Creating a User in MongoDB

MongoDB is a document-oriented cross-platform database that makes storing and retrieving complex data easy and fast. It uses a JSON-like structure for the documents, which is familiar to anyone working with modern applications.

With the advent of automated scaling solutions for our cloud environment like AWS Auto Scaling Groups, we need a way for our strongDM inventory to change in real-time along with the underlying servers. The solution: automation automation automation! The devops mindset is key, we want to automate cloud infrastructure so it operates without manual intervention. We can write scripts that hook into instance boot and shutdown events that will automatically adjust our strongDM inventory accordingly.

The examples in this post are written for AWS, but all major cloud providers should provide a similar API for instance information, lifecycle hooks, and metadata-like tags.

Adding a New User

MongoDB provides an internal method, {{code}} db.createUser() {{/code}}, that is used for making new users in the system. Unlike traditional SQL databases, MongoDB users are not global, but tied to what is called an Authentication Database.

From the MongoDB documentation:

The user’s name and authentication database serve as a unique identifier for that user. That is, if two users have the same name but are created in different databases, they are two separate users. If you intend to have a single user with permissions on multiple databases, create a single user with roles in the applicable databases instead of creating the user multiple times in different databases.

Connecting to the Database with the MongoDB Shell

Using the mongo CLI, also known as the mongo shell, connect to your database with the appropriate admin credentials:

mongo --host \
 --port 27017 \
 --username your_admin_user \

Note: To force mongo to prompt for a password, enter the --password option as the last option and leave out the argument.

Adding the User

Use the {{code}} db.createUser() {{/code}} method to add the user to the specified database. Adding a user with options is easy, it’s essentially inserting a {{code}} user {{/code}} document into a NoSQL database!

use reporting               // specify the DB
   user: "reportsUser",
   pwd: passwordPrompt(),  // or cleartext password if you wish
   roles: [
      { role: "read", db: "reporting" },
      { role: "read", db: "products" },
      { role: "read", db: "sales" },
      { role: "readWrite", db: "accounts" }

In the example above, after connecting to the MongoDB instance, we attach to the {{code}} reporting {{/code}} database to execute our {{code}} db.createuser() {{/code}} command. The database that we {{code}} use {{/code}} will act as the user’s Authentication Database.

The username and password are specified as key value pairs in the document we’re using for our method call. Access to databases is granted with roles. Roles are required for a user to access any database, even it’s own Authentication Database! In the example, we grant {{code}} read {{/code}} to three databases, and {{code}} readWrite {{/code}} to a fourth.

It’s that easy!

MongoDB and strongDM

With strongDM, we can abstract-away usernames and passwords from our developers and allow us, the systems administrator, to keep the master passwords in a safe space under lock and key. strongDM provides us central authentication and auditing for all actions against a MongoDB host.

To add a new MongoDB host to strongDM:

  1. Login to the strongDM admin website and select datasources
  2. In the upper right hand part of the screen, click the add datasource button.
  3. Select MongoDB (solo or sharded) from the available list of datasource types.

In this dialog, you’ll configure how your strongDM gateways will connect to the MongoDB database. For this to work properly, you will need to ensure that at least one of your gateways has a network path to the target database system.

  1. Type in a Display Name — this is how the database will show up in the Admin UI and local clients - in the example above, we used ACME Retail Staging.
  2. Enter the hostname or IP address of the target database. Again, this endpoint must be connectable from at least one gateway instance.
  3. The port— in this case, 27017, will be automatically chosen based on you selecting MongoDB as your database type above. If your database is configured to run on a non-standard port, enter this custom port number here.
  4. The Port Override will automatically populate based on other datasources in your ogranization, if you have others. This port is the one that clients will open on engineer’s workstations when they connect to the datasource with the SDM application. You can overwrite it with your own preferred port if you wish, but the default port number is almost always fine.
  5. Type in the Authentication Database. This is the database that the user was created for, and the database that they authenticate against. In our case we created this user with the Authentication Database of acmestaging.

Note:  A user’s privileges are not limited to their authentication database, they can have privileges across as many databases as needed. Using roles, you can give users access to other databases in the system. Configure this as you wish, but keeping users’ acces scoped as small as possible aligns with The Principle of Least Privilege.

  1. Type in the Username that the relay will be connecting to the database with; in this case, acmestage.
  2. Type in the Password for the user.
  3. If your MongoDB database is configured to require TLS, check the box to have the strongDM gateway negotiate a secure connection.

After you hit Create, your engineers will immediately have access to connect to this database, and any other that this user has access to, via their strongDM app.