How I lock one user in MongoDB

[Henrique_Souza (Henrique de Araujo Souza)]

Please, is possible lock one user in MongoDB 4.2 Community? (Not drop)

Thanks,
Henrique.

[Ramachandra_Tummala]

There is no such facility in mongodb
Check these

Limit failed logins from MongoDB shell

I have MongoDB community installed on VMs and I was wondering if there is there a way to lock user accounts after x number of failed logins on MongoDB Community when using SCRAM authentication? I looked in the documentation and didn’t see anything on this topic. Any help would be appreciated.

https://jira.mongodb.org/browse/SERVER-12818

[Henrique_Souza (Henrique de Araujo Souza)]

Thanks for help me @Ramachandra_Tummala , but i’ve seen it before and in my version of MongoDB (4.2) don’t have a db.lockUser method.

I think do one backup of this specific user (JSON of admin collection db.system.users) and store this in one collection. After this i drop the user!

But thanks for help!

[Stennie_X (Stennie)]

Hi @Henrique_Souza,

There is currently no in-built feature to “lock” a user account, however you can effectively remove access by one or more of:

• removing any roles for the user account
• changing the password

As noted in the discussion referenced by @Ramachandra_Tummala, a more typical approach for Enterprise customers would be using third party auth systems (for example, LDAP) which provide additional account management features.

@Henrique_Souza

db.lockUser method.

To be clear, there is no such method as of MongoDB 6.0. SERVER-12818 is a feature request (currently in the issue backlog) to implement locking/unlocking user accounts.

Regards,
Stennie