MongoDB Basics: Configuring Role-Based Access Control (RBAC)
Tags: mongodb, rbac, nosql, security
Published: 2017-11-28 14:48:53

---
title: "MongoDB Basics: Configuring Role-Based Access Control (RBAC)"
published: true
description: "ScaleGrid Tutorial: How to create, grant and assign MongoDB role-based action control RBAC user privileges for reIndex, mongodump and mongorestore."
tags: "MongoDB, RBAC, NoSQL, Security"
canonical_url: https://scalegrid.io/blog/mongodb-basics-configuring-role-based-access-control-rbac/
---
<link rel="canonical" href="https://scalegrid.io/blog/mongodb-basics-configuring-role-based-access-control-rbac/" />

<h1>MongoDB Basics: Configuring Role-Based Access Control (RBAC)</h1>
<p style="text-align: justify;">MongoDB, an open-source document store and most popular NoSQL database on the market today, offers a variety of advanced features to administer security over your MongoDB deployments. In this tutorial post, we're going to show you how to set up role-based access control (RBAC) to manage user access across your MongoDB systems for reIndex, mongodump and mongorestore.</p>
<p style="text-align: justify;">If you're the administrator of your MongoDB databases, you've likely received requests to provide an individual user with the capabilities to perform a certain action(s). <a href="https://scalegrid.io/blog/the-three-as-of-mongodb-security-authentication-authorization-auditing/" target="_blank">MongoDB's security</a> <a href="https://docs.mongodb.com/manual/security/" target="_blank">features</a> are fairly mature now, and allow you to create and assign very granular <a href="https://docs.mongodb.com/manual/core/authorization/">role-based access control</a>.</p>
<p style="text-align: justify;">We're going to walk through an example of granting a user the specific privilege of performing the <a style="color: #41a62a;" href="https://docs.mongodb.com/manual/reference/privilege-actions/#reIndex">reIndex</a> action in a step-by-step approach through its resolution. Before we demonstrate how to perform this common security action, let's go through an overview of MongoDB's role-based action control.</p>

<h2>How MongoDB RBAC Works</h2>
<p style="text-align: justify;">MongoDB allows you to use a <a href="https://en.wikipedia.org/wiki/Role-based_access_control" target="_blank">RBAC</a> mechanism to restrict access to users through assigned 'roles'. RBAC access control is not enabled by default and must be configured by an administrator on your team. By granting a user access to a specific resource, you are authorizing that role or user to perform actions on that resource.</p>

<ul>
	<li>
<h4>Resources</h4>
<p style="text-align: justify;">A database, collection, set of collections, or the cluster.</p>
</li>
	<li>
<h4>Actions</h4>
<p style="text-align: justify;">Specific operations a user can perform on a resource (usually a database).</p>
</li>
</ul>
<p style="text-align: justify;">MongoDB supports pre-defined roles called <a href="https://docs.mongodb.com/manual/reference/built-in-roles/" target="_blank">built-in roles</a> with actions collated into logical groups such as <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#read" target="_blank">read(-Only),</a> <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#readWrite" target="_blank">readWrite</a>, <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#backup" target="_blank">backup</a>, etc. MongoDB also supports the creation of <a href="https://docs.mongodb.com/manual/core/security-user-defined-roles/" target="_blank">user-defined roles</a>.</p>

