Creating users and roles in MongoDB - Visual Walkthrough

Concept Flow - Creating users and roles

Start

↓

Define Role

↓

Create Role with Privileges

↓

Define User

↓

Create User with Roles

↓

User Can Access Resources

↓

End

First, define roles with specific permissions, then create users and assign these roles to control access.

Execution Sample

MongoDB

db.createRole({
  role: "readWriteReports",
  privileges: [{ resource: { db: "reports", collection: "" }, actions: ["find", "insert"] }],
  roles: []
});

db.createUser({
  user: "reportUser",
  pwd: "password123",
  roles: ["readWriteReports"]
});

This code creates a role with read and write access to the 'reports' database, then creates a user assigned to that role.

Execution Table

Step	Action	Input	Result	Notes
1	Define Role	{ role: "readWriteReports", privileges: [{ resource: { db: "reports", collection: "" }, actions: ["find", "insert"] }], roles: [] }	Role 'readWriteReports' created	Role has find and insert privileges on 'reports' DB
2	Create User	{ user: "reportUser", pwd: "password123", roles: ["readWriteReports"] }	User 'reportUser' created with role 'readWriteReports'	User can perform find and insert on 'reports' DB
3	User Access	User 'reportUser' tries to insert document in 'reports' collection	Success	User has insert privilege via role
4	User Access	User 'reportUser' tries to delete document in 'reports' collection	Failure	Delete not allowed by role privileges
5	End	-	-	Execution stops after user creation and role assignment

💡 User creation and role assignment complete; user permissions enforced by assigned role

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
role	undefined	{ name: "readWriteReports", privileges: [find, insert], roles: [] }	{ name: "readWriteReports", privileges: [find, insert], roles: [] }	{ name: "readWriteReports", privileges: [find, insert], roles: [] }
user	undefined	undefined	{ name: "reportUser", pwd: "password123", roles: ["readWriteReports"] }	{ name: "reportUser", pwd: "password123", roles: ["readWriteReports"] }

Key Moments - 3 Insights

Why can't the user delete documents even though they can insert and find?

Because the role 'readWriteReports' only includes 'find' and 'insert' actions, not 'delete'. See execution_table row 4 where delete fails.

Can a role include other roles?

Yes, roles can inherit privileges from other roles by listing them in the 'roles' array. Here, the role has an empty 'roles' array (execution_table row 1).

What happens if you create a user without assigning any roles?

The user will have no permissions and cannot access any database resources. This is not shown here but is important to remember.

Visual Quiz - 3 Questions

Look at the execution_table at step 3. What action does the user 'reportUser' successfully perform?

A Insert a document in 'reports' collection

B Delete a document in 'reports' collection

C Update a document in 'reports' collection

D Drop the 'reports' database

💡 Hint

Check the 'Result' column at step 3 in the execution_table.

At which step does the role 'readWriteReports' get created?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the 'Action' column in the execution_table for role creation.

If the role included 'delete' in privileges, what would change in the execution_table?

A Step 3 would fail

B Step 4 would show 'Success' for delete action

C User creation would fail

D Role creation would fail

💡 Hint

Refer to step 4 where delete currently fails due to missing privilege.

Concept Snapshot

Creating users and roles in MongoDB:
- Use db.createRole() to define roles with specific privileges.
- Privileges specify actions allowed on resources (databases/collections).
- Use db.createUser() to create users and assign roles.
- Users inherit permissions from assigned roles.
- Roles can include other roles for privilege inheritance.

Full Transcript

In MongoDB, you first create roles that define what actions are allowed on which databases or collections. For example, a role can allow reading and inserting documents in a specific database. Then, you create users and assign these roles to them. The user can then perform only the actions allowed by their roles. The execution table shows step-by-step how a role is created, then a user is created with that role, and how the user can perform allowed actions but not disallowed ones. Variables track the role and user objects as they are created. Key moments clarify common confusions like why a user cannot delete documents if the role does not allow it. The quiz tests understanding of these steps and permissions.

Practice

1. What is the primary purpose of creating users in MongoDB?

easy

A. To control who can access the database

B. To store data in collections

C. To optimize query performance

D. To backup the database automatically

Solution

1. Step 1: Understand user creation in MongoDB

   Users in MongoDB are created to manage access to the database system.

2. Step 2: Identify the purpose of users

   Users control who can connect and perform actions on the database.

