Connect to MongoDB without auth (initial setup)

If authentication isn't enabled yet, connect to create the first admin user:

# Connect to MongoDB
mongosh

# Or with older mongo shell
mongo

If MongoDB Atlas, skip to step 4 - Atlas handles this automatically.

Create an admin user

In the admin database, create a user with full privileges:

// Switch to admin database
use admin

// Create admin user
db.createUser({
  user: "adminUser",
  pwd: passwordPrompt(),  // Prompts for password (more secure)
  roles: [
    { role: "userAdminAnyDatabase", db: "admin" },
    { role: "readWriteAnyDatabase", db: "admin" },
    { role: "dbAdminAnyDatabase", db: "admin" },
    { role: "clusterAdmin", db: "admin" }
  ]
})

// Or with explicit password (less secure, avoid in scripts)
db.createUser({
  user: "adminUser",
  pwd: "yourStrongPassword123!",
  roles: ["root"]
})

Enable authentication in MongoDB config

Edit the MongoDB configuration file:

# Location varies by OS:
# Linux: /etc/mongod.conf
# macOS (Homebrew): /usr/local/etc/mongod.conf
# Windows: C:\Program Files\MongoDB\Server\{version}\bin\mongod.cfg

# Add or modify security section:
security:
  authorization: enabled

Restart MongoDB:

# Linux
sudo systemctl restart mongod

# macOS
brew services restart mongodb-community

# Windows
net stop MongoDB && net start MongoDB

Create application-specific users

Connect as admin and create a user for your application:

# Connect with admin credentials
mongosh -u adminUser -p --authenticationDatabase admin

# In the shell:
use myappdb

// Create app user with minimal permissions
db.createUser({
  user: "myapp",
  pwd: passwordPrompt(),
  roles: [
    { role: "readWrite", db: "myappdb" }
  ]
})

// For read-only access (reporting, analytics)
db.createUser({
  user: "myapp_readonly",
  pwd: passwordPrompt(),
  roles: [
    { role: "read", db: "myappdb" }
  ]
})

Update your application connection string

Add authentication to your MongoDB connection:

// Connection string format
mongodb://username:password@host:port/database?authSource=admin

// Example for local development
mongodb://myapp:mypassword@localhost:27017/myappdb

// With options
mongodb://myapp:mypassword@localhost:27017/myappdb?authSource=myappdb&retryWrites=true

// In Node.js with Mongoose
import mongoose from 'mongoose';

await mongoose.connect(process.env.MONGODB_URI, {
  // Connection options are included in the URI
});

// Or with explicit options
await mongoose.connect('mongodb://localhost:27017/myappdb', {
  user: process.env.MONGO_USER,
  pass: process.env.MONGO_PASSWORD,
  authSource: 'myappdb'
});

Set up role-based access for teams

Create custom roles for different access levels:

use myappdb

// Create a custom role for developers
db.createRole({
  role: "developer",
  privileges: [
    {
      resource: { db: "myappdb", collection: "" },
      actions: ["find", "insert", "update", "createIndex"]
    }
  ],
  roles: []
})

// Create developer user
db.createUser({
  user: "dev_john",
  pwd: passwordPrompt(),
  roles: [{ role: "developer", db: "myappdb" }]
})

// Create a read-only role for analytics
db.createRole({
  role: "analyst",
  privileges: [
    {
      resource: { db: "myappdb", collection: "" },
      actions: ["find", "listCollections"]
    }
  ],
  roles: []
})