<h2>Authorizing MongoDB reIndex RBAC Privileges</h2>
<p style="text-align: justify;">Now that you have some context, let's jump into the steps of authorizing a user the privilege of performing the reIndex action.</p>
<ol>
	<li>
<h3 style="font-size: 24px;">Determine the Privilege Actions</h3>
<p style="text-align: justify;">Actions in the MongoDB context are known as <a href="https://docs.mongodb.com/manual/reference/privilege-actions/#privilege-actions" target="_blank">Privilege Actions</a> and you can find an exhaustive list of these actions in <a href="https://docs.mongodb.com/manual/reference/privilege-actions/#privilege-actions" target="_blank">MongoDB's documentation</a>. The action we're interested in is <a href="https://docs.mongodb.com/manual/reference/privilege-actions/#reIndex" target="_blank">reIndex,</a> or the privilege that allows a user to execute the <a href="https://docs.mongodb.com/manual/reference/command/reIndex" target="_blank">reIndex command</a> on a given database or collection. Since the reIndex command can be expensive for collections with large amounts of data or a large number of indexes, it's part of <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#dbAdmin" target="_blank">administrative roles</a> by default.</p>
</li>
	<li>
<h3 style="font-size: 24px;">Grant Privileges to a Role</h3>
<p style="text-align: justify;">Once we've determined the privileges we need, we move on to granting those privileges to a role. You can also simply pick a built-in role that already has the privilege, but we recommend creating your own user-defined role over modifying built-in roles as they're good defaults to return to.</p>

<ol>
	<li>
<h4 style="display: inline !important;">Create a New User-Defined Role</h4>
<p style="text-align: justify;">Here's what we'll use to <a href="https://docs.mongodb.com/manual/reference/method/db.createRole/" target="_blank">create</a> our new user-defined role:</p>

<pre>&gt; use test
switched to db test
&gt; <strong>db.createRole({role: "reIndexing", privileges: [], roles: ["readWrite"]})</strong> // Create a new role out of the default readWrite rule.
{ "role" : "reIndexing", "privileges" : [ ], "roles" : [ "readWrite" ] }
&gt; db.getRole("reIndexing")
{
	"role" : "reIndexing",
	"db" : "test",
	"isBuiltin" : false,
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	],
	"inheritedRoles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}</pre>
</li>
	<li>
<h4>Grant Privileges to the New Role</h4>
<p style="text-align: justify;">Now we're going to assign our desired <a href="https://docs.mongodb.com/manual/reference/command/grantPrivilegesToRole/" target="_blank">privileges</a> to our newly created user-defined role.</p>

<pre>&gt; <strong>db.grantPrivilegesToRole("reIndexing", [ { resource: { db : "test", collection: "" }, actions: ["reIndex"] } ])</strong>
&gt; db.getRole("reIndexing", {showPrivileges: true})
{
	"role" : "reIndexing",
	"db" : "test",
	"isBuiltin" : false,
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	],
	"inheritedRoles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	],
<strong>	"privileges" : [
		{
			"resource" : {
				"db" : "test",
				"collection" : ""
			},
			"actions" : [
				"reIndex"
			]
		}</strong>
	],
	"inheritedPrivileges" : [
....
	]
}

</pre>
</li>
</ol>
</li>
	<li>
<h3 style="font-size: 24px;">Grant the Role to a User</h3>
<p style="text-align: justify;">The last step is to simply <a href="https://docs.mongodb.com/manual/reference/method/db.grantRolesToUser/" target="_blank">assign the user</a> this new role:</p>

<pre>&gt; db.getUser("indexUser")
{
	"_id" : "test.indexUser",
	"user" : "indexUser",
	"db" : "test",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
&gt; <strong>db.grantRolesToUser("indexUser", ["reIndexing"])</strong>
&gt; db.getUser("indexUser")
{
	"_id" : "test.indexUser",
	"user" : "indexUser",
	"db" : "test",
	"roles" : [
<strong>		{
			"role" : "reIndexing",
			"db" : "test"
		},</strong>
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
</pre>
<p style="text-align: justify;">Remember to perform these steps on a dummy user so you can test and confirm the new privileges work before granting and notifying the relevant user of their authorization.</p>
</li>
</ol>

