Role-based access control in MongoDB - Step-by-Step Execution

Concept Flow - Role-based access control

Define Roles

↓

Assign Permissions to Roles

↓

Create Users

↓

Assign Roles to Users

↓

User Tries Action

↓

Check User's Roles and Permissions

Yes No↓

Allow

This flow shows how roles are defined with permissions, assigned to users, and checked when users try actions.

Execution Sample

MongoDB

db.createRole({
  role: "readData",
  privileges: [{ resource: { db: "test", collection: "" }, actions: ["find"] }],
  roles: []
});
db.createUser({ user: "alice", pwd: "password", roles: ["readData"] });

This code creates a role with read permission and assigns it to a user named alice.

Execution Table

Step	Action	Details	Result
1	Create Role	Role: readData with find action on test db	Role readData created
2	Create User	User: alice with role readData	User alice created with role readData
3	User Action	alice tries to find documents in test db	Check alice's roles and permissions
4	Permission Check	readData role allows find on test db	Action allowed
5	User Action	alice tries to insert document in test db	Check alice's roles and permissions
6	Permission Check	readData role does not allow insert	Action denied

💡 Execution stops after permission checks determine allow or deny

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 5	Final
Roles	{}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}	{"readData": {privileges: find on test}}
Users	{}	{}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}	{"alice": {roles: [readData]}}
User Action	N/A	N/A	N/A	find on test db	insert on test db	N/A
Permission Result	N/A	N/A	N/A	allowed	denied	N/A

Key Moments - 2 Insights

Why can alice find documents but cannot insert them?

Because alice has the readData role which only grants the 'find' action, not 'insert'. See execution_table rows 4 and 6.

What happens if a user has multiple roles with conflicting permissions?

MongoDB combines permissions from all roles. If any role allows an action, the user can perform it. This is shown by checking all roles in step 4.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result when alice tries to find documents in the test database?

A Action denied

B Action allowed

C Role not found

D User not found

💡 Hint

Check execution_table row 4 under Result column

At which step does the system deny alice's action?

A Step 5

B Step 4

C Step 6

D Step 3

💡 Hint

Look at execution_table row 6 for the permission check result

If alice was assigned a role with insert permission, how would the permission result change at step 6?

A It would allow the action

B It would cause an error

C It would still deny the action

D It would ignore the new role

💡 Hint

Refer to key_moments about combining permissions from multiple roles

Concept Snapshot

Role-based access control in MongoDB:
- Define roles with specific privileges
- Create users and assign roles
- When user acts, MongoDB checks roles' permissions
- If any role allows action, user is allowed
- Otherwise, action is denied

Full Transcript

Role-based access control in MongoDB works by defining roles that have specific permissions on database resources. Users are created and assigned these roles. When a user tries to perform an action, MongoDB checks the permissions granted by all roles assigned to that user. If any role allows the action, the user can perform it; otherwise, the action is denied. For example, a role named readData may allow only reading documents. A user alice with this role can find documents but cannot insert new ones. This ensures secure and organized access control based on roles.

Practice

1. What is the main purpose of role-based access control (RBAC) in MongoDB?

easy

A. To optimize query performance automatically

B. To store data in a structured format

C. To manage user permissions by assigning roles with specific privileges

D. To backup the database regularly

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling what users can do by giving them roles with permissions.

2. Step 2: Identify RBAC purpose in MongoDB

   MongoDB uses RBAC to assign roles that define user privileges, managing access securely.

3. Final Answer:

   To manage user permissions by assigning roles with specific privileges -> Option C

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC controls user actions via roles, not data or backups [OK]

Common Mistakes:

• Confusing RBAC with data storage
• Thinking RBAC handles backups
• Assuming RBAC optimizes queries

2. Which of the following is the correct syntax to create a role named readOnlyUser with read access on the sales database?

easy

A. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

B. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

C. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales"}, actions: ["insert"]}], roles: []})

D. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["update"]}], roles: []})

Solution

1. Step 1: Check correct field for role name

   The field to name the role is name, not role.

2. Step 2: Verify privileges for read access

   Read access uses the find action on the database with empty collection string for all collections.

3. Final Answer:

   db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []}) -> Option B

4. Quick Check:

   Role name uses 'name' field = A [OK]

Hint: Use 'name' for role, 'find' for read, empty collection for all [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role creation
• Assigning wrong actions like 'insert' for read role
• Missing empty string for collection to cover all

3. Given the following commands, what will be the result of db.runCommand({usersInfo: "alice"}) after assigning the role?

db.createRole({
  name: "reportViewer",
  privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}],
  roles: []
})
db.createUser({
  user: "alice",
  pwd: "password123",
  roles: ["reportViewer"]
})

medium

A. Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports'

B. Returns an error because 'reportViewer' role does not exist

C. Returns user info but shows no roles assigned to 'alice'

D. Returns user info showing 'alice' has admin role

Solution

1. Step 1: Confirm role creation and assignment

   The role 'reportViewer' is created with find privileges on 'reports' and assigned to user 'alice'.

2. Step 2: Understand usersInfo command output

   Running usersInfo for 'alice' shows user details including assigned roles and privileges.

3. Final Answer:

   Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports' -> Option A

4. Quick Check:

   Role assigned correctly, usersInfo shows it = C [OK]

Hint: usersInfo shows assigned roles and privileges correctly [OK]

Common Mistakes:

• Assuming usersInfo errors if role was just created
• Expecting no roles shown after assignment
• Confusing assigned roles with admin role

4. You tried to create a role with this command:

db.createRole({
  role: "dataEditor",
  privileges: [{resource: {db: "inventory", collection: "products"}, actions: ["update"]}],
  roles: []
})

But it failed. What is the error?

medium

A. The field 'role' should be 'name' when creating a role

B. The 'actions' array cannot contain 'update'

C. The 'resource' field must include 'collection' as null, not a string

D. Roles cannot have empty 'roles' array

Solution

1. Step 1: Check role creation syntax

   The correct field to name a role is 'name', not 'role'. Using 'role' causes failure.

2. Step 2: Validate other fields

   Actions like 'update' are valid, collection as string is correct, and empty roles array is allowed.

3. Final Answer:

   The field 'role' should be 'name' when creating a role -> Option A

4. Quick Check:

   Use 'name' field for role creation = B [OK]

Hint: Use 'name' not 'role' to name roles in createRole [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role name
• Thinking 'update' is invalid action
• Believing empty roles array is disallowed

5. You want to create a custom role manager that can read and update documents in the employees database and also inherit all privileges from the built-in read role on the same database. Which command correctly achieves this?

hard

A. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

B. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "admin"}]})

C. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["insert", "update"]}], roles: [{role: "read", db: "employees"}]})

D. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

Solution

1. Step 1: Check privileges for read and update on employees

   Privileges should apply to all collections in 'employees' database, so collection is empty string "".

2. Step 2: Verify inherited role database

   The built-in 'read' role must be inherited from the same database 'employees', not 'admin'.

3. Step 3: Confirm actions and roles

   Actions 'find' and 'update' are correct; 'insert' is not required here.

4. Final Answer:

   db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]}) -> Option D

5. Quick Check:

   Empty collection for all, inherit 'read' from same DB = D [OK]

Hint: Use empty collection for all, inherit roles from same DB [OK]

Common Mistakes:

• Setting collection name instead of empty string for all
• Inheriting 'read' role from wrong database
• Using wrong actions like 'insert' instead of 'find'