Misconceptions about permissions — the ordering below does not mean the permissions get bigger and bigger. Apart from users with the readWrite permission (root users included), no other users have write permission on a database, and apart from the read permission, no other users have read permission on the data in a database. Each permission has a different function (except root).
Normal users
Normal users only have the read and write permissions below
| Permission | Description |
|---|---|
| Read | Allows the user to read the specified database |
| readWrite | Allows the user to read and write the specified database |
Administrative users
Administrative users have some of the operational permissions described below
| Permission | Description |
|---|---|
| dbAdmin | Allows the user to run administrative functions in the specified database, such as (creating and deleting indexes, viewing statistics, accessing system.profile) |
| userAdmin | Allows the user to write to the system.users collection, and to create, delete and manage users in the specified database |
| clusterAdmin | Only available in the admin database; grants the user administrative permission over all sharding and replica set related functions |
Users who grant permissions
The users below mainly grant the corresponding permissions to other users
| Permission | Description |
|---|---|
| readAnyDatabase | Only available in the admin database; grants the user read permission on all databases |
| readWriteAnyDatabase | Only available in the admin database; grants the user read and write permission on all databases |
| userWriteAnyDatabase | Only available in the admin database; grants the user the userAdmin permission on all databases |
| dbAdminAnyDatabase | Only available in the admin database; grants the user the dbAdmin permission on all databases |
Super administrator
Can do anything, whatever they please
| Permission | Description |
|---|---|
| root | Only available in the admin database; super administrator |
| mongodb | After installation, the first time you enter no password is needed and there are no users at all — just connect and go in |
/usr/local/mongodb/bin/mongo —host 192.168.31.215 —port 27018
Creating an administrative user
> use admin
switched to db admin
> db.createUser ( {
user: "manage",
pwd: "123456",
roles: [ { role: "root", db: "admin" } ]
}
)
#the following output means the creation succeeded
Successfully added user: {
"user": "manage",
"roles": [
{
"role": "root",
"db": "admin"
}
]
}
Log out, then enable authentication in the mongodb configuration file
vim /usr/local/mongodb/27018/conf/mongod.conf
security:
authorization: enabled
javascriptEnabled: true
Restart mongodb
/usr/local/mongodb/bin/mongod --shutdown -f /usr/local/mongodb/27018/conf/mongod.conf
/usr/local/mongodb/bin/mongod -f /usr/local/mongodb/27018/conf/mongod.conf
Connect to mongodb
/usr/local/mongodb/bin/mongo --host 192.168.31.215 --port 27018
MongoDB shell version v4.2.0
connecting to: mongodb: //192.168.31.215: 27018/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id": UUID("fc77266a-b2ff-4eb0-b6ca-c493c7c29143") }
MongoDB server version: 4.2.0
> use admin #enter the admin database and authenticate the account first
switched to db admin
> db.auth('manage','123456') #authenticate the account; a return value of 1 means authentication succeeded
Creating a read-write user for the mongdb database
> db.createUser( {
... user: "zhangsan",
... pwd: "zhangsan",
... roles: [ { role: "readWrite", db: "mongdb" } ]
... }
... )
Successfully added user: {
"user": "zhangsan",
"roles": [
{
"role": "readWrite",
"db": "mongdb"
}
]
}
Verify the zhangsan user that was created (no need to log out)
> use admin
switched to db admin
> db.auth('zhangsan','zhangsan')
1
> show dbs #list the databases; the mongdb database does not show up because it stores data
> use mongdb #use the mongdb database directly
switched to db mongdb
#insert a JSON format document into the coll collection
> db.coll.insert({"name": "Zhangsan","url": "http: //abcops.cn","age": 25,"isNonProfit": true,})
WriteResult({ "nInserted": 1 })
> show collections #list the existing collections
coll
> db.coll.find() #read the data in the collection
{ "_id": ObjectId("5d8b24c2f1c33f4950f2c5df"), "name": "Zhangsan", "url": "http: //abcops.cn", "age": 25, "isNonProfit": true }
That completes the verification of the read and write permission
One user with multiple permissions
Grant the lisi user read permission on 01db, readWrite on 02db, dbAdmin permission on 03db and userAdmin permission on 04db
This time create the databases first
> use admin
switched to db admin
> db.auth('manage','123456')
1
> use 01db
switched to db 01db
> db.coll.insert({"name": "01db","url": "http: //abcops.cn","age": 25,"isNonProfit": true,})
WriteResult({ "nInserted": 1 })
> use 02db
switched to db 02db
> db.coll.insert({"name": "02db","url": "http: //abcops.cn","age": 25,"isNonProfit": true,})
WriteResult({ "nInserted": 1 })
> use 03db
switched to db 03db
> db.coll.insert({"name": "03db","url": "http: //abcops.cn","age": 25,"isNonProfit": true,})
WriteResult({ "nInserted": 1 })
> use 04db
switched to db 04db
> db.coll.insert({"name": "04db","url": "http: //abcops.cn","age": 25,"isNonProfit": true,})
WriteResult({ "nInserted": 1 })
Creating a user and granting permissions
> db.createUser( {
... user: "lisi",
... pwd: "123456",
... roles: [ { role: "read",db: "01db" },
... { role: "readWrite",db: "02db" },
... { role: "dbAdmin",db: "03db" },
... { role: "userAdmin",db: "04db" } ]
... }
... )
Successfully added user: {
"user": "lisi",
"roles": [
{
"role": "read",
"db": "01db"
},
{
"role": "readWrite",
"db": "02db"
},
{
"role": "dbAdmin",
"db": "03db"
},
{
"role": "userAdmin",
"db": "04db"
}
]
}
Viewing all users
> show users
{
"_id": "admin.admin",
"userId": UUID("9958faa5-7132-4146-8775-a001e47fe7f8"),
"user": "admin",
"db": "admin",
"roles": [
{
"role": "root",
"db": "admin"
}
],
"mechanisms": [
"SCRAM-SHA-1"
]
}
{
"_id": "admin.lisi",
"userId": UUID("bc8e5dc7-2f8c-40c1-8190-cea4951ae4a1"),
"user": "lisi",
"db": "admin",
"roles": [
{
"role": "read",
"db": "01db"
},
{
"role": "readWrite",
"db": "02db"
},
{
"role": "dbAdmin",
"db": "03db"
},
{
"role": "userAdmin",
"db": "04db"
}
],
"mechanisms": [
"SCRAM-SHA-1"
]
}
{
"_id": "admin.manage",
"userId": UUID("e1b34f57-06f2-4ef1-b23a-2d46a3964fbf"),
"user": "manage",
"db": "admin",
"roles": [
{
"role": "root",
"db": "admin"
}
],
"mechanisms": [
"SCRAM-SHA-1"
]
}
{
"_id": "admin.micvs",
"userId": UUID("1f4837c7-8c14-40d4-8a21-d621e0bcc278"),
"user": "micvs",
"db": "admin",
"roles": [
{
"role": "dbAdminAnyDatabase",
"db": "admin"
}
],
"mechanisms": [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}
{
"_id": "admin.zhangsan",
"userId": UUID("1003726b-c7fc-44e6-b001-b5c828bfb40d"),
"user": "zhangsan",
"db": "admin",
"roles": [
{
"role": "readWrite",
"db": "mongdb"
}
],
"mechanisms": [
"SCRAM-SHA-1"
]
}
Original source: https://mp.weixin.qq.com/s/YWcwaPIQDP6ln_6qtvnsOA
