatibility

This command is available in deployments hosted in the following environments:

• MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB

• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB

Syntax

The command uses the following syntax:

 db.runCommand(
    {
      updateUser: "<username>",
      pwd: passwordPrompt(),      // Or  "<cleartext password>"
      customData: { <any information> },
      roles: [
        { role: "<role>", db: "<database>" } | "<role>",
        ...
      ],
      authenticationRestrictions: [
         {
           clientSource: ["<IP>" | "<CIDR range>", ...],
           serverAddress: ["<IP>", | "<CIDR range>", ...]
         },
         ...
      ],
      mechanisms: [ "<scram-mechanism>", ... ],
      digestPassword: <boolean>,
      writeConcern: { <write concern> },
      comment: <any>
    }
)

Command Fields

The command takes the following fields:

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior

Required Access

You must have access that includes the revokeRole action on all databases in order to update a user's roles array.

You must have the grantRole action on a role's database to add a role to a user.

To change another user's pwd or customData field, you must have the changePassword and changeCustomData actions respectively on that user's database.

To modify your own password and custom data, you must have privileges that grant changeOwnPassword and changeOwnCustomData actions respectively on the user's database.

Example

Given a user appClient01 in the products database with the following user info:

{
   "_id" : "products.appClient01",
   "userId" : UUID("c5d88855-3f1e-46cb-9c8b-269bef957986"),
   "user" : "appClient01",
   "db" : "products",
   "customData" : { "empID" : "12345", "badge" : "9156" },
   "roles" : [
       { "role" : "readWrite",
         "db" : "products"
       },
       { "role" : "read",
         "db" : "inventory"
       }
   ],
   "mechanisms" : [
      "SCRAM-SHA-1",
      "SCRAM-SHA-256"
   ]
}

The following updateUser command completely replaces the user's customData and roles data:

use products
db.runCommand( {
   updateUser : "appClient01",
   customData : { employeeId : "0x3039" },
   roles : [ { role : "read", db : "assets" } ]
} )

The user appClient01 in the products database now has the following user information:

{
   "_id" : "products.appClient01",
   "userId" : UUID("c5d88855-3f1e-46cb-9c8b-269bef957986"),
   "user" : "appClient01",
   "db" : "products",
   "customData" : { "employeeId" : "0x3039" },
   "roles" : [
       { "role" : "read",
         "db" : "assets"
       }
   ],
   "mechanisms" : [
      "SCRAM-SHA-1",
      "SCRAM-SHA-256"
   ]
}