Author: Zen and the Art of Computer Programming
1 Introduction
This is a technical blog post covering MongoDB user management and access control. The article introduces MongoDB user management and access control in detail from the following aspects:
User role and permission management: This article will introduce in detail the concepts of user role, read and write permissions, database permissions and how they are implemented in MongoDB. The article will first introduce what a user role is, why it is used, and what it is used for. Next, the article will describe the role permission system in MongoDB, how to create, modify and delete roles, and how to assign permissions to roles. Finally, this article will also explain the role mapping strategies used in MongoDB, including Allow-Based (whitelist), Deny-Based (blacklist) and Role-Based (role-based).
Account authentication: This article will discuss the MongoDB account authentication method and related configuration. First, it introduces that MongoDB supports multiple authentication methods, including SCRAM-SHA-1, SCRAM-SHA-256, MONGODB-X509, and LDAP. Then, the applicable scenarios of different authentication methods will be described, and corresponding configuration methods will be provided. The article also introduces the configuration of SSL/TLS and the behavior after the authentication fails.
Access control: This article mainly introduces the access control model of MongoDB, which can be based on role authorization, collection or database authorization. Specifically, role-based authorization refers to permission control through roles; collection-based or database-based authorization controls through user names, passwords, and collection or database names. The article also details the authorization process, including the role of the user when querying and whether the database permissions are sufficient, and when the user should be prohibited from performing certain operations.
Troubleshooting: This article will introduce how to solve problems such as MongoDB account authentication and access control in a production environment. First, some common problems will be introduced, such as account authentication failure,