Users and roles

Users

• Connection-scoped workspace for users and roles, using the connected account’s effective permissions
• Users: list, filter, create, edit roles, change password, and delete
• Password users can generate and reveal a secure password: 20 characters, from an alphabet with no ambiguous letters
• Identities from normal authentication databases and from external authentication

Roles

• Role assignment distinguishes built-in from custom roles and shows cross-database scope
• Built-in roles are read-only. Custom roles can be created, edited, and deleted
• Custom roles support resource-scoped privileges, grouped action selection, and inherited roles
• An invalid cross-database or cluster privilege scope is refused, with the offending scope named
• Role detail pane: flattened effective privileges marked granted or inherited, the roles it inherits, and which users and roles hold it
• Create User and Create Role show the equivalent mongosh command, collapsed and copyable, with passwordPrompt() instead of the typed password

MongoDB Atlas

• Atlas connects with a project API key or a service account authenticated by OAuth2
• The secret half is stored encrypted on this device and can be disconnected at any time
• A service account secret shows its expiry date and warns within 30 days of it
• On Atlas the user form adds a description, temporary-user expiry, and scopes for the clusters the user may reach
• On Atlas the role form offers only the actions Atlas can grant, and not anyResource

What it does when access is limited

• The workspace adapts to available access: full administration, view-only, Atlas read-only until credentials are connected, or Atlas managed
• A deployment with no access control works too, with a warning
• Deleting the last user administrator warns that it appears to be the last one
• Every user and role mutation is recorded in operation logs. Passwords never are