0

I want to create a custom role which can just read one collection and readWrite all other collections. Don't have any delete permission on any collections.

  • Why this code won't work?

  • Should I add something like * in : collection:"" ?

    db.createRole(
    {
     role: "role1",
     privileges: [
       { resource: { db: "db1" ,collection:"" }, actions: [ "find","insert","update" ] },      
       { resource: { db: "db1" ,collection:"col1" }, actions: [ "find"] }      
     ],
     roles:[]      
    },
    { wtimeout: 5000 }
    )
    
  • What error are you getting? If you already gave find, insert, update to all collection, you cannot restrict one collection to find. – SqlWorldWide Jul 25 '17 at 12:14
1

The only solution is to move that col1 to different DB, but then your application must, of course, read two different databases.

  • this is the only solution and there is no other scientific tips for that? – Hamed_gibago Jul 26 '17 at 6:10
  • As @SqlWordWide wrote, if you give some right to all collections in DB, then right is given and you cannot "exclude" or override it. Of course if you give "find" to all collections (collection:"") and then list all collections where role have insert/update right separately. But in this solution, when ever you add new collection, it must be inserted to that list. – JJussi Jul 26 '17 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.