MongoDB Administrator's Guide

There's more...

In this recipe, we saw how to start a new replica set using key files. If you already have a replica set, you can still enable key-file-based authorization but you'll have to carefully sequence your steps, like so:

1. First, add a superuser account as shown previously.
2. Next, create the relevant client accounts that would be used by your applications.
3. Ensure that the applications are using the newly created user accounts.
4. Stop one of the secondaries and start with the parameter --transitionToAuth along with --keyFile.
5. One by one, restart all secondary nodes with the parameter --transitionToAuth along with --keyFile.
6. Bring down the primary using rs.stepDown(), and once a new primary node is elected, start this instance too, with ...