Skip to content

Commit 77e0b16

Browse files
erabil-mdberabil-mdb
authored
Backports DOCSP-32346 to v7.0 (#4996)
* (DOCSP-32346) Revamps to include Atlas steps for Atlas Top 250 initiative. * Revises per copy review.
1 parent 4339e88 commit 77e0b16

File tree

2 files changed

+217
-4
lines changed

2 files changed

+217
-4
lines changed

‎source/includes/steps-add-scram-user.yaml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
stepnum: 1
2+
title: Open the :guilabel:`Add New Database User` dialog.
3+
ref: go-users-view-manual
4+
content: |
5+
a. In the :guilabel:`Security` section of the left navigation, click
6+
:guilabel:`Database Access`. The :guilabel:`Database Users` tab
7+
displays.
8+
9+
#. Click :icon-fa5:`plus` :guilabel:`Add New Database User`.
10+
---
11+
stepnum: 2
12+
title: Select :guilabel:`Password`.
13+
ref: scram-select-password-manual
14+
content: |
15+
In the :guilabel:`Authentication Method` section of the :guilabel:`Add
16+
New Database User` modal window, select the box labeled :guilabel:`Password`.
17+
---
18+
stepnum: 3
19+
title: Enter user information.
20+
ref: scram-enter-user-info-manual
21+
content: |
22+
Under :guilabel:`Password Authentication`, there are two text fields.
23+
24+
a. Enter a username for the new user in the top text field.
25+
26+
#. Enter a password for the new user in the lower text field.
27+
28+
To use a password auto-generated by {+atlas+},
29+
click the :guilabel:`Autogenerate Secure Password` button.
30+
---
31+
stepnum: 4
32+
title: Assign privileges.
33+
ref: assign-user-privileges-manual
34+
content: |
35+
Select the database user privileges. You can assign privileges to the new user
36+
in one or more of the following ways:
37+
38+
- Select a :atlas:`built-in role </security-add-mongodb-users/#built-in-roles>` from the
39+
:guilabel:`Built-in Role` dropdown menu. You can select one
40+
built-in role per database user within the Atlas UI. If you delete the
41+
default option, you can click :guilabel:`Add Built-in Role` to select a new built-in role.
42+
43+
- If you have any :atlas:`custom roles </security-add-mongodb-roles>` defined, you can expand
44+
the :guilabel:`Custom Roles` section and select
45+
one or more roles from the :guilabel:`Custom Roles` dropdown menu. Click
46+
:guilabel:`Add Custom Role` to add more custom roles. You can also
47+
click the :guilabel:`Custom Roles` link to see the custom
48+
roles for your project.
49+
50+
- Expand the :guilabel:`Specific Privileges` section and select one or more
51+
:atlas:`privileges </security-add-mongodb-users/#specific-privileges>` from the
52+
:guilabel:`Specific Privileges` dropdown menu. Click
53+
:guilabel:`Add Specific Privilege` to add more privileges. This assigns the
54+
user specific privileges on individual databases and collections.
55+
56+
{+atlas+} can apply a built-in role, multiple custom roles, and multiple specific
57+
privileges to a single database user.
58+
59+
To remove an applied role or privilege, click :icon-fa4:`trash-o`
60+
:guilabel:`Delete` next to the role or privilege you wish to delete.
61+
62+
.. note::
63+
64+
{+atlas+} doesn't display the :icon-fa4:`trash-o` :guilabel:`Delete` icon
65+
next to your :guilabel:`Built-in Role`, :guilabel:`Custom Role`, or
66+
:guilabel:`Specific Privilege` selection if you selected only one option. You
67+
can delete the selected role or privilege once you apply another role or privilege.
68+
69+
For more information on authorization, see :ref:`Role-Based
70+
Access Control <authorization>` and :ref:`Built-in
71+
Roles <built-in-roles>`.
72+
---
73+
stepnum: 5
74+
title: Specify the resources in the project that the user can access.
75+
optional: true
76+
ref: restrict-resource-access-manual
77+
content: |
78+
By default, users can access all the clusters and
79+
:atlas:`federated database instances </data-federation/overview>` in the
80+
project. You can restrict access to specific clusters and federated database instances
81+
by performing both of the following steps:
82+
83+
a. Toggle :guilabel:`Restrict Access to Specific Clusters/Federated
84+
Database Instances` to :guilabel:`ON`.
85+
86+
#. Select the clusters and federated database instances to grant the user access to
87+
from the :guilabel:`Grant Access To` list.
88+
---
89+
stepnum: 6
90+
title: Save as temporary user.
91+
optional: true
92+
ref: save-temp-user-manual
93+
content: |
94+
Toggle :guilabel:`Temporary User` to :guilabel:`On` and choose
95+
a time after which {+atlas+} can delete the user from the
96+
:guilabel:`Temporary User Duration` dropdown. You can select one of the
97+
following time periods for the user to exist:
98+
99+
- 6 hours
100+
- 1 day
101+
- 1 week
102+
103+
In the :guilabel:`Database Users` tab, temporary users display
104+
the time remaining until {+atlas+} will delete the user. Once
105+
{+atlas+} deletes the user, any client or application that uses
106+
the temporary user's credentials loses access to the cluster.
107+
---
108+
stepnum: 7
109+
title: Click :guilabel:`Add User`.
110+
ref: save-user-manual
111+
...

