Role-based access control in MongoDB - Step-by-Step Execution

Concept Flow - Role-based access control

Define Roles

↓

Assign Permissions to Roles

↓

Create Users

↓

Assign Roles to Users

↓

User Tries Action

↓

Check User's Roles and Permissions

Yes No↓

Allow

This flow shows how roles are defined with permissions, assigned to users, and checked when users try actions.

Execution Sample

MongoDB

db.createRole({
  role: "readData",
  privileges: [{ resource: { db: "test", collection: "" }, actions: ["find"] }],
  roles: []
});
db.createUser({ user: "alice", pwd: "password", roles: ["readData"] });

This code creates a role with read permission and assigns it to a user named alice.

Execution Table

Step	Action	Details	Result
1	Create Role	Role: readData with find action on test db	Role readData created
2	Create User	User: alice with role readData	User alice created with role readData
3	User Action	alice tries to find documents in test db	Check alice's roles and permissions
4	Permission Check	readData role allows find on test db	Action allowed
5	User Action	alice tries to insert document in test db	Check alice's roles and permissions
6	Permission Check	readData role does not allow insert	Action denied

💡 Execution stops after permission checks determine allow or deny

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 5	Final
Roles	{}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}
Users	{}	{}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}
User Action	N/A	N/A	N/A	find on test db	insert on test db	N/A
Permission Result	N/A	N/A	N/A	allowed	denied	N/A

Key Moments - 2 Insights

Why can alice find documents but cannot insert them?

Because alice has the readData role which only grants the 'find' action, not 'insert'. See execution_table rows 4 and 6.

What happens if a user has multiple roles with conflicting permissions?

MongoDB combines permissions from all roles. If any role allows an action, the user can perform it. This is shown by checking all roles in step 4.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result when alice tries to find documents in the test database?

A Action denied

B Action allowed

C Role not found

D User not found

💡 Hint

Check execution_table row 4 under Result column

At which step does the system deny alice's action?

A Step 5

B Step 4

C Step 6

D Step 3

💡 Hint

Look at execution_table row 6 for the permission check result

If alice was assigned a role with insert permission, how would the permission result change at step 6?

A It would allow the action

B It would cause an error

C It would still deny the action

D It would ignore the new role

💡 Hint

Refer to key_moments about combining permissions from multiple roles

Concept Snapshot

Role-based access control in MongoDB:
- Define roles with specific privileges
- Create users and assign roles
- When user acts, MongoDB checks roles' permissions
- If any role allows action, user is allowed
- Otherwise, action is denied

Full Transcript

Role-based access control in MongoDB works by defining roles that have specific permissions on database resources. Users are created and assigned these roles. When a user tries to perform an action, MongoDB checks the permissions granted by all roles assigned to that user. If any role allows the action, the user can perform it; otherwise, the action is denied. For example, a role named readData may allow only reading documents. A user alice with this role can find documents but cannot insert new ones. This ensures secure and organized access control based on roles.