Built-in roles (read, readWrite, dbAdmin) in MongoDB - Mini Project: Build & Apply

Using MongoDB Built-in Roles: read, readWrite, dbAdmin

📖 Scenario: You are managing a small company's database using MongoDB. Different team members need different access levels to the database collections. You will assign built-in roles to users to control their permissions.

🎯 Goal: Assign MongoDB built-in roles read, readWrite, and dbAdmin to users on a database called companyDB.

📋 What You'll Learn

Create three users with exact usernames: readerUser, writerUser, and adminUser

Assign the read role on companyDB to readerUser

Assign the readWrite role on companyDB to writerUser

Assign the dbAdmin role on companyDB to adminUser

💡 Why This Matters

🌍 Real World

In real companies, database access must be controlled carefully. Assigning built-in roles helps secure data and limits user actions to what they need.

💼 Career

Database administrators and backend developers often create and manage users with roles to protect data and ensure proper access control.

1

Create the readerUser with read role

Use the db.createUser() command to create a user named readerUser with password readerPass123 and assign the built-in role read on the database companyDB.

MongoDB

# Use db.createUser() to create readerUser with read role
# Your code here

Hint

The read role allows the user to read data but not modify it.

2

Create the writerUser with readWrite role

Use the db.createUser() command to create a user named writerUser with password writerPass123 and assign the built-in role readWrite on the database companyDB.

MongoDB

db.createUser({
  user: "readerUser",
  pwd: "readerPass123",
  roles: [{ role: "read", db: "companyDB" }]
})
# Use db.createUser() to create writerUser with readWrite role
# Your code here

Hint

The readWrite role allows the user to read and write data in the database.

3

Create the adminUser with dbAdmin role

Use the db.createUser() command to create a user named adminUser with password adminPass123 and assign the built-in role dbAdmin on the database companyDB.

MongoDB

db.createUser({
  user: "readerUser",
  pwd: "readerPass123",
  roles: [{ role: "read", db: "companyDB" }]
})
db.createUser({
  user: "writerUser",
  pwd: "writerPass123",
  roles: [{ role: "readWrite", db: "companyDB" }]
})
# Use db.createUser() to create adminUser with dbAdmin role
# Your code here

Hint

The dbAdmin role allows the user to manage the database, including indexes and statistics, but not read or write data.

4

Verify all users are created with correct roles

Use the db.getUsers() command to list all users and verify that readerUser, writerUser, and adminUser exist with their assigned roles on companyDB.

MongoDB

db.createUser({
  user: "readerUser",
  pwd: "readerPass123",
  roles: [{ role: "read", db: "companyDB" }]
})
db.createUser({
  user: "writerUser",
  pwd: "writerPass123",
  roles: [{ role: "readWrite", db: "companyDB" }]
})
db.createUser({
  user: "adminUser",
  pwd: "adminPass123",
  roles: [{ role: "dbAdmin", db: "companyDB" }]
})
# Use db.getUsers() to list all users
# Your code here

Hint

This command shows all users and their roles on the current database.

Practice

1. Which built-in MongoDB role allows a user to only view data without making any changes?

easy

A. root

B. readWrite

C. dbAdmin

D. read

Solution

1. Step 1: Understand the read role

   The read role allows users to view data but not modify it.

2. Step 2: Compare with other roles

   readWrite allows changes, dbAdmin manages settings, root has full access.

3. Final Answer:

   read -> Option D

4. Quick Check:

   View-only permission = read [OK]

Hint: View-only means read role [OK]

Common Mistakes:

• Confusing readWrite with read
• Thinking dbAdmin allows data viewing only
• Assuming root is for read-only

2. Which of the following is the correct way to assign the readWrite role to a user on the database mydb in MongoDB shell?

easy

A. db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}])

B. db.createUser({user: 'username', roles: ['readWrite']})

C. db.grantRolesToUser('username', ['readWrite'])

D. db.grantRolesToUser('username', [{role: 'readWrite', db: 'admin'}])

Solution

1. Step 1: Check syntax for granting roles

   The correct syntax uses db.grantRolesToUser with an array of role objects specifying role and database.

2. Step 2: Validate database name and role format

   db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}]) correctly specifies role as 'readWrite' and database as 'mydb'. db.grantRolesToUser('username', [{role: 'readWrite', db: 'admin'}]) wrongly uses 'admin' database.

3. Final Answer:

   db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}]) -> Option A

4. Quick Check:

   Grant role with role+db object array [OK]

Hint: Use role objects with db name in array for granting roles [OK]

Common Mistakes:

• Passing roles as simple strings without db
• Using wrong database name for the role
• Using createUser instead of grantRolesToUser for existing users

3. Given a user with the dbAdmin role on database sales, which of the following actions can the user perform?

medium

A. Create and drop indexes on collections

B. Insert new documents into collections

C. Read documents from collections

D. Modify documents in collections

Solution

1. Step 1: Understand dbAdmin role capabilities

   The dbAdmin role allows managing database settings like indexes, stats, and users, but not data changes.

2. Step 2: Match actions to role permissions

   Creating/dropping indexes is a dbAdmin task. Inserting, reading, or modifying documents require readWrite or read roles.

3. Final Answer:

   Create and drop indexes on collections -> Option A

4. Quick Check:

   dbAdmin manages indexes, not data changes [OK]

Hint: dbAdmin manages indexes, not data content [OK]

Common Mistakes:

• Assuming dbAdmin can insert or modify data
• Confusing readWrite with dbAdmin
• Thinking dbAdmin can read data

4. You tried to assign the readWrite role to a user with this command:
db.grantRolesToUser('alice', ['readWrite'])
But it failed. What is the likely cause?

medium

A. The user 'alice' does not exist

B. The role array must contain objects with role and db fields

C. The readWrite role does not exist

D. You must use createUser to assign roles

Solution

1. Step 1: Check syntax for grantRolesToUser

   The method requires an array of role objects with role and db fields, not just strings.

2. Step 2: Analyze the given command

   The command uses an array of strings, which is invalid syntax and causes failure.

3. Final Answer:

   The role array must contain objects with role and db fields -> Option B

4. Quick Check:

   Roles must be objects with role and db [OK]

Hint: Roles need role+db objects, not strings [OK]

Common Mistakes:

• Passing roles as strings instead of objects
• Assuming createUser is needed to add roles to existing users
• Ignoring user existence errors

5. You want a user to manage database indexes and view data but not modify documents. Which combination of built-in roles should you assign?

hard

A. readWrite only

B. dbAdmin only

C. read and dbAdmin

D. readWrite and dbAdmin

Solution

1. Step 1: Identify roles for viewing data and managing indexes

   read allows viewing data, dbAdmin allows managing indexes and database settings.

2. Step 2: Exclude roles that allow modifying documents

   readWrite allows modifying documents, which is not desired here.

3. Final Answer:

   read and dbAdmin -> Option C

4. Quick Check:

   View + manage indexes = read + dbAdmin [OK]

Hint: Combine read and dbAdmin to view and manage without edits [OK]

Common Mistakes:

• Using readWrite which allows document changes
• Assigning only dbAdmin which lacks read permission
• Assuming dbAdmin includes readWrite