How to allow creation and deletion of a database or collections with user and password

Question

I created a user with the role of userAdminAnyDatabase

db.createUser({user: "Username", pwd: "password", roles: [{role: "userAdminAnyDatabase", db: "admin"}]})

and also user with the role of userAdmin for a single db in the mongo shell.

db.createUser({user: "Username", pwd: "password", roles: [{role: "userAdmin", db: "myDB"}]})

But when I create or delete collections in myDB it's not asking me for the user name or password. What is the point of creating a user then?

I want the creation and deletion of databases and collections only when I give in the admin credentials.

Answer 1

No, system don't work that way. You must enable authentication and authorization of your mongodb.

After that, you log in with userAdmin credentials and you (only) have authorization to do userAdmin work, not system admin work. But remember to create super-admin user (before enabling authenticaton) or you end up to situation that you don't have superuser (root) who can give other needed rights.