<h2>Additional Privileges: mongodump &amp; mongorestore</h2>
<p style="text-align: justify;">We demonstrated the reIndex example first to illustrate both granting privileges to roles and granting roles to users.</p>
<p style="text-align: justify;">A more common use case is providing authorization to perform <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#backup" target="_blank">backup</a> and <a href="https://docs.mongodb.com/manual/reference/built-in-roles/#restore" target="_blank">restore</a> actions using <a href="https://docs.mongodb.com/manual/reference/program/mongodump/" target="_blank"><code>mongodump</code></a> and <a href="https://docs.mongodb.com/manual/reference/program/mongorestore/" target="_blank"><code>mongorestore</code></a>. This can be done in a single step through MongoDB's built-in roles, and both backup and restore privileges can be granted to enable users to run <code>mongodump</code> and <code>mongorestore</code>, respectively.</p>
<p style="text-align: justify;">For example, here's how we would grant a user permissions to backup and restore any database. <em>Note that these roles are only available to users on the admin database.</em></p>

<pre>&gt; <strong>db.grantRolesToUser("backupUser", ["backup", "restore"])</strong>
&gt; db.getUser("backupUser")
{
	"_id" : "admin.backupUser",
	"user" : "backupUser",
	"db" : "admin",
	"roles" : [
		{
			"role" : "restore",
			"db" : "admin"
		},
		{
			"role" : "backup",
			"db" : "admin"
		},
		{
			"role" : "readWrite",
			"db" : "admin"
		}
	]
}
</pre>
<p style="text-align: justify;">Adding permissions to backup and restore on a single database or collection requires more work. For <code>mongodump</code>, you must additionally grant a <a href="https://docs.mongodb.com/manual/reference/program/mongodump/#required-access" target="_blank">find</a> privilege on that given database, however, <a href="https://docs.mongodb.com/manual/reference/program/mongorestore/#required-access" target="_blank"><code>mongorestore</code></a> has more complicated privilege requirements.</p>

<h4 style="padding-top: 20px;">Interested in MongoDB security? Here are the top posts on MongoDB security topics:</h4>
<ul>
	<li><a href="https://scalegrid.io/blog/the-three-as-of-mongodb-security-authentication-authorization-auditing/" target="_blank">The three A’s of MongoDB security – Authentication, Authorization &amp; Auditing</a></li>
	<li><a href="https://scalegrid.io/blog/three-simple-steps-to-improve-the-security-of-your-mongodb-installation/" target="_blank">Three simple steps to improve the security of your MongoDB installation</a></li>
	<li><a href="https://scalegrid.io/blog/configuring-mongodb-cr-authentication-as-default-on-mongodb-3-x/" target="_blank">Configuring MongoDB-CR authentication as default on MongoDB 3.x</a></li>
	<li><a href="https://scalegrid.io/blog/mongodb-ssl-with-self-signed-certificates-in-node-js/" target="_blank">MongoDB SSL with self signed certificates in Node.js</a></li>
	<li><a href="https://scalegrid.io/blog/10-tips-to-improve-your-mongodb-security/" target="_blank">10 tips to improve your MongoDB security</a></li>
</ul>
&nbsp;
<p style="text-align: center;"><!--HubSpot Call-to-Action Code --><span id="hs-cta-wrapper-2ec5e2d1-945d-4968-a949-871637933192" class="hs-cta-wrapper"><span id="hs-cta-2ec5e2d1-945d-4968-a949-871637933192" class="hs-cta-node hs-cta-2ec5e2d1-945d-4968-a949-871637933192"><!-- [if lte IE 8]></p>

<div id="hs-cta-ie-element"></div>
<![endif]--><a href="https://cta-redirect.hubspot.com/cta/redirect/3848622/2ec5e2d1-945d-4968-a949-871637933192" target="_blank"><img id="hs-cta-img-2ec5e2d1-945d-4968-a949-871637933192" class="hs-cta-img aligncenter" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/3848622/2ec5e2d1-945d-4968-a949-871637933192.png" alt="Learn more about ScaleGrid" /></a></span><script src="https://js.hscta.net/cta/current.js" charset="utf-8"></script><script>// <![CDATA[
hbspt.cta.load(3848622, '2ec5e2d1-945d-4968-a949-871637933192', {});
// ]]></script></span><!-- end HubSpot Call-to-Action Code -->

<hr />

&nbsp;