Custom role creation in MongoDB - Step-by-Step Execution

Concept Flow - Custom role creation

Start

↓

Define Role Name

↓

Specify Privileges

↓

Specify Resources

↓

Create Role Command

↓

Role Created in Database

↓

Assign Role to User

↓

End

The flow shows defining a role name, specifying privileges and resources, creating the role, and then assigning it to a user.

Execution Sample

MongoDB

db.createRole({
  role: "readWriteReports",
  privileges: [
    { resource: { db: "reportsDB", collection: "sales" }, actions: ["find", "insert"] }
  ],
  roles: []
})

This code creates a custom role named 'readWriteReports' with find and insert privileges on the sales collection in reportsDB.

Execution Table

Step	Action	Input/Command	Result/Output
1	Define role name	role: "readWriteReports"	Role name set to 'readWriteReports'
2	Specify privileges	{ resource: { db: "reportsDB", collection: "sales" }, actions: ["find", "insert"] }	Privileges set for find and insert on sales collection
3	Specify inherited roles	roles: []	No inherited roles specified
4	Run createRole command	db.createRole({...})	Role 'readWriteReports' created successfully
5	Assign role to user	db.grantRolesToUser("alice", [{ role: "readWriteReports", db: "admin" }])	Role assigned to user 'alice'
6	Verify role assignment	db.getUser("alice")	User 'alice' has role 'readWriteReports'
7	End	-	Custom role creation and assignment complete

💡 Process ends after role creation and assignment to user.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 5	Final
roleName	undefined	readWriteReports	readWriteReports	readWriteReports	readWriteReports	readWriteReports
privileges	undefined	undefined	[{db: 'reportsDB', collection: 'sales', actions: ['find','insert']}]	[{db: 'reportsDB', collection: 'sales', actions: ['find','insert']}]	[{db: 'reportsDB', collection: 'sales', actions: ['find','insert']}]	[{db: 'reportsDB', collection: 'sales', actions: ['find','insert']}]
roles	undefined	undefined	[]	[]	[]	[]
userRoles	undefined	undefined	undefined	undefined	[{role: 'readWriteReports', db: 'admin'}]	[{role: 'readWriteReports', db: 'admin'}]

Key Moments - 3 Insights

Why do we specify an empty array for 'roles' when creating a custom role?

The 'roles' array lists roles this new role inherits from. An empty array means it does not inherit any roles. See execution_table step 3 where 'roles: []' means no inherited roles.

What happens if we forget to assign the new role to a user?

The role exists but no user has its privileges. The user won't gain any new permissions. See execution_table step 5 where role assignment to user 'alice' happens.

Can we assign privileges on multiple collections in one role?

Yes, by adding multiple privilege objects in the 'privileges' array. Here, only one collection is shown for simplicity (step 2).

Visual Quiz - 3 Questions

Look at the execution_table, what is the role name after step 1?

A "alice"

B "reportsDB"

C "readWriteReports"

D undefined

💡 Hint

Check the 'Action' and 'Result/Output' columns in row for step 1.

At which step is the role assigned to the user?

A Step 3

B Step 5

C Step 2

D Step 7

💡 Hint

Look for 'Assign role to user' in the 'Action' column.

If we add another collection privilege, which variable in variable_tracker changes?

A privileges

B roleName

C roles

D userRoles

💡 Hint

Check which variable holds the list of privileges in variable_tracker.

Concept Snapshot

Custom Role Creation in MongoDB:
- Use db.createRole() with role name, privileges, and roles.
- Privileges specify actions on resources (db, collection).
- Roles array is for inherited roles (can be empty).
- Assign created role to users with db.grantRolesToUser().
- Verify with db.getUser().

Full Transcript

This visual execution traces creating a custom role in MongoDB. First, we define the role name 'readWriteReports'. Next, we specify privileges allowing 'find' and 'insert' on the 'sales' collection in 'reportsDB'. We set roles to an empty array meaning no inherited roles. Then we run the createRole command which creates the role in the database. After that, we assign this role to user 'alice' using grantRolesToUser. Finally, we verify the assignment by fetching the user details. Variables like roleName, privileges, roles, and userRoles change step by step as shown. Key moments clarify why roles array can be empty, the importance of assigning roles to users, and how to add multiple privileges. The quiz tests understanding of role name, assignment step, and privilege variable. The snapshot summarizes the commands and flow for quick reference.