Video Transcript (English)

Enabling authentication is one of the first security measures that you should take to protect your MongoDB deployment.

Authentication is important because it ensures that only users with valid credentials can connect to the database.

In this video, you’ll learn how to enable authentication on a self-managed MongoDB deployment by using MongoDB’s default authentication mechanism.

MongoDB supports numerous authentication mechanisms, managed within the database and managed through integration with organization-wide identity management systems.

The default authentication mechanism in MongoDB is SCRAM, or the Salted Challenge Response Authentication Mechanism.

SCRAM verifies the identity of a user by exchanging a challenge and response that are protected by a cryptographic key. This makes it difficult for attackers to gain unauthorized access to a database.

Let’s go through the process of enabling authentication on a standalone MongoDB instance by using SCRAM.

For this example, we’ve already started a standalone `mongod` process.

We’ve also downloaded and installed the MongoDB Shell, or mongosh, on the same host machine.

First, we enable access control by updating the `mongod` configuration file.

Enabling access control on a MongoDB deployment enforces authentication.

With access control enabled, users must authenticate themselves and can only access database resources and perform actions as allowed by their roles.

We open the configuration file and add the `security.authorization` configuration file setting to enable access control. Then we save the file.

We restart the `mongod`, now with access control enabled.

We now connect to the `mongod` with `mongosh`.

While we’ve enabled access control, we’re able to connect to the `mongod` without authenticating because of the localhost exception.

The localhost exception allows you to connect to a MongoDB instance running on the localhost interface without authenticating as long as you haven’t yet created any users or roles in the MongoDB instance.

By connecting with the localhost exception, you’re able to create the first user, which you then use to create all other users.

Now that we’re connected to the `mongod`, we’re ready to create the first user, the user administrator.

The user administrator is responsible for managing all users and roles that are allowed to access the database. It should be the first user that you create on any database.

The user administrator must be created on the `admin` database. We switch to the `admin` database by using the `use admin` command.

We use the `db.createUser` method, and set the username to `globalUserAdmin`. We’re using the passwordPrompt() user management method so that we’ll be prompted for the password in `mongosh` rather than having to specify it in cleartext. This is a more secure approach to entering passwords because the password isn’t displayed in the shell when you’re creating the user.

Lastly, we assign the “userAdminAnyDatabase” role to the user administrator.

We enter a password for globalUserAdmin at the prompt.

userAdminAnyDatabase is a built-in MongoDB system superuser role that allows the user to create and modify users and roles, among other privilege actions.

This role is often assigned to the user administrator.

Now that we’ve created the user administrator, we quit the current shell session.

We’ve enabled access control and created a user administrator, so now we’ll connect to the `mongod` again to authenticate as the user administrator.

Note that to connect to a MongoDB deployment that requires authentication, we need to start `mongosh` with the username command line option.

We run the operation and enter globalUserAdmin’s password when prompted.

Great, we’re connected to the `mongod` as the user administrator.

As a final step, we want to verify that the user administrator is currently the only database user.

First, we switch to the `admin` database.

Then we query for all users in the `admin` database by using the `db.getUsers` user management method.

We see that the globalUserAdmin with the role `userAdminAnyDatabase` is currently the only user on the database.

Now that we’ve enabled authentication and set up the user administrator, we can create additional users and assign them roles.

In this video, you learned how to enable authentication on a standalone `mongod` instance by using SCRAM, MongoDB’s default authentication mechanism.

You also learned that `userAdminAnyDatabase` is a built-in superuser role that can create and manage other users and roles across databases.

This role is often assigned to the user administrator.