How do I find the creation date of a user in MongoDB?

Question

How do I find the creation date of a user in MongoDB? As background, I'm used to doing this in relational databases like Oracle or MSSQL.

I've checked the admin.system.users table, as I thought I might be able to decode the _id in case it were a generated ObjectID, but no luck there, as it uses the {db}.{username} as the _id.

I could probably stuff the current timestamp into the customData field at user creation, but that would not be as reliable as the data dictionary queries I'm used to from the RDBMS cousins. I would need to make sure all other DBAs follow the practice (not too hard, but prone to human error), but also make sure any 3rd party tools that do user administration (IDM) functionality follow suit (not easy).

Answer 1

As at MongoDB 3.2, you are correct that the admin.system.users collection does not maintain metadata such as created or modified timestamps.

You can add metadata manually using customData, but as you noted this requires coordination with any applications or tools that are allowed to create users in your MongoDB deployment:

use admin
db.createUser({
     user: "bobbytables",
     pwd: "CorrectHorseBatteryStaple",
     customData: { created: new Date() },
     roles: [
        { role: "readWrite", db: "accounts" }
     ]
  })

Ideally this sort of metadata would be maintained by the database server in a standard format that tools could also choose to interpret. There is a relevant open feature request that you can watch/upvote: SERVER-10021: Add timestamps to user documents.

If you are using MongoDB Enterprise there are a few extra features that may help you with a workaround in the interim:

• You can use an external authentication mechanism that maintains metadata for users, such as Kerberos or LDAP.

• You could potentially enable auditing to capture createUser and updateUser events, and write an admin script to update the customData accordingly.