Use SCRAM to Authenticate Clients on Self-Managed Deployments

Start MongoDB without access control

Start a standalone mongod instance without access control.

Open a terminal and run the following command as the mongod user:

mongod --port 27017 --dbpath /var/lib/mongodb

The mongod instance in this tutorial uses port 27017 and the /var/lib/mongodb data directory.

The tutorial assumes that the /var/lib/mongodb directory exists and is the default dbPath. You may specify a different data directory or port as needed.

Connect to the instance

Open a new terminal and connect to the cluster with mongosh:

mongosh --port 27017

If you are connecting to a different deployment, specify additional command line options, such as --host, as needed to connect.

Create the user administrator

Using mongosh:

1. switch to the admin database
2. add the myUserAdmin user with the userAdminAnyDatabase and readWriteAnyDatabase roles":

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [
      { role: "userAdminAnyDatabase", db: "admin" },
      { role: "readWriteAnyDatabase", db: "admin" }
    ]
  }
)

The userAdminAnyDatabase role allows this user to:

• create users
• grant or revoke roles from users
• create or modify customs roles

You can assign your user additional built-in roles or user-defined roles as needed.

The database where you create the user, in this example admin, is the user's authentication database. Although the user needs to authenticate to this database, the user can have roles in other databases. The user's authentication database doesn't limit the user's privileges.

Re-start the MongoDB instance with access control

Shut down the mongod instance. Using mongosh, issue the following command:

db.adminCommand( { shutdown: 1 } )

Exit mongosh.

Start the mongod with access control enabled.

• If you start the mongod from the command line, add the --auth command line option:

  mongod --auth --port 27017 --dbpath /var/lib/mongodb

• If you start the mongod using a configuration file, add the security.authorization configuration file setting:

  security:
      authorization: enabled

Clients that connect to this instance must now authenticate themselves and can only perform actions as determined by their assigned roles.

Connect and authenticate as the user administrator

Using mongosh, you can:

mongosh --port 27017  --authenticationDatabase \
    "admin" -u "myUserAdmin" -p

mongosh --port 27017

use admin
db.auth("myUserAdmin", passwordPrompt()) // or cleartext password