MongoDB Documentation, Release 3.0.4 The privileges array lists the privileges that the appAdmin role specifies. This role has a single privilege that permits its actions ( "insert" , "dbStats" , "collStats" , "compact" , "repairDatabase" ) on all the collections in the myApp database excluding its system collections. See Specify a Database as Resource (page 418). The roles array lists the roles, identified by the role names and databases, from which the role appAdmin inherits privileges. system.users Collection Changed in version 2.6. The system.users collection in the admin database stores user authentication (page 320) and authorization (page 324) information. To manage data in this collection, MongoDB provides user management commands . The documents in the system.users collection have the following schema: system.users Schema { _id: <system defined id>, user: "<name>", db: "<database>", credentials: { <authentication credentials> }, roles: [ { role: "<role name>", db: "<database>" }, ... ], customData: <custom information> } Each system.users document has the following fields: admin.system.users. user The user (page 416) field is a string that identifies the user. A user exists in the context of a single logical database but can have access to other databases through roles specified in the roles (page 416) array. admin.system.users. db The db (page 416) field specifies the database associated with the user. The user’s privileges are not necessarily limited to this database. The user can have privileges in additional databases through the roles (page 416) array. admin.system.users. credentials The credentials (page 416) field contains the user’s authentication information. For users with externally stored authentication credentials, such as users that use Kerberos (page 372) or x.509 certificates for authentica- tion, the system.users document for that user does not contain the credentials (page 416) field. admin.system.users. roles The roles (page 416) array contains role documents that specify the roles granted to the user. The array contains both built-in roles (page 405) and user-defined role (page 325). A role document has the following syntax: { role: "<role name>", db: "<database>" } A role document has the following fields: admin.system.users.roles[n]. role The name of a role. A role can be a built-in role (page 405) provided by MongoDB or a custom user-defined role (page 325). Chapter 6. Security 416