0

Our team has been tasked with a fairly open ended request for a MongoDB with multiple users that can access and submit documents to collections for a graduate class. The team is all new to MongoDB and are unsure how to handle the user storage side of things.

The internal team discussion is for: a) create a new limited role user in the database level as each user signs up to the service or b) creating a user collection and store users and hashed passwords there.

Does anyone have any advice on which method is better and why?

|improve this question
  • What is the MongoDB Version(x,y,z)? – Md Haidar Ali Khan Sep 23 at 4:40
  • MongoDB Community 4.2. I've got it setup on a remote host with authentication turned on, so a username and password is required to interact with the DB. – Austin Sep 23 at 13:04
1

If you absolutely need to give direct database access to someone, then go with option a) and all that it entails.

Else, then go with option b).

Option a) is a poor choice because, as of right now (MongoDB 4.2), permission granularity is still at collection level. This means that if users have write access to the same collection, they can overwrite documents of each other.

Even for your use case, if each user has their own collection or database, this would only work well with few users (less than five thousand active users). I suppose you could have a million users this way, even a billion, but MongoDB sharding doesn't work this way, and will never scale properly.

|improve this answer
  • Thanks for the answer. If a user is NOT a user of the database, how do they read and write to it? What is the best mechanism to achieve this? – Austin Sep 23 at 2:01
  • @Austin There is some type of software to interface between a human and a machine. We can say the flow is database -> software -> human. So for the database, his user is the software. But for the software, his user is the human. – Marcos Zolnowski Sep 23 at 3:30
  • I know how to read and write to the database if I have a user account, but if option a) is not to be used, what user account is to be used to read / write? Do 1,000 users use the same account? – Austin Sep 23 at 3:56
  • @Austin Your code use option a) to be able to make the database connection, after that your code should use this connection to check your client users passwords using option b). From the point of view of the database, yes, you are using only one user for everyone. – Marcos Zolnowski Sep 23 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.