‎source/tutorial/create-users.txt‎

Lines changed: 106 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,34 @@ user. This principle of *access isolation* facilitates access revocation
2323
and ongoing user maintenance. To ensure a system of :term:`least
2424
privilege`, only grant the minimal set of privileges required to a user.
2525

26+
The user information on this page applies to deployments hosted in
27+
all of the following environments unless specified otherwise:
28+
29+
.. include:: /includes/fact-environments.rst
30+
31+
{+atlas+} Limitations
32+
------------------------------
33+
34+
The following limitations apply only to deployments hosted in
35+
{+atlas+}. If any of these limits present a problem for your organization,
36+
contact :atlas:`Atlas support </support>`.
37+
38+
* The available {+atlas+} :atlas:`built-in roles </security-add-mongodb-users/#std-label-atlas-user-privileges>`
39+
and :atlas:`specific privileges </security-add-mongodb-users/#std-label-atlas-specific-privileges>`
40+
support a subset of MongoDB commands.
41+
See :atlas:`Unsupported Commands in M10+ Clusters </unsupported-commands/#std-label-paid-tier-command-limitations>`
42+
for more information.
43+
44+
* {+atlas+} supports a maximum of 100 database users per {+atlas+}
45+
project. If you require more than 100 database users on a project,
46+
contact :atlas:`Atlas support </support>`.
47+
48+
* You must use the :atlas:`Atlas CLI </cli/stable/command/atlas-dbusers-create>`,
49+
:atlas:`Atlas Administration API </reference/api-resources-spec/v2/#tag/Database-Users>`,
50+
Atlas UI, or a supported :atlas:`integration </partner-integrations/#std-label-partner-integrations>`
51+
to add, modify, or delete database users on {+atlas+} database deployments.
52+
Otherwise, {+atlas+} rolls back any user modifications.
53+
2654
.. _add-user-prereq:
2755

2856
Prerequisites
@@ -37,24 +65,85 @@ For routine user creation, you must possess the following permissions:
3765

3866
.. include:: /includes/access-create-user.rst
3967

68+
To create users for {+atlas+}, you must have
69+
:atlas:`Organization Owner </reference/user-roles/#mongodb-authrole-Organization-Owner>`
70+
or :atlas:`Project Owner </reference/user-roles/#mongodb-authrole-Project-Owner>`
71+
access to {+atlas+}. These roles are unique to {+atlas+} and are
72+
separate from database users.
73+
To learn more, see :atlas:`Atlas User Roles </reference/user-roles>`.
74+
4075
.. _create-user-procedure:
4176

