Enable Access Control

Start MongoDB without access control.

Start a standalone mongod instance without access control.

Open a terminal and run the following command as the mongod user:

mongod --port 27017 --dbpath /var/lib/mongodb

The mongod instance in this tutorial uses port 27017 and the /var/lib/mongodb data directory.

The tutorial assumes that the /var/lib/mongodb directory exists and is the default dbPath. You may specify a different data directory or port as needed.

Connect to the instance.

For example, open a new terminal and connect a mongo shell to the instance:

mongo --port 27017 

Specify additional command line options as appropriate to connect the mongo shell to your deployment, such as --host.

Create the user administrator.

From the mongo shell, add a user with the userAdminAnyDatabase role in the admin database. Include additional roles as needed for this user. For example, the following creates the user myUserAdmin in the admin database with the userAdminAnyDatabase role and the readWriteAnyDatabase role.

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
  }
)

Re-start the MongoDB instance with access control.

1. Shut down the mongod instance. For example, from the mongo shell, issue the following command:

   db.adminCommand( { shutdown: 1 } )

2. Exit the mongo shell.

3. Start the mongod with access control enabled.

   • If you start the mongod from the command line, add the --auth command line option:

     mongod --auth --port 27017 --dbpath /var/lib/mongodb

   • If you start the mongod using a configuration file, add the security.authorization configuration file setting:

     security:
         authorization: enabled

Clients that connect to this instance must now authenticate themselves as a MongoDB user. Clients can only perform actions as determined by their assigned roles.

Connect and authenticate as the user administrator.

Using the mongo shell, you can:

• Connect with authentication by passing in user credentials, or

• Connect first without authentication, and then issue the db.auth() method to authenticate.

mongo --port 27017  --authenticationDatabase "admin" -u "myUserAdmin" -p

mongo --port 27017

use admin
db.auth("myUserAdmin", passwordPrompt()) // or cleartext password

Create additional users as needed for your deployment.

Once authenticated as the user administrator, use db.createUser() to create additional users. You can assign any built-in roles or user-defined roles to the users.

The following operation adds a user myTester to the test database who has readWrite role in the test database as well as read role in the reporting database.

use test
db.createUser(
  {
    user: "myTester",
    pwd:  passwordPrompt(),   // or cleartext password
    roles: [ { role: "readWrite", db: "test" },
             { role: "read", db: "reporting" } ]
  }
)

After creating the additional users, disconnect the mongo shell.

Connect to the instance and authenticate as myTester.

After disconnecting the mongo shell as myUserAdmin, reconnect as myTester. You can:

• Connect with authentication by passing in user credentials, or

• Connect first withouth authentication, and then issue the db.auth() method to authenticate.

mongo --port 27017 -u "myTester" --authenticationDatabase "test" -p

mongo --port 27017

use test
db.auth("myTester", passwordPrompt())  // or cleartext password

Insert a document as myTester.

As myTester, you have privileges to perform read and write operations in the test database (as well as perform read operations in the reporting database). Once authenticated as myTester, insert a document into a collection in test database. For example, you can perform the following insert operation in the test database:

db.foo.insert( { x: 1, y: 1 } )