The documents are confusing me a little bit and I'm not finding any answers on here or google. I'm using my own auth via passport-local-mongoose, so I don't need to use mongo's auth at all.

The docs say that I should create a new user for each user/application. Does this mean I create a user for each entry point, ie: one for mobile app, one for web service api, and then an admin for management?

Or does this mean I need to make a new user for every single person who signs up on my site/app?

Every interaction with entry points (other than user registration) requires auth already, so creating a separate mongo user for every registered user seems redundant, however this is my first database so I'm not sure how things work as far as logging or security best practices.

It is worth noting that I am currently storing users as collections with embedded documents for their data for easy lookup per user.

2 Answers 2


As per MongoDB BOL Role-Based Access Control MongoDB employs Role-Based Access Control (RBAC) to govern access to a MongoDB system. A user is granted one or more roles that determine the user’s access to database resources and operations. Outside of role assignments, the user has no access to the system.

MongoDB does not enable access control by default. You can enable authorization using the --auth or the security.authorization setting. Enabling internal authentication also enables client authorization.

Once access control is enabled, users must authenticate themselves.

As MongoDB provides built-in roles with pre-defined pairings of resources and permitted actions.

MongoDB grants access to data and commands through role-based authorization and provides built-in roles that provide the different levels of access commonly needed in a database system. You can additionally create user-defined roles.

A role grants privileges to perform sets of actions on defined resources. A given role applies to the database on which it is defined and can grant access down to a collection level of granularity.

For your further ref Here and Here


Because user security is handled with your application and it's application what contacts the database (not user), you don't need to create every user to the database as a database user.

However, it is still good practice to create a user for every application that uses the database system, so that application can only use those databases what that application needs to access and do only those operations (insert, delete, update,...) what that application needs to do. Nothing else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.