Adds or removes a user from a MongoDB database.
- replica_set (optional, str, None)
- Replica set to connect to (automatically connects to primary for writes).
- database (True, str, None)
- The name of the database to add/remove the user from.
- name (True, str, None)
- The name of the user to add or remove.
- password (optional, str, None)
- The password to use for the user.
- roles (optional, list, None)
The database user roles valid values could either be one or more of the following strings: 'read', 'readWrite', 'dbAdmin', 'userAdmin', 'clusterAdmin', 'readAnyDatabase', 'readWriteAnyDatabase', 'userAdminAnyDatabase', 'dbAdminAnyDatabase'
Or the following dictionary '{ db: DATABASE_NAME, role: ROLE_NAME }'.
This param requires pymongo 2.5+. If it is a string, mongodb 2.4+ is also required. If it is a dictionary, mongo 2.6+ is required.
- state (optional, str, present)
- The database user state.
- update_password (optional, str, always)
always will always update passwords and cause the module to return changed.
on_create will only set the password for newly created users.
This must be always to use the localhost exception when adding the first admin user.
This option is effectively ignored when using x.509 certs. It is defaulted to 'on_create' to maintain a a specific module behaviour when the login_database is '$external'.
- create_for_localhost_exception (optional, path, None)
This is parmeter is only useful for handling special treatment around the localhost exception.
If login_user is defined, then the localhost exception is not active and this parameter has no effect.
If this file is NOT present (and login_user is not defined), then touch this file after successfully adding the user.
If this file is present (and login_user is not defined), then skip this task.
- login_user (False, str, None)
The MongoDB user to login with.
Required when login_password is specified.
- login_password (False, str, None)
The password used to authenticate with.
Required when login_user is specified.
- login_database (False, str, admin)
- The database where login credentials are stored.
- login_host (False, str, localhost)
- The host running MongoDB instance to login to.
- login_port (False, int, 27017)
- The MongoDB server port to login to.
- strict_compatibility (optional, bool, True)
- Enforce strict requirements for pymongo and MongoDB software versions
- ssl (False, bool, False)
- Whether to use an SSL connection when connecting to the database.
- ssl_cert_reqs (False, str, CERT_REQUIRED)
- Specifies whether a certificate is required from the other side of the connection, and whether it will be validated if provided.
- ssl_ca_certs (False, str, None)
- The ssl_ca_certs option takes a path to a CA file.
- ssl_crlfile (False, str, None)
- The ssl_crlfile option takes a path to a CRL file.
- ssl_certfile (False, str, None)
- Present a client certificate using the ssl_certfile option.
- ssl_keyfile (False, str, None)
- Private key for the client certificate.
- ssl_pem_passphrase (False, str, None)
- Passphrase to decrypt encrypted private keys.
- auth_mechanism (False, str, None)
- Authentication type.
- connection_options (False, list, None)
Additional connection options.
Supply as a list of dicts or strings containing key value pairs seperated with '='.
Note
- name: Create 'burgers' database user with name 'bob' and password '12345'. community.mongodb.mongodb_user: database: burgers name: bob password: 12345 state: present - name: Create a database user via SSL (MongoDB must be compiled with the SSL option and configured properly) community.mongodb.mongodb_user: database: burgers name: bob password: 12345 state: present ssl: True - name: Delete 'burgers' database user with name 'bob'. community.mongodb.mongodb_user: database: burgers name: bob state: absent - name: Define more users with various specific roles (if not defined, no roles is assigned, and the user will be added via pre mongo 2.2 style) community.mongodb.mongodb_user: database: burgers name: ben password: 12345 roles: read state: present - name: Define roles community.mongodb.mongodb_user: database: burgers name: jim password: 12345 roles: readWrite,dbAdmin,userAdmin state: present - name: Define roles community.mongodb.mongodb_user: database: burgers name: joe password: 12345 roles: readWriteAnyDatabase state: present - name: Add a user to database in a replica set, the primary server is automatically discovered and written to community.mongodb.mongodb_user: database: burgers name: bob replica_set: belcher password: 12345 roles: readWriteAnyDatabase state: present # add a user 'oplog_reader' with read only access to the 'local' database on the replica_set 'belcher'. This is useful for oplog access (MONGO_OPLOG_URL). # please notice the credentials must be added to the 'admin' database because the 'local' database is not synchronized and can't receive user credentials # To login with such user, the connection string should be MONGO_OPLOG_URL="mongodb://oplog_reader:oplog_reader_password@server1,server2/local?authSource=admin" # This syntax requires mongodb 2.6+ and pymongo 2.5+ - name: Roles as a dictionary community.mongodb.mongodb_user: login_user: root login_password: root_password database: admin user: oplog_reader password: oplog_reader_password state: present replica_set: belcher roles: - db: local role: read - name: Adding a user with X.509 Member Authentication community.mongodb.mongodb_user: login_host: "mongodb-host.test" login_port: 27001 login_database: "$external" database: "admin" name: "admin" password: "test" roles: - dbAdminAnyDatabase ssl: true ssl_ca_certs: "/tmp/ca.crt" ssl_certfile: "/tmp/tls.key" #cert and key in one file state: present auth_mechanism: "MONGODB-X509" connection_options: - "tlsAllowInvalidHostnames=true"