3. Final Answer:

   To control who can access the database -> Option A

4. Quick Check:

   Users = Access control [OK]

Hint: Users manage access, not data or backups [OK]

Common Mistakes:

• Confusing users with data storage
• Thinking users optimize queries
• Assuming users handle backups

2. Which of the following is the correct syntax to create a user with read-only access on the sales database in MongoDB?

easy

A. db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]})

B. db.createUser({user: 'reader', pwd: 'pass', roles: ['read']})

C. db.addUser('reader', 'pass', 'read')

D. db.users.insert({user: 'reader', pwd: 'pass', role: 'read'})

Solution

1. Step 1: Recall MongoDB user creation syntax

   The correct syntax uses db.createUser() with roles as an array of objects specifying role and database.

2. Step 2: Check each option

   db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]}) correctly specifies the role 'read' on the 'sales' database. db.createUser({user: 'reader', pwd: 'pass', roles: ['read']}) misses the database name, C uses deprecated syntax, D tries to insert directly into users collection which is invalid.

3. Final Answer:

   db.createUser({user: 'reader', pwd: 'pass', roles: [{role: 'read', db: 'sales'}]}) -> Option A

4. Quick Check:

   Roles need role and db fields [OK]

Hint: Roles need role and db fields in array [OK]

Common Mistakes:

• Omitting the database in roles
• Using deprecated addUser method
• Trying to insert user directly into collection

3. Given the following command in MongoDB shell:

db.createUser({user: 'adminUser', pwd: 'secure123', roles: [{role: 'userAdminAnyDatabase', db: 'admin'}]})

What permission does the user adminUser have?

medium

A. Can read data from any database

B. Can manage users on any database

C. Can only read the admin database

D. Can write data to any database

Solution

1. Step 1: Understand the role userAdminAnyDatabase

   This role allows managing users and roles across all databases.

2. Step 2: Analyze the permissions given

   The user can create, modify, and delete users on any database but does not have read or write data permissions by default.

3. Final Answer:

   Can manage users on any database -> Option B

4. Quick Check:

   userAdminAnyDatabase = user management [OK]

Hint: userAdminAnyDatabase manages users, not data [OK]

Common Mistakes:

• Assuming it grants read or write data access
• Confusing admin database with all databases
• Thinking it only applies to admin database

4. You try to create a user with this command:

db.createUser({user: 'testUser', pwd: 'test123', roles: ['readWrite']})

But it fails. What is the most likely reason?

medium

A. Password is too short

B. User already exists

C. Roles must be objects specifying role and database

D. Missing database name in createUser command

Solution

1. Step 1: Check roles format in createUser

   Roles must be an array of objects with role and db fields, not just strings.

2. Step 2: Identify the error cause

   The command uses roles as strings, which is invalid syntax causing failure.

3. Final Answer:

   Roles must be objects specifying role and database -> Option C

4. Quick Check:

   Roles = [{role: '', db: ''}] [OK]

Hint: Roles need role and db objects, not strings [OK]

Common Mistakes:

• Using role names as plain strings
• Ignoring role database specification
• Assuming password length causes failure

5. You want to create a custom role named reportViewer that allows users to only read data from the reports collection in the analytics database. Which command correctly creates this role?

hard

A. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['read']}], roles: []})

B. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics'}, actions: ['read']}], roles: []})

C. db.createRole({role: 'reportViewer', privileges: [{resource: {collection: 'reports'}, actions: ['find']}], roles: []})

D. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []})

Solution

1. Step 1: Understand custom role creation syntax

   Custom roles require specifying privileges with resource (db and collection) and actions allowed.

2. Step 2: Analyze each option's privileges

   db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []}) correctly specifies the database 'analytics', collection 'reports', and action 'find' which allows reading documents. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics'}, actions: ['read']}], roles: []}) uses 'read' action on the whole database, not just the collection. db.createRole({role: 'reportViewer', privileges: [{resource: {collection: 'reports'}, actions: ['find']}], roles: []}) misses the database name. db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['read']}], roles: []}) uses 'read' action which is not a valid action for privileges; 'find' is correct for reading documents.

3. Final Answer:

   db.createRole({role: 'reportViewer', privileges: [{resource: {db: 'analytics', collection: 'reports'}, actions: ['find']}], roles: []}) -> Option D

4. Quick Check:

   Custom role needs db, collection, and 'find' action [OK]

Hint: Use 'find' action for read on specific collection [OK]

Common Mistakes:

• Using 'read' action instead of 'find'
• Omitting database name in resource
• Specifying collection without database