Enable Authentication in MongoDB (Self-Managed)

This guide explains how to correctly enable MongoDB authentication in a self-managed environment. It covers admin user creation, authorization configuration, login verification, and least-privilege application users, following current MongoDB best practices.

1) Create an Admin User (Before Enabling Authorization)

MongoDB authentication must be bootstrapped by creating the first administrative user before authorization is enabled. This user will be responsible for managing databases, users, and roles.

Start by opening the MongoDB Shell locally:

mongosh

mongosh is the official MongoDB Shell (replacing the legacy mongo shell). All commands below are compatible with MongoDB 6.x and 7.x.

Switch to the admin database. MongoDB stores global authentication metadata in this database. Failing to run use admin will create the user in the wrong database and cause authentication failures later due to an incorrect authSource.

use admin

db.createUser({
  user: "siteAdmin",
  pwd:  "CHANGE_ME_STRONG_PASSWORD",
  roles: [
    { role: "userAdminAnyDatabase", db: "admin" },
    { role: "readWriteAnyDatabase", db: "admin" }
  ]
})

Parameter explanation:

• user: Username used for authentication.
• pwd: User password (use a strong, unique password).
• userAdminAnyDatabase: Allows managing users and roles across all databases.
• readWriteAnyDatabase: Allows read/write access to all databases.

This role combination is commonly used for a general-purpose MongoDB administrator.

If you prefer a clearly defined super-admin account, use the built-in root role:

use admin

db.createUser({
  user: "root",
  pwd:  "CHANGE_ME_STRONG_PASSWORD",
  roles: [ { role: "root", db: "admin" } ]
})

The root role grants full administrative privileges and must never be used by applications.

2) Enable Authorization in mongod.conf

After creating at least one admin user, enable authorization. Edit the MongoDB configuration file (commonly /etc/mongod.conf) and add the following section:

security:
  authorization: enabled

authorization: enabled forces MongoDB to require authentication for all client connections.

3) Restart MongoDB

Restart MongoDB to apply the configuration change:

sudo systemctl restart mongod
sudo systemctl status mongod

After restarting, MongoDB will reject all unauthenticated connections.

4) Verify Authentication

Log in using the admin user created earlier. The authentication database must be explicitly specified.

mongosh --username siteAdmin --password --authenticationDatabase admin

If login succeeds, MongoDB authentication is correctly configured.

5) Create an Application User (Least Privilege)

Applications should never use admin credentials. Instead, create a dedicated user with access limited to the required database.

Example: an application that uses the myapp database with read/write access:

use myapp

db.createUser({
  user: "myapp_rw",
  pwd:  "CHANGE_ME_STRONG_PASSWORD",
  roles: [ { role: "readWrite", db: "myapp" } ]
})

This user can only read and write data inside the myapp database.

For read-only access:

use myapp

db.createUser({
  user: "myapp_ro",
  pwd:  "CHANGE_ME_STRONG_PASSWORD",
  roles: [ { role: "read", db: "myapp" } ]
})

6) Correct Connection String (authSource)

The authSource parameter must match the database where the user was created.

Example for a user created in myapp:

mongodb://myapp_rw:[email protected]:27017/myapp?authSource=myapp

Admin users created in admin must use authSource=admin.

Common Issues

Authentication failed
Usually caused by:

• Incorrect authSource
• User created in an unexpected database

Locked out after enabling authorization
Authorization was enabled before creating an admin user.
Fix: temporarily disable authorization, restart MongoDB, create the admin user, then enable authorization again.