MongoDB Access Control – Users, Roles, and Permissions

= 1024) leftSidebarOpen = false; if(window.innerWidth >= 1280) rightSidebarOpen = false" :class="{ 'dark': $store.theme.dark, 'left-sidebar-closed': !leftSidebarDesktop, 'right-sidebar-closed': !rightSidebarDesktop, 'overflow-hidden': leftSidebarOpen || rightSidebarOpen, 'sidebars-closed': !leftSidebarDesktop && !rightSidebarDesktop }">

MongoDB RBAC Explained: Users, Roles, and Permissions

Navigation

if (window.innerWidth

Preferences

Layout

Save Sidebar view

Remember if sidebars are open or closed across pages.

Save Sidebar layout preference

Enable Bookmarks

Save your favourite articles locally in this browser.

Enable Local Bookmarks

let scroll = window.scrollY; let docHeight = document.documentElement.scrollHeight - window.innerHeight; this.progress = docHeight > 0 ? Math.max(0, Math.min(1, scroll / docHeight)) : 0; this.ticking = false; }); }" @scroll.window.passive="update()" @resize.window.passive="update()" x-init="update()" class="fixed top-0 left-0 w-full h-[3px] z-[100] pointer-events-none">

Visual guide to MongoDB access control with users, roles, and permissions in VisuaLeaf.

There are two major aspects when connecting to MongoDB. One of them is identifying yourself. The other one is defining what you are permitted to do. Both aspects are different from each other. A user could identify itself correctly by using its username and password, yet the user wouldn’t be able to perform any actions with databases, update any document within, add new users, or manage any roles. All these permissions are provided through RBAC. Role-Based Access Control, or RBAC, refers to the allocation of specific roles to users in MongoDB. Roles determine what actions can be performed on particular databases or collections. For this example, I used the VisuaLeaf RBAC Dashboard to create and review users, roles, and permissions visually. The same setup can also be done from the Mongo shell, but using VisuaLeaf makes it easier to see who has access to what.

In my case, I decided to use the streaming_platform_db database, whose collections include: users movies reviews payments subscriptions It is an appropriate choice as not all users would require the same access rights. For instance, the app requires writing operations. The data analyst may require reading operations. The support agent requires viewing users, payments, and subscriptions. Administrative rights should be reserved for admin tasks. A quick overview of MongoDB users, roles, databases, and active sessions in VisuaLeaf.Authentication vs. Authorization Authentication provides an answer to the following question: Is this really the person they claim to be? Authorization provides the answer to the following question: What can this person do? In other words, even if support_agent succeeds in logging into MongoDB, it should prevent them from executing update, insert, and delete queries if their role is read. That is how it should be. The login was successful. The operation wasn’t. This proves that the role works. Sample Environment Configuration I have configured some users in VisuaLeaf with various roles as follows: data_analyst@streaming_platform_db read@streaming_platform_db streamflix_app@admin readWrite@streaming_platform_db support_agent@admin supportViewer@admin, read@streaming_platform_db admin@admin root@admin A simple configuration, yet it includes most possible scenarios. The admin user is used for administrative purposes. The streamflix_app user is used for applications. The data_analyst user is used for generating and reviewing reports. The support_agent user is used for support activities that require data verification without making any changes. MongoDB users and their assigned roles in VisuaLeaf.Role Definition in MongoDB The MongoDB role is defined through privileges. The privilege means: This operation is permitted on this database/resource. The operation can be find, insert, update, or remove. The resource can be a database or an exact collection. Thus, the role is more than just its name; it is a combination of rules. For instance, read@streaming_platform_db means that the user has the permission to read information from streaming_platform_db. It doesn’t imply the user is granted access to read all the databases present on the server. That’s because of the latter part - the database. Built-In Roles You Will Use Often MongoDB has numerous built-in default roles, but you don't have to start with all of them. Most beginners will probably use the following ones first:

Role What it means Good for

read Can view data Analysts, support users

readWrite Can view and change data Application users

dbAdmin Can manage database tasks like indexes Database maintenance

userAdmin Can manage users and roles for a database Access management

root Full admin access Trusted admin account

Here comes the common temptation to use the root role in every case, which will help avoid access issues. It will work just fine at the early...

MongoDB Access Control – Users, Roles, and Permissions

Related Articles

(no title)

Scientists reverse brain aging, with a nasal spray

AI has torched the market for junior programmers

Al Vigier: Canada's AI strategy shouldn't include secret Palantir bills

The Anatomy of an AI-Native Org