-1

I have created a user in MongoDB and it has read permission to a db, which i verified it by db.getUser("username").

It confirms that it has read access.

However i am able to create and update collections in this db. How is that possible?

  • Give me your user creation query. – Bhuvanesh Apr 12 '18 at 17:49
  • db.createUser( { user: "skjdhf", pwd: "Iskjdfa" , roles: [ { role: "readWrite", db: "sakjdh" } ]} ) – lakshayk Apr 13 '18 at 7:55
  • 2
    You gave the role readWrite, then obviously it'll insert data.Just use read alone. – Bhuvanesh Apr 13 '18 at 9:26
  • @lakshayk, what is MongoDB version ? – Md Haidar Ali Khan Apr 13 '18 at 11:20
  • Also make sure that you enabled authentication. --auth true – JERRY May 22 '18 at 9:23
0

MongoDB: Read Role Able to Write and Edit Collections

As per MongoDB BOL here No, Because read Provides the ability to read data on all non-system collections and on the following system collections: system.indexes, system.js, and system.namespaces collections. The role provides read access by granting the following actions:

  1. collStats
  2. dbHash
  3. dbStats
  4. find
  5. killCursors
  6. listIndexes
  7. listCollections

However i am able to create and update collections in this db. How is that possible?

It possible through readWrite database user roles , It Provides all the privileges of the read role plus ability to modify data on all non-system collections and the system.js collection. The role provides the following actions on those collections:

  1. collStats
  2. convertToCapped
  3. createCollection
  4. dbHash
  5. dbStats
  6. dropCollection
  7. createIndex
  8. dropIndex
  9. find
  10. insert
  11. killCursors
  12. listIndexes
  13. listCollections
  14. remove
  15. renameCollectionSameDB
  16. update

For example here i am going to create new collection name with DBRole in test database and providing the role is readWrite.

> use test
switched to db test
> db.createCollection("DBRole")
{ "ok" : 1 }
> db.DBRole.find()
> db.createUser(
...    {
...      user: "lakshayk",
...      pwd: "lakshayk123",
...      roles: [ "readWrite"]
...    }
... );
Successfully added user: { "user" : "lakshayk", "roles" : [ "readWrite" ] }

And how to see the all users associated with that database.

> db.getUsers()
[
        {
                "_id" : "test.lakshayk",
                "user" : "lakshayk",
                "db" : "test",
                "roles" : [
                        {
                                "role" : "readWrite",
                                "db" : "test"
                        }
                ]
        }
]

Here again i am going to create new user with name of "StackExchange" and also going to provide dbAdmin Database Administration Roles other than Database User Role client roles.

> db.createUser(
...    {
...      user: "StackExchange",
...      pwd: "StackExchange123",
...      roles: [ "readWrite","dbAdmin"]
...    }
... );
Successfully added user: { "user" : "StackExchange", "roles" : [ "readWrite", "dbAdmin" ] }

And again I shall check all users from db.getUsers() to associated with that database.

> db.getUsers()
[
        {
                "_id" : "test.StackExchange",
                "user" : "StackExchange",
                "db" : "test",
                "roles" : [
                        {
                                "role" : "readWrite",
                                "db" : "test"
                        },
                        {
                                "role" : "dbAdmin",
                                "db" : "test"
                        }
                ]
        },
        {
                "_id" : "test.lakshayk",
                "user" : "lakshayk",
                "db" : "test",
                "roles" : [
                        {
                                "role" : "readWrite",
                                "db" : "test"
                        }
                ]
        }
]
>

I would like to say that here as i am able to see in your question statement, you are trying to fetch users through db.getUser(username) not with db.getUsers().

As per W3resource documentation here db.getUser() method is used to return user information about the specified user from a database. The user must exist on the database on which the method runs.

The Syntax is

db.getUser(username)

And where db.getUsers() The db.getUsers() method is used to return information for all users associated with a database.

The Syntax is

db.getUsers()

MongoDB grants access to data and commands through role-based authorization and provides built-in roles that provide the different levels of access commonly needed in a database system. You can additionally create user-defined roles.

For further your ref: here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.