MongoDB's RBAC manages database access through role assignment permissions. Its core mechanism is to assign the role of a predefined set of permissions to the user, thereby determining the operations and scope it can perform. Roles are like positions, such as "read-only" or "administrator", built-in roles meet common needs, and custom roles can also be created. Permissions are composed of operations (such as insert, find) and resources (such as collections, databases), such as allowing queries to be executed on a specific collection. Commonly used built-in roles include read, readWrite, dbAdmin, userAdmin and clusterAdmin. When creating a user, you need to specify the role and its scope of action. For example, Jane can have read and write rights in the sales library, and only read rights in the inventory library. Roles are always bound to a specific database, global permissions need to be set in the admin library, and users can have multiple roles across libraries.

MongoDB's Role-Based Access Control (RBAC) system is how you manage who can do what in your database. At its core, it works by assigning roles to users, and those roles define what actions they can perform and on which parts of the system.

Here's a breakdown of how roles and privileges work in MongoDB RBAC:

What Are Roles in MongoDB?

Roles are sets of defined permissions that control what operations a user can perform. Instead of giving each user individual permissions, you assign them a role — like “read-only” or “admin” — and that role determines their access level.

You can think of roles as job titles: someone with the read role can look at data but not change it; someone with the readWrite role can both view and modify data.

MongoDB comes with built-in roles for common use cases, and you can also create custom roles if needed.

How Do Privileges Work?

Privileges are the specific permissions within a role. A privilege usually includes two parts:

• Actions – what operations the user can perform (like insert, delete, find)
• Resource – where those actions apply (a collection, a database, or across the whole cluster)

For example, a privilege might say:

Allow find , insert , and update actions on the orders collection in the sales database.

So when you assign a role to a user, you're really giving them a package of these privileges.

Common Built-In Roles You Should Know

MongoDB has several pre-defined roles that cover most typical needs. Here are some of the most commonly used ones:

• read : Allows read operations on all collections in a specific database
• readWrite : Same as read , but also allows write operations
• dbAdmin : For administrative tasks like creating/dropping collections, indexing, etc.
• userAdmin : Lets you manage users and roles (but not necessary data itself)
• clusterAdmin : Super-admin-level access across the entire MongoDB deployment

There are also roles like backup and restore for managing backups, and readAnyDatabase or readWriteAnyDatabase for cross-database access.

If none of the built-in roles fit your needs exactly, you can create a custom role that combines only the privileges you want.

How to Assign Roles to Users

When creating or modifying a user in MongoDB, you specify which roles they have and where those roles apply. Here's an example using the MongoDB shell:

 use sales
db.createUser(
  {
    user: "jane",
    pwd: "securePassword123",
    roles: [
      { role: "readWrite", db: "sales" },
      { role: "read", db: "inventory" }
    ]
  }
)

This gives Jane read/write access to the sales database and read-only access to inventory .

Some things to remember:

• Roles are always tied to a specific database
• To grant global access (like cluster-wide admin), you need to assign roles in the admin database
• A user can have multiple roles across different databases

Final Thoughts

Understanding roles and privileges in MongoDB helps you set up secure, well-organized access controls without overcomplicating things. Use built-in roles where possible, combine them when necessary, and don't hesitate to build custom roles if you need more precise control.

That's the basics of how MongoDB handles RBAC — not too bad once you break it down.

The above is the detailed content of What are roles and privileges in MongoDB's Role-Based Access Control (RBAC) system?. For more information, please follow other related articles on the PHP Chinese website!