MongoDB – Enable User Authentication

authenticationmongodb

We are at Mongo 3.2. We deployed our first app with mongo without user authentication in db schema.
Now we want to enable authentication at db level but want to avoid application downtime doing the same.
Is it possible in Mongo that we enable this authentication at DB level to avoid anyone to log in and run commands through console.

Application should not take down time.

Best Answer

MongoDB 3.2 and earlier require downtime and a coordinated restart of your deployment and application to enable access control: all clients and members of a deployment must use authentication once enabled. There is a localhost exception that allows you to create the first user on the admin database after authentication is enabled.

With planning this can be a relatively quick process, but to minimize potential downtime I strongly recommend first testing in a representative staging environment.

Enabling access control and authentication is an obvious security measure but still leaves you vulnerable to other possible attacks. For example, you should also Configure TLS/SSL to secure your network communication and restrict remote network access via firewall or perhaps a VPN/VPC between your application servers and your MongoDB deployment.

For a full list of security measures and links to relevant tutorials, see the Security Checklist in the MongoDB manual.

There are several steps that you can test in a staging environment to help ensure the transition goes smoothly, including:

  • Generate a valid keyfile or x.509 certificate for internal authentication between members of your replica set or sharded cluster.
  • Write a JavaScript file to create the initial user administrator and any required user accounts/roles.
  • Ensure that you have properly configured authentication by trying to login without any credentials as well as with valid/invalid credentials.
  • Test external access to your deployment to confirm your firewall configuration.
  • Make sure the MongoDB driver you are using has been updated to support MongoDB 3.2 and that your application is able to successfully login after you have enabled authentication and any other security measures.

MongoDB 3.4 --transitionToAuth

Another option worth mentioning for future consideration (although generally not the fastest path to enabling authentication on an existing deployment) would be upgrading to MongoDB 3.4.

MongoDB 3.4 includes a new --transitionToAuth option that enables a rolling upgrade to authentication; see: Enforce Keyfile Access Control in a Replica Set without Downtime.