MongoDB Documentation, Release 3.0.4 Step 3: Create the system user administrator. Add the user with the userAdminAnyDatabase (page 412) role, and only that role. The following example creates the user siteUserAdmin user on the admin database: After you create the user administrator, the localhost exception (page 324) is no longer available. The mongo shell executes a number of commands at start up. As a result, when you log in as the user administrator, you may see authentication errors from one or more commands. You may ignore these errors, which are expected, because the userAdminAnyDatabase (page 412) role does not have permissions to run some of the start up commands. Step 4: Create additional users. Login in with the user administrator’s credentials and create additional users. See Add a User to a Database (page 386). If you need to disable access control for any reason, restart the process without the authorization or keyFile setting. New in version 2.0: Support for authentication with sharded clusters. When authentication is enabled on a sharded cluster, every client that accesses the cluster must provide credentials. This includes MongoDB instances that access each other within the cluster. To enable authentication on a sharded cluster, you must enable authentication individually on each component of the cluster. This means enabling authentication on each mongos and each mongod , including each config server, and all members of a shard’s replica set. Authentication requires an authentication mechanism and, in most cases, a key file . The content of the key file must be the same on all cluster members. It is not possible to convert an existing sharded cluster that does not enforce access control to require authentication without taking all components of the cluster offline for a short period of time. As described in Localhost Exception (page 324), the localhost exception will apply to the individual shards unless you either create an administrative user or disable the localhost exception on each shard. Overview Considerations Enable Authentication in a Sharded Cluster Next Steps use admin db.createUser( { user: "siteUserAdmin", pwd: "password", roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] } ) Chapter 6. Security 358