Creating users and roles in MongoDB - Quick Revision & Summary

Recall & Review

beginner

What is the purpose of creating users in MongoDB?

Users in MongoDB are created to control who can access the database and what actions they can perform. This helps keep data safe and organized.

beginner

What is a role in MongoDB?

A role is a set of permissions that define what actions a user can do in the database, like reading data or writing data.

intermediate

How do you create a user with read-only access to a database in MongoDB?

You use the command db.createUser() with the role 'read' on the specific database. For example:
db.createUser({user: 'reader', pwd: 'password', roles: [{role: 'read', db: 'mydb'}]})

intermediate

What command is used to create a custom role in MongoDB?

Use db.createRole() with a role name and a list of privileges. For example:
db.createRole({role: 'myRole', privileges: [{resource: {db: 'mydb', collection: ''}, actions: ['find']}], roles: []})

beginner

Why is it important to assign roles instead of giving all privileges to a user?

Assigning specific roles limits what a user can do, which improves security by preventing accidental or malicious changes to the database.

Which MongoDB command is used to add a new user?

A db.insertUser()

B db.createUser()

C db.addUser()

D db.newUser()

The correct command to create a user in MongoDB is db.createUser().

What does a role in MongoDB define?

A The user's password

B The user's email

C The user's permissions

D The user's database name

A role defines the permissions or actions a user can perform in the database.

Which role would you assign to a user who should only read data?

A root

B dbAdmin

C readWrite

D read

The 'read' role allows a user to only read data without making changes.

What is the purpose of db.createRole()?

A To create a custom role with specific privileges

B To create a new user

C To create a new database

D To delete a role

db.createRole() is used to create a custom role with specific permissions.

Why should you avoid giving users the 'root' role unless necessary?

A It gives full access which can be risky

B It only allows reading data

C It disables their account

D It limits their access

The 'root' role gives full access to the database, which can be risky if misused.

Explain how to create a user with read and write access to a specific database in MongoDB.

Think about the command and the role that allows both reading and writing.

Describe the steps to create a custom role that allows only reading from a specific collection.

Focus on defining privileges and then assigning the role.

Practice

1. What is the primary purpose of creating users in MongoDB?

easy

A. To control who can access the database

B. To store data in collections

C. To optimize query performance

D. To backup the database automatically

Solution

1. Step 1: Understand user creation in MongoDB

   Users in MongoDB are created to manage access to the database system.

2. Step 2: Identify the purpose of users

   Users control who can connect and perform actions on the database.

3. Final Answer:

   To control who can access the database -> Option A

4. Quick Check:

   Users = Access control [OK]

Hint: Users manage access, not data or backups [OK]

Common Mistakes:

• Confusing users with data storage
• Thinking users optimize queries
• Assuming users handle backups

2. Which of the following is the correct syntax to create a user with read-only access on the sales database in MongoDB?

easy

A. db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]})

B. db.createUser({user: 'reader', pwd: 'pass', roles: ['read']})

C. db.addUser('reader', 'pass', 'read')

D. db.users.insert({user: 'reader', pwd: 'pass', role: 'read'})

Solution

1. Step 1: Recall MongoDB user creation syntax

   The correct syntax uses db.createUser() with roles as an array of objects specifying role and database.

2. Step 2: Check each option

   db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]}) correctly specifies the role 'read' on the 'sales' database. db.createUser({user: 'reader', pwd: 'pass', roles: ['read']}) misses the database name, C uses deprecated syntax, D tries to insert directly into users collection which is invalid.

3. Final Answer:

   db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]}) -> Option A

4. Quick Check:

   Roles need role and db fields [OK]

Hint: Roles need role and db fields in array [OK]

Common Mistakes:

• Omitting the database in roles
• Using deprecated addUser method
• Trying to insert user directly into collection

3. Given the following command in MongoDB shell:

db.createUser({user: 'adminUser', pwd: 'secure123', roles: [{role: 'userAdminAnyDatabase', db: 'admin'}]})

What permission does the user adminUser have?

medium

A. Can read data from any database

B. Can manage users on any database

C. Can only read the admin database

D. Can write data to any database

Solution

1. Step 1: Understand the role userAdminAnyDatabase

   This role allows managing users and roles across all databases.

2. Step 2: Analyze the permissions given

   The user can create, modify, and delete users on any database but does not have read or write data permissions by default.

3. Final Answer:

   Can manage users on any database -> Option B

4. Quick Check:

   userAdminAnyDatabase = user management [OK]

Hint: userAdminAnyDatabase manages users, not data [OK]

Common Mistakes:

• Assuming it grants read or write data access
• Confusing admin database with all databases
• Thinking it only applies to admin database

4. You try to create a user with this command:

db.createUser({user: 'testUser', pwd: 'test123', roles: ['readWrite']})

But it fails. What is the most likely reason?

medium

A. Password is too short

B. User already exists

C. Roles must be objects specifying role and database

D. Missing database name in createUser command

Solution

1. Step 1: Check roles format in createUser

   Roles must be an array of objects with role and db fields, not just strings.

2. Step 2: Identify the error cause

   The command uses roles as strings, which is invalid syntax causing failure.

3. Final Answer:

   Roles must be objects specifying role and database -> Option C

4. Quick Check:

   Roles = [{role: '', db: ''}] [OK]

Hint: Roles need role and db objects, not strings [OK]

Common Mistakes:

• Using role names as plain strings
• Ignoring role database specification
• Assuming password length causes failure

5. You want to create a custom role named reportViewer that allows users to only read data from the reports collection in the analytics database. Which command correctly creates this role?

hard

A. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['read']}], roles: []})

B. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics'}, actions: ['read']}], roles: []})

C. db.createRole({role: 'reportViewer', privileges: [{resource: {collection: 'reports'}, actions: ['find']}], roles: []})

D. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []})

Solution

1. Step 1: Understand custom role creation syntax

   Custom roles require specifying privileges with resource (db and collection) and actions allowed.

2. Step 2: Analyze each option's privileges

   db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []}) correctly specifies the database 'analytics', collection 'reports', and action 'find' which allows reading documents. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics'}, actions: ['read']}], roles: []}) uses 'read' action on the whole database, not just the collection. db.createRole({role: 'reportViewer', privileges: [{resource: {collection: 'reports'}, actions: ['find']}], roles: []}) misses the database name. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['read']}], roles: []}) uses 'read' action which is not a valid action for privileges; 'find' is correct for reading documents.

3. Final Answer:

   db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []}) -> Option D

4. Quick Check:

   Custom role needs db, collection, and 'find' action [OK]

Hint: Use 'find' action for read on specific collection [OK]

Common Mistakes:

• Using 'read' action instead of 'find'
• Omitting database name in resource
• Specifying collection without database