4277
Procedure
4378
---------
4479

4580
.. note::
4681

47-
The following procedure uses :ref:`authentication-scram`
82+
The following procedures use :ref:`authentication-scram`
4883
authentication. For additional information on other authentication
4984
mechanisms, see :ref:`create-users-examples`.
5085

86+
Configure Database Users for {+atlas+}
87+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
88+
89+
A {+atlas+} project can have users with different authentication methods.
90+
91+
You cannot change a user's authentication method after creating that
92+
user. To use an alternative authentication method, you must create a
93+
new user.
94+
95+
Configure database users for your {+atlas+} deployment who
96+
use :ref:`authentication-scram` authentication:
97+
98+
.. tabs::
99+
100+
.. tab:: Atlas CLI
101+
:tabid: cli
102+
103+
The Atlas CLI uses the following commands to create new database users and
104+
X.509 certificates. The options you specify determine the authentication method.
105+
106+
To create a database user for your project using the Atlas CLI,
107+
run the following command:
108+
109+
.. code-block:: sh
110+
111+
atlas dbusers create [builtInRole]... [options]
112+
113+
To create a new Atlas-managed X.509 certificate for the specified
114+
database user using the Atlas CLI, run the following command:
115+
116+
.. code-block:: sh
117+
118+
atlas dbusers certs create [options]
119+
120+
To learn more about the syntax and parameters for the previous commands,
121+
see the Atlas CLI documentation for
122+
:atlas:`atlas dbusers create </cli/stable/command/atlas-dbusers-create>` and
123+
:atlas:`atlas dbusers certs create </cli/stable/command/atlas-dbusers-certs-create>`.
124+
125+
.. see:: Related Links
126+
127+
- :atlas:`Install the Atlas CLI </cli/stable/install-atlas-cli>`
128+
- :atlas:`Connect to the Atlas CLI </cli/stable/connect-atlas-cli>`
129+
130+
.. tab:: Atlas UI
131+
:tabid: ui
132+
133+
.. include:: /includes/steps/add-scram-user.rst
134+
135+
Configure Users for Self-Hosted Deployments
136+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
137+
138+
To configure database users for your self-hosted MongoDB Enterprise
139+
or MongoDB Community deployment, follow these steps:
140+
51141
.. include:: /includes/steps/authorization-create-users.rst
52142

53143
.. seealso::
54144

55145
:doc:`/tutorial/manage-users-and-roles`
56146

57-
58147
.. _create-users-examples:
59148
.. _add-new-user:
60149

@@ -150,6 +239,10 @@ access to the ``records`` database:
150239
- :doc:`/tutorial/configure-ldap-sasl-activedirectory`
151240
- :doc:`/tutorial/configure-ldap-sasl-openldap`
152241

242+
To learn more about setting up LDAP authentication for {+atlas+},
243+
see :atlas:`Add Database Users</security-add-mongodb-users/#add-database-users>`
244+
in the {+atlas+} documentation.
245+
153246
x.509 Client Certificate Authentication
154247
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
155248

@@ -184,8 +277,17 @@ user with read-only access to the ``records`` database.
184277

185278
- :doc:`/tutorial/configure-x509-client-authentication`
186279

280+
To learn more about setting up x.509 Client Certificate authentication for {+atlas+},
281+
see :atlas:`Add Database Users</security-add-mongodb-users/#add-database-users>`
282+
in the {+atlas+} documentation.
283+
187284
Next Steps
188285
----------
189286

190-
To manage users, assign roles, and create custom roles, see
191-
:doc:`/tutorial/manage-users-and-roles`.
287+
To manage users, assign roles, and create custom roles for your
288+
self-hosted MongoDB Enterprise or MongoDB Community deployment,
289+
see :doc:`/tutorial/manage-users-and-roles`.
290+
291+
You can also :atlas:`manage users, assign roles </security-add-mongodb-users>`,
292+
and :atlas:`create custom roles </security-add-mongodb-roles>`
293+
for your {+atlas+} deployment.

0 commit comments

Comments
 (0)