Docs Menu
Docs Home
/
MongoDB Cloud Manager
/
Security
/
Secure MongoDB Deployments with Authentication
/
Manage MongoDB Users and Roles

Manage MongoDB Users

On this page

  • Considerations
  • Add One MongoDB User
  • Edit One MongoDB User Details
  • Manage or Unmanage MongoDB Users
  • Remove a MongoDB User

When you select an Authentication Mechanism for your Cloud Manager project, this enables access control for all managed deployments in your Cloud Manager project.

With access control enabled, clients must authenticate to the MongoDB process as MongoDB users. Once authenticated, these users only have privileges granted by their assigned roles. You can assign MongoDB's built-in roles to a user as well as custom roles.

You can create MongoDB users before or after enabling accessing control, but your MongoDB instances do not require user credentials if access control is not enabled.

Important

MongoDB users are separate from Cloud Manager users. MongoDB users have access to MongoDB databases, while Cloud Manager users access the Cloud Manager application itself.

Considerations

Managed Users and Roles

Any users or roles you choose to manage in an Cloud Manager project have their Synced value set to Yes and are synced to all deployments in the project.

Any users or roles you do not choose to manage in an Cloud Manager project have their Synced value set to No and exist only in their respective MongoDB deployments.

Note

If you toggle Synced to OFF after import, any users or roles you create are deleted.

Consistent Users and Roles

If you enforce a consistent set of users and roles in your project, Cloud Manager synchronizes these users and roles across all deployments in that project. Toggle Enforce Consistent Set to choose whether or not to manage one set of users and roles:

Enforce Consistent Set is YES

In a managed project, Cloud Manager grants all of the users and roles access to all deployments. All deployments that the Cloud Manager project manages have the same set of MongoDB users and roles.

Cloud Manager limits the access to users and roles where you set Synced to Yes. Cloud Manager deletes all users and roles that Cloud Manager project doesn't manage from the deployments in your project.

Enforce Consistent Set is NO

In a managed project, Cloud Manager allows each deployment to use its own set of MongoDB users and roles. Cloud Manager doesn't need to manage these MongoDB users and roles. To manage these users and roles, you must connect direct to the MongoDB deployment.

Cloud Manager grants managed MongoDB users and roles where you set Synced to Yes access to all managed deployments.

Cloud Manager limits access of unmanaged MongoDB users and roles, where you set Synced to No, to those users' and roles' specific deployments.

Note

Enforce Consistent Set defaults to NO.

To learn how importing MongoDB deployments can affect managing users and roles, see Automation and Updated Security Settings Upon Import.

Add One MongoDB User

Note

Cloud Manager Uses Default Hashing Iterations for User Credentials

When you create a MongoDB user via Cloud Manager, it uses the default number of iterations for SCRAM-SHA-1 (10,000) and SCRAM-SHA-256 (15,000) to hash user credentials. If you want to use different values, create the user in MongoDB directly.

1

In MongoDB Cloud Manager, go to the Deployment page for your project.

  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. If the Deployment page is not already displayed, click Deployment in the sidebar.

    The Deployment page displays.

2

Go to the Security page.

Click the Security tab for your deployment.

The Security page displays.

3

Click the MongoDB Users tab.

4

Click the Add New User button.

5

Complete the user account fields.

Field
Description
Identifier

  • In the first field, enter the database on which the user authenticates.

  • In the second field, enter a username on that database.

Together, the database and username uniquely identify the user. Though the user has just one authentication database, the user can have privileges on other databases. You grant those privileges when assigning the user roles.

If you are authenticating with an external system, like Kerberos or an LDAP server, add users to the $external database.

Roles
Enter any available user-defined roles and built-in roles into this box. The combo box provides a list of existing roles when you click in it.
Password

Enter the user's password.

IMPORTANT: If you specified $external as the database in the Identifier, you do not need to specify a password for the new user.

Authentication Restrictions

  1. Click Add Entry.

  2. Add one or more IP addresses and/or CIDR blocks in either the Client Source or Server Address boxes. Separate multiple addresses or blocks with commas.

    • Client Source restricts which addresses this user can authenticate and use the given roles.

    • Server Address restricts the addresses this user can authenticate and has the given roles.

  3. Click Save.

  4. To add another entry, click Add Entry.

6

Click Add User.

