mongodb: how to list all users across all authentication databases - mongodb

Question

I'm pretty new to Mongo, so this may be a silly question, but I have not found a way to list all users (and their privileges) across all (authentication) databases. Similarly, I have not found a way to list all (authentication) databases. The "show users", "show databases" and their "db.adminCommand(...) versions all seem to run against the current database (the one specified with the "use" command), but what I need is a list of all(!) users and/or all(!) databases, regardless of those users' authentication databases.
Why do I (think) I need this? Well, I periodically must set up Mongo accounts for large groups of users, with each user having his/her/their own database. A few months later, I have to drop those users and their databases. I have a Python program that creates/drops these users and their databases. It all seems to work just fine. When creating a user, I give them their own authenticationDatabase (rather than adding them to "admin") with ReadWrite privileges on that database. As said, all of that seems to work just fine.
However... I need a way to see if, after the program runs (create or drop), users have indeed be created or databases have indeed be dropped by the Python program. Similarly, I need, from time to time, to see who all the users are and what databases I might still have around. Hence, a command for listing all users across all (authentication) databases and for listing all databases across all authentication databases would be welcome.
Hope someone can help (sorry for the long read).
R.

Answer 1

There is no built-in command that does that as far as I know but it is straightforward to implement this functionality:
Obtain the list of databases.
For each database, obtain the list of users.

Answer 2

I have not found a way to list all users (and their privileges) across
all (authentication) databases.
I have not found a way to list all
(authentication) databases.
... what I need is a list of all(!) users
and/or all(!) databases, regardless of those users' authentication
databases.
Here is a way to get the info you are looking for. Assuming you have the privilege to read other user's information (viewUser action), from the mongo shell you can query as follows:
> db.getUsers( { usersInfo: { forAllDBs: true } } )
This returns an array of all users and authentication databases and other related information. You are interested in "user" and "db fields, mostly. For example:
[
{
"_id" : "admin.user1",
"userId" : UUID("4f7369f6-bffa-45d9-bbdc-5bf50c196ea3"),
"user" : "user1",
"db" : "admin",
"roles" : [ { "role" : "read", "db" : "test" } ],
"mechanisms" : [ "SCRAM-SHA-1", ... ]
},
{
"_id" : "test.user2",
"userId" : UUID("1e36faaf-0667-4ec5-bbe9-3f703712cd9a"),
"user" : "user2",
"db" : "test",
"roles" : [ { "role" : "readWrite", "db" : "test" } ],
...
},
{
"_id" : "admin.super1",
"userId" : UUID("bcb2f424-7367-4686-82d8-115748fab951"),
"user" : "super1",
"db" : "admin",
"roles" : [ { "role" : "root", "db" : "admin" } ],
...
}
]
Since you need specific info, the query is customized as follows:
(1) To list all authentication databases, you can query like this:
var dbs = new Set()
db.getUsers( { usersInfo: { forAllDBs: true } } ).forEach(doc => dbs.add(doc.db))
print([...dbs])
The output is a list of unique authentication database names:
admin
test
(2) To list all authentication databases and users:
var dbUsers = [ ]
db.getUsers( { usersInfo: { forAllDBs: true } } ).forEach(doc => dbUsers.push(doc.db + ", " + doc.user))
dbUsers.sort()
dbUsers.forEach(printjson)
This get the ouput sorted by the authentication database and the user:
"admin, user1"
"admin, super1"
"test, user2"
(3) There are other ways to query too. For example, you can add a filter to get users with authentication database "admin":
db.getUsers( { usersInfo: { forAllDBs: true }, filter: { db: "admin" } } ).forEach(doc => print(doc.user))
This prints users only for "admin":
super1
user1
NOTES:
For more details see the User Management command usersInfo. The mongo shell provides the db.getUser() helper for this command, and this is used in the above examples.
The server version I tried with is the MongoDB version 4.2.