Navigation

createUser

Definition

createUser

Creates a new user on the database where you run the command. The createUser command returns a duplicate user error if the user exists. The createUser command uses the following syntax:

Changed in version 3.6.

{ createUser: "<name>",
  pwd: "<cleartext password>",
  customData: { <any information> },
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  writeConcern: { <write concern> },
  txnNumber: <long>,
  lsid: { id: <UUID> }
}

createUser has the following fields:

Field Type Description
createUser string The name of the new user.
pwd string The user’s password. The pwd field is not required if you run createUser on the $external database to create users who have credentials stored externally to MongoDB.
customData document Optional. Any arbitrary information. This field can be used to store any data an admin wishes to associate with this particular user. For example, this could be the user’s full name or employee id.
roles array The roles granted to the user. Can specify an empty array [] to create users without roles.
digestPassword boolean Optional. When true, the mongod instance will create the hash of the user password; otherwise, the client is responsible for creating the hash of the password. Defaults to true.
writeConcern document Optional. The level of write concern for the creation operation. The writeConcern document takes the same fields as the getLastError command.
authenticationRestrictions array

Optional. The authentication restrictions the server enforces on the created user. Specifies a list of IP addresses and CIDR ranges from which the user is allowed to connect to the server or from which the server can accept users.

New in version 3.6.

txnNumber 64-bit integer/long

Optional.

A strictly increasing non-negative number that uniquely identifies the command in the command’s session.

If specified, the command must also include the lsid option.

Tip

The mongo shell and the drivers provide helpers to start the session and assign a txnNumber to the commands in the session.

New in version 3.6.

lsid document

Optional.

The document that specifies the unique id of the session associated with the command. If the txnNumber is specified, the lsid is required.

Tip

The mongo shell and the drivers provide helpers to start the session and assign the lsid for the commands in the session.

New in version 3.6.

Roles

In the roles field, you can specify both built-in roles and user-defined roles.

To specify a role that exists in the same database where createUser runs, you can either specify the role with the name of the role:

"readWrite"

Or you can specify the role with a document, as in:

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.

Authentication Restrictions

New in version 3.6.

The authenticationRestrictions document can contain the following fields:

Field Name Value Description
clientSource Array of IP addresses and/or CIDR ranges If present, when authenticating a user, the server verifies that the client’s IP address is either in the given list or belongs to a CIDR range in the list. If the client’s IP address is not present, the server does not authenticate the user.
serverAddress Array of IP addresses and/or CIDR ranges A list of IP addresses or CIDR ranges to which the client can connect. If present, the server will verify that the client’s connection was accepted via an IP address in the given list. If the connection was accepted via an unrecognized IP address, the server does not authenticate the user.

Important

These are the only fields recognized by the server in the authenticationRestrictions document. When creating a user, if the server does not recognize a field contained within the authenticationRestrictions document, it throws an error.

For more information on authentication in MongoDB, see Authentication.

Behavior

Encryption

createUser sends password to the MongoDB instance in cleartext. To encrypt the password in transit, use TLS/SSL.

External Credentials

Users created on the $external database should have credentials stored externally to MongoDB, as, for example, with MongoDB Enterprise installations that use Kerberos.

local Database

You cannot create users on the local database.

Required Access

The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.

Example

The following createUser command creates a user accountAdmin01 on the products database. The command gives accountAdmin01 the clusterAdmin and readAnyDatabase roles on the admin database and the readWrite role on the products database:

db.getSiblingDB("products").runCommand( { createUser: "accountAdmin01",
                                          pwd: "cleartext password",
                                          customData: { employeeId: 12345 },
                                          roles: [
                                                   { role: "clusterAdmin", db: "admin" },
                                                   { role: "readAnyDatabase", db: "admin" },
                                                   "readWrite"
                                                 ],
                                          writeConcern: { w: "majority" , wtimeout: 5000 }
                                       } )