MongoDB User
Login via MongoSH
General login
mongosh -u <username> -p --authenticationDatabase <database>
Login as Admin
root@42c2a9506877:/# mongosh -u <admin-username> -p --authenticationDatabase admin
Enter password: ************************
Current Mongosh Log ID: 66093baf14becfa04bdb83af
Connecting to: mongodb://<credentials>@127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&
...
test>
OR promt credentials later
Login without permissions and authenticate inside mongo-shell
root@42c2a9506877:/# mongosh
Current Mongosh Log ID: 66093e1e11b8bf37abdb83af
Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+2.2.0
Using MongoDB: 7.0.7
Using Mongosh: 2.2.0
For mongosh info see: https://docs.mongodb.com/mongodb-shell/
test> use admin
switched to db admin
admin> db.auth("<username>", passwordPrompt())
Enter password
************************{ ok: 1 }
admin>
Show users and credentials
Show users
admin> db.system.users.find()
[
{
_id: '<databasename>.<username>',
userId: UUID('76334351-ae44-4ef8-917b-c6ae57f56518'),
user: '<username>',
db: '<databasename>',
credentials: {
'SCRAM-SHA-1': {
iterationCount: 10000,
salt: 'ANYHASHpkIZJx7EYVMdHhRzZ2Ej6lXG==',
storedKey: 'ANYOTHERHASHpkIZJx7EYVMdHhRzZ2Ej6lXG=',
serverKey: 'ANYFURTHERHASHpkIZJx7EYVMdHhRzZ2Ej6lXG='
},
'SCRAM-SHA-256': {
iterationCount: 15000,
salt: 'ANYHASHpkIZJx7EYVMdHhRzZ2Ej6lXG==',
storedKey: 'ANYOTHERHASHpkIZJx7EYVMdHhRzZ2Ej6lXG=',
serverKey: 'ANYFURTHERHASHpkIZJx7EYVMdHhRzZ2Ej6lXG='
}
},
roles: [ { role: 'readWrite', db: '<databasename>' } ]
},
...
]
admin>
Show credentials of a user in a database
admin> use <database>
switched to db <database>
<database>> db.getUser("reportsUser")
null
<database>> db.getUser("<username>")
{
_id: '<database>.<username>',
userId: UUID('76324351-ae44-4ef8-917b-c6ae57f57518'),
user: '<username>',
db: '<database>',
roles: [ { role: 'readWrite', db: '<database>' } ],
mechanisms: [ 'SCRAM-SHA-1', 'SCRAM-SHA-256' ]
}
Create User via MongoSH
Create new user with password promt
db.createUser(
{
user: "<username>",
pwd: passwordPrompt(),
roles: [ { role: "readWrite", db: "<database-1>" }, (1)
{ role: "read", db: "<database-2>" } ] (2)
}
)
| 1 | Read and Write permissions |
| 2 | Read only permissions |
Permission |
Read access |
ReadWrite access |
find |
✓ |
✓ |
insert |
✓ |
|
changeStream |
✓ |
✓ |
convertToCapped |
✓ |
|
dbHash |
✓ |
✓ |
collStats |
✓ |
✓ |
dbStats |
✓ |
✓ |
createCollection |
✓ |
|
listCollections |
✓ |
✓ |
dropCollection |
✓ |
|
renameCollectionSameDB |
✓ |
|
createIndex |
✓ |
|
listIndexes |
✓ |
✓ |
dropIndex |
✓ |
|
createSearchIndexes |
✓ |
|
listSearchIndexes |
✓ |
✓ |
updateSearchIndex |
✓ |
|
dropSearchIndex |
✓ |
|
update |
✓ |
|
remove |
✓ |
|
killCursors |
✓ |
✓ |
further built-in user roles and permissions information see https://www.mongodb.com/docs/manual/reference/built-in-roles/#std-label-self-hosted-built-in-roles