7

Click Review & Deploy to review your changes.

8

Click Confirm & Deploy to deploy your changes.

Otherwise, click Cancel and you can make additional changes.

Edit One MongoDB User Details

Note

Cloud Manager Uses Default Hashing Iterations for User Credentials

When you edit a MongoDB user via Cloud Manager, it uses the default number of iterations for SCRAM-SHA-1 (10,000) and SCRAM-SHA-256 (15,000) to hash user credentials. If you want to use different values, update the user in MongoDB directly.

1

In MongoDB Cloud Manager, go to the Deployment page for your project.

  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. If the Deployment page is not already displayed, click Deployment in the sidebar.

    The Deployment page displays.

2

Go to the Security page.

Click the Security tab for your deployment.

The Security page displays.

3

Click the MongoDB Users tab.

4

Click Edit next to the user you want to modify.

5

Edit the user's information.

Field
Description
Identifier
These values cannot be edited.
Roles

Enter any available user-defined roles and built-in roles into this box. The combo box provides a list of existing roles when you click in it.

To remove a role, click the x to the left of that role.

Password

Enter the user's password.

IMPORTANT: If you specified $external as the database in the Identifier, you do not need to change this value.

Authentication Restrictions

To add an authentication restriction:

  1. Click Add Entry.

  2. Add one or more IP addresses or CIDR blocks in either the Client Source or Server Address boxes. Separate multiple addresses or blocks with commas.

    • Client Source restricts which addresses this user can authenticate and use the given roles.

    • Server Address restricts the addresses this user can authenticate and has the given roles.

  3. Click Save.

  4. To add another entry, click Add Entry.

To remove an authentication restriction:

  1. Click the x to the right of the authentication restriction.

6

Click Save Changes.

7

Click Review & Deploy to review your changes.

8

Click Confirm & Deploy to deploy your changes.

Otherwise, click Cancel and you can make additional changes.

Manage or Unmanage MongoDB Users

1

In MongoDB Cloud Manager, go to the Deployment page for your project.

  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. If the Deployment page is not already displayed, click Deployment in the sidebar.

    The Deployment page displays.

2

Go to the Security page.

Click the Security tab for your deployment.

The Security page displays.

3

Click the MongoDB Users tab.

4

Click Refresh to discover any unmanaged users in your deployments.

This shows all MongoDB users present in all managed deployments for the Cloud Manager project and any potential conflicts.

5

Select users to manage or unmanage.

Set the Sync switch to Yes for each MongoDB user you want Cloud Manager to manage. To manage all MongoDB users for the Cloud Manager project, click the Sync All link.

Set the Sync switch to No to unmanage the MongoDB user.

Current Sync State
New Sync State
What Changes
NO
YES

Cloud Manager now manages the user.

If there are any potential conflicts with other discovered users, Cloud Manager presents you with the option to resolve the conflicts.

YES
NO

Cloud Manager no longer manages the user.

WARNING: If Ensure Consistent Set is YES, the user is deleted from all MongoDB databases Cloud Manager currently manages for this project.

If Ensure Consistent Set is NO, Cloud Manager no longer manages the users in that MongoDB database, but you can still manage the users through a direct connection to that database.

6

Click Review & Deploy to review your changes.

7

Click Confirm & Deploy to deploy your changes.

Otherwise, click Cancel and you can make additional changes.

8

Click Refresh to verify the desired users have been removed from your deployments.

Remove a MongoDB User

The following procedure deletes the MongoDB user from all the project's managed MongoDB deployments. See also Manage or Unmanage MongoDB Users.

1

In MongoDB Cloud Manager, go to the Deployment page for your project.

  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. If the Deployment page is not already displayed, click Deployment in the sidebar.

    The Deployment page displays.

2

Go to the Security page.

Click the Security tab for your deployment.

The Security page displays.

3

Click the MongoDB Users tab.

4

Set the Ensure Consistent Set toggle to YES.

5

Set the Sync setting for the users to be deleted to OFF.

6

Click Delete next to the user to delete.

7

Click Review & Deploy to review your changes.

8

Click Confirm & Deploy to deploy your changes.

Otherwise, click Cancel and you can make additional changes.

9

Click Refresh to verify the desired users have been removed from your deployments.

Back

Manage MongoDB Users and Roles

Next

Manage Custom Roles