Role-based access control in MongoDB - Mini Project: Build & Apply

Role-based Access Control with MongoDB

📖 Scenario: You are building a simple user management system for a small company. The system needs to control what actions users can perform based on their roles.For example, an admin can read and write all data, a manager can read and write some data, and a viewer can only read data.

🎯 Goal: Create a MongoDB collection to store users with their roles and permissions. Then, define a query to find users who have permission to write data.

📋 What You'll Learn

Create a MongoDB collection named users with documents containing username, role, and permissions fields.

Define roles with specific permissions: admin has read and write, manager has read and write, viewer has only read.

Write a query to find all users who have write permission.

💡 Why This Matters

🌍 Real World

Role-based access control is used in many applications to restrict what users can do based on their roles, improving security and organization.

💼 Career

Understanding how to manage user roles and permissions in databases is essential for backend developers, database administrators, and security engineers.

1

Create the users collection with user documents

Create a MongoDB collection called users and insert these exact documents: { username: "alice", role: "admin", permissions: ["read", "write"] }, { username: "bob", role: "manager", permissions: ["read", "write"] }, and { username: "carol", role: "viewer", permissions: ["read"] }.

MongoDB

// Insert the users documents into the users collection
// Your code here

Hint

Use db.users.insertMany() with an array of user objects.

2

Define a variable for the write permission

Create a variable called writePermission and set it to the string "write" to represent the write permission.

MongoDB

db.users.insertMany([
  { username: "alice", role: "admin", permissions: ["read", "write"] },
  { username: "bob", role: "manager", permissions: ["read", "write"] },
  { username: "carol", role: "viewer", permissions: ["read"] }
])

// Create a variable called writePermission and set it to "write"
// Your code here

Hint

Use const writePermission = "write" to create the variable.

3

Write a query to find users with write permission

Write a MongoDB query called usersWithWrite that finds all documents in the users collection where the permissions array contains the value stored in writePermission.

MongoDB

db.users.insertMany([
  { username: "alice", role: "admin", permissions: ["read", "write"] },
  { username: "bob", role: "manager", permissions: ["read", "write"] },
  { username: "carol", role: "viewer", permissions: ["read"] }
])

const writePermission = "write"

// Write a query called usersWithWrite to find users with write permission
// Your code here

Hint

Use db.users.find({ permissions: writePermission }) to find users with write permission.

4

Complete by adding a projection to show only usernames

Modify the usersWithWrite query to include a projection that returns only the username field and excludes the _id field.

MongoDB

db.users.insertMany([
  { username: "alice", role: "admin", permissions: ["read", "write"] },
  { username: "bob", role: "manager", permissions: ["read", "write"] },
  { username: "carol", role: "viewer", permissions: ["read"] }
])

const writePermission = "write"

// Modify usersWithWrite to project only username and exclude _id
// Your code here

Hint

Use the projection option in find() to select fields.

Practice

1. What is the main purpose of role-based access control (RBAC) in MongoDB?

easy

A. To optimize query performance automatically

B. To store data in a structured format

C. To manage user permissions by assigning roles with specific privileges

D. To backup the database regularly

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling what users can do by giving them roles with permissions.

2. Step 2: Identify RBAC purpose in MongoDB

   MongoDB uses RBAC to assign roles that define user privileges, managing access securely.

3. Final Answer:

   To manage user permissions by assigning roles with specific privileges -> Option C

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC controls user actions via roles, not data or backups [OK]

Common Mistakes:

• Confusing RBAC with data storage
• Thinking RBAC handles backups
• Assuming RBAC optimizes queries

2. Which of the following is the correct syntax to create a role named readOnlyUser with read access on the sales database?

easy

A. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

B. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

C. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales"}, actions: ["insert"]}], roles: []})

D. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["update"]}], roles: []})

Solution

1. Step 1: Check correct field for role name

   The field to name the role is name, not role.

2. Step 2: Verify privileges for read access

   Read access uses the find action on the database with empty collection string for all collections.

3. Final Answer:

   db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []}) -> Option B

4. Quick Check:

   Role name uses 'name' field = A [OK]

Hint: Use 'name' for role, 'find' for read, empty collection for all [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role creation
• Assigning wrong actions like 'insert' for read role
• Missing empty string for collection to cover all

3. Given the following commands, what will be the result of db.runCommand({usersInfo: "alice"}) after assigning the role?

db.createRole({
  name: "reportViewer",
  privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}],
  roles: []
})
db.createUser({
  user: "alice",
  pwd: "password123",
  roles: ["reportViewer"]
})

medium

A. Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports'

B. Returns an error because 'reportViewer' role does not exist

C. Returns user info but shows no roles assigned to 'alice'

D. Returns user info showing 'alice' has admin role

Solution

1. Step 1: Confirm role creation and assignment

   The role 'reportViewer' is created with find privileges on 'reports' and assigned to user 'alice'.

2. Step 2: Understand usersInfo command output

   Running usersInfo for 'alice' shows user details including assigned roles and privileges.

3. Final Answer:

   Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports' -> Option A

4. Quick Check:

   Role assigned correctly, usersInfo shows it = C [OK]

Hint: usersInfo shows assigned roles and privileges correctly [OK]

Common Mistakes:

• Assuming usersInfo errors if role was just created
• Expecting no roles shown after assignment
• Confusing assigned roles with admin role

4. You tried to create a role with this command:

db.createRole({
  role: "dataEditor",
  privileges: [{resource: {db: "inventory", collection: "products"}, actions: ["update"]}],
  roles: []
})

But it failed. What is the error?

medium

A. The field 'role' should be 'name' when creating a role

B. The 'actions' array cannot contain 'update'

C. The 'resource' field must include 'collection' as null, not a string

D. Roles cannot have empty 'roles' array

Solution

1. Step 1: Check role creation syntax

   The correct field to name a role is 'name', not 'role'. Using 'role' causes failure.

2. Step 2: Validate other fields

   Actions like 'update' are valid, collection as string is correct, and empty roles array is allowed.

3. Final Answer:

   The field 'role' should be 'name' when creating a role -> Option A

4. Quick Check:

   Use 'name' field for role creation = B [OK]

Hint: Use 'name' not 'role' to name roles in createRole [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role name
• Thinking 'update' is invalid action
• Believing empty roles array is disallowed

5. You want to create a custom role manager that can read and update documents in the employees database and also inherit all privileges from the built-in read role on the same database. Which command correctly achieves this?

hard

A. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

B. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "admin"}]})

C. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["insert", "update"]}], roles: [{role: "read", db: "employees"}]})

D. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

Solution

1. Step 1: Check privileges for read and update on employees

   Privileges should apply to all collections in 'employees' database, so collection is empty string "".

2. Step 2: Verify inherited role database

   The built-in 'read' role must be inherited from the same database 'employees', not 'admin'.

3. Step 3: Confirm actions and roles

   Actions 'find' and 'update' are correct; 'insert' is not required here.

4. Final Answer:

   db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]}) -> Option D

5. Quick Check:

   Empty collection for all, inherit 'read' from same DB = D [OK]

Hint: Use empty collection for all, inherit roles from same DB [OK]

Common Mistakes:

• Setting collection name instead of empty string for all
• Inheriting 'read' role from wrong database
• Using wrong actions like 'insert' instead of 'find'