When and how to create users in a MongoDB sharded cluster

Question

I hope my question is clear enough.

I'm setting up a sharded cluster, 3 members, each running as a replica set. So, on each shard there are 3 mongod running as replica sets.

My question is what should be the time during the setup process to create users&roles and on what instance of mongod? I know about the localhost exception on a mongo db deployment, but it's not clear from the documentation what would be the best way to do it in a sharded cluster.

I have the following users:

1. useradmin -> able to create new users only -> role userAdminAnyDatabase (to create new users)
2. manager -> use to manage the cluster -> role clusterAdmin
3. root -> root access/roles -> role root
4. appuser -> role readWriteAnyDatabase

So the options I see are:

1. On each replica set mongod, using localhost exception, before it's added to the sharded cluster, add all users from above?
2. At the end of setup, only once in the config replica set?
3. At the end, connecting to the sharded cluster?
4. Create initial users only with createUser role on each mongodbs and then create the others connecting at the end to the sharded cluster?

I did using 1st option, but I feel something is not right.

Answer 1

Tutorial Deploy Sharded Cluster with Keyfile Authentication provides a step-by-step setup for a sharded cluster with authentication, i.e. creating users.

The general procedure is this:

1. Deploy the entire sharded cluster completely without any user accounts.
2. When the cluster is complete connect to one mongos (using localhost exception) and create the user accounts. The accounts will be available in the entire cluster.
3. Connect locally to each shard (i.e. the PRIMARY node, using localhost exception) and create the "shard-local administrator" accounts.

Step 2 and 3 you can exchange, if you like.

What is a "shard-local administrator" account?

User accounts are (usually) defined in the admin database of the Config Servers. When a client connects to the cluster then it queries the config server to validate the credentials. Some operational tasks on the shard servers requires a direct (i.e. local) connection to the shard server, sometimes they are even disconnected from the cluster. A disconnected shard node cannot query the Config Server in order to validate any credentials.

For this reason you have to create the "shard-local administrator" accounts on each shard. With this account you can connect locally to the shard server and perform some maintenance operations even when it is not connected to the cluster. The accounts are created on the PRIMARY nodes and they are replicated to the SECONDARIES.

The "shard-local administrator" accounts are needed only for some operational task, your application does not require any of them.

The Config Server does not have such local accounts, because local users are equal to cluster users. You can use the cluster user credential also to connect directly (i.e. locally) to a Config server.

The mongos does not have such local accounts either. The mongos does not store any data locally, thus operational tasks mentioned above does not exist and local accounts are not required nor possible.

When you add new shard replica sets then you also have to create the "shard-local administrator" accounts on them. However, it does not matter when you create it, because they are fully independent from any cluster user.