@@ -7,19 +7,20 @@ Create a User Administrator
7
7
Overview
8
8
--------
9
9
10
- The user administrator creates users and creates and assigns roles. The
10
+ User administrators create users and create and assigns roles. A
11
11
user administrator can grant any privilege in the database and can create
12
12
new ones. In a MongoDB deployment, create the user administrator as the
13
13
first user. Then let this user create all other users.
14
14
15
- To support creation of user administrators, MongoDB provides the
16
- :authrole:`userAdmin` and :authrole:`userAdminAnyDatabase` roles, both of
17
- which grant :ref:`actions <security-user-actions>` specific to user and
18
- role management and confer no additional privileges, in keeping with the
19
- policy of :term:`least privilege`.
15
+ To provide user administrators, MongoDB has
16
+ :authrole:`userAdmin` and :authrole:`userAdminAnyDatabase` roles,
17
+ which grant access to :ref:`actions <security-user-actions>` that support user and
18
+ role management. Following the policy of :term:`least privilege`
19
+ :authrole:`userAdmin` and :authrole:`userAdminAnyDatabase` confer no
20
+ additional privileges.
20
21
21
- Carefully control these roles. A user with either of these roles can grant
22
- *itself* additional privileges. Specifically, a user with the
22
+ Carefully control access to these roles. A user with either of these roles can grant
23
+ *itself* unlimited additional privileges. Specifically, a user with the
23
24
:authrole:`userAdmin` role can grant itself any privilege in the database.
24
25
A user assigned either the :authrole:`userAdmin` role on the ``admin``
25
26
database or the :authrole:`userAdminAnyDatabase` can grant itself any
0 commit comments