title: mongodb sharding user authentication
body: <p>I've set up a brand new, sharded MongoDb (3 config servers, 3 node replica set). Followed the documentation online, really didn't have any problems. Sharded a database and a collection; mongos connects to the system; it's all working fine.</p>
  
  <p>The one thing that I don't have a grasp of is how authentication works when in a sharded system. I have keyfile set for all 6 nodes. When I want to add a user, do I do it from mongos? Do I have to log in to each node in the replica set and add the user as well? Do I have to add the user to the config servers?</p>
  
  <p>In particular I've created a MMS user via mongos, and that allowed the mms-monitoring-agent to connect enough to know about the various servers. But it can't actually read data from any of them; I get errors like:</p>
  
  <pre><code>ask failure `serverStatus`. Err: `Failed command to mongoshard1:27017 running 
  [{serverStatus 1} {recordStats 0} {locks 0}] against DB admin. 
  Err: `not authorized on admin to execute command { serverStatus: 1, recordStats: 0, locks: 0 }`
  </code></pre>
  
  <p>When I connect via mongos and use admin; show users I see:</p>
  
  <pre><code>{
  "_id" : "admin.mms",
  "user" : "mms",
  "db" : "admin",
  "roles" : [
      {
          "role" : "readAnyDatabase",
          "db" : "admin"
      },
      {
          "role" : "clusterMonitor",
          "db" : "admin"
      }
  ]
  }
  </code></pre>
  
  <p>I think I just lack understanding of which of the instances the user needs to be added to.</p>