If users truly need unrestricted access to a MongoDB deployment, MongoDB provides a built-in role (page 405) named root (page 413) that grants the combined privileges of all built-in roles. This document describes how to create an administrative user with the root (page 413) role. 

For descriptions of the access each built-in role provides, see the section on built-in roles (page 405). 

## Prerequisites 

Required Access You must have the createUser (page 420) action (page 419) on a database to create a new user on that database. 

You must have the grantRole (page 420) action (page 419) on a role’s database to grant the role to another user. 

If you have the userAdmin (page 407) or userAdminAnyDatabase (page 412) role, you have those actions. 

First User Restrictions If your MongoDB deployment has no users, you must connect to mongod using the local- host exception (page 324) or use the --noauth option when starting mongod to gain full access the system. Once you have access, you can skip to Creating the system user administrator in this procedure. 

If users exist in the MongoDB database, but none of them has the appropriate prerequisites to create a new user or you do not have access to them, you must restart mongod with the --noauth option. 

## Procedure 

Step 1: Connect to MongoDB with the appropriate privileges. Connect to the mongod or mongos as a user with the privileges specified in the Prerequisites (page 388) section. 

The following procedure uses the siteUserAdmin created in Create a User Administrator (page 384). 

mongo --port 27017 -u siteUserAdmin -p password --authenticationDatabase admin 

Step 2: Create the administrative user. In the admin database, create a new user using the db.createUser() method. Give the user the built-in root (page 413) role. 

For example: 

use admin db.createUser( { user: "superuser", pwd: "12345678", roles: [ "root" ] } ) 

Authenticate against the admin database to test the new user account. Use db.auth() while using the admin database or use the mongo shell with the --authenticationDatabase option. 

## Create a Role 

## Overview 

Roles grant users access to MongoDB resources. By default, MongoDB provides a number of built-in roles (page 405) that administrators may use to control access to a MongoDB system. However, if these roles cannot describe the 

