So what is authentication and authorization?
These are actually two concepts which are closely related.
Authentication is all about identifying users in your database, authorization on the other hand is all
about identifying what these users may then actually do in the database,
so if we want to use a real world analogy, you could kind of say that you might be employed and therefore
you are able to access the office because you got a key card to the office building let's say, so you
are an employee, you are authenticated to access the office
but the things you may do in the office depend on your role.
So let's say you are an accountant and then therefore you might be allowed to access the internal systems,
to process orders or buildings or anything like that.
So you describe that you are allowed to access and then you describe what you are allowed to do, that
is authentication and authorization and mongodb uses these two concepts to control who is able
to connect to the database server
and then what these people who are able to connect can do.
And when I say people here, that's important,
I don't just mean people,
I also absolutely mean things like the app you're writing, you as a developer will then write code so
that your app can connect automatically to the database server.
It's also important to understand that when I talk about users here, I don't mean users of your app,
so if you're building a shop, I don't mean the users who can sign up to buy things in your shop.
You might manage these users in your database but with your own logic
but with users here, I mean the users of the mongodb server,
so the people who are allowed to directly interact with it in some way and that of course are not the
users of your shop,
they may not directly insert documents or read documents or delete a database,
this is very important to understand.
I'm talking about users who are allowed to connect to the database not users
you might know in your application.
Now before we actually write some commands to actually create users and authenticate, it's important
to fully understand the authentication system mongodb uses. Mongodb employs a role based access control
system
and this works like this.
Let's say we have a mongodb server with three databases and the admin database is one
you already saw in previous modules, it's a special database which exists out of the box
and I'll come back to why it's special throughout this module.
So let's say we have that admin database,
obviously we would also have that config and local database we started with but we also have our
own databases here let's say, shop and blog.
Now in the shop database we have two collections and in the blog database too. Now we enable authentication
and that is something we'll do in the next lectures, authentication can be enabled in a very easy way
and suddenly our mongodb server only allows authenticated users to interact with it, with the
collections and the documents and with the overall server.
So let's say we have a user and now here important again, user here means either a real person like a
data analyst who directly connects to the database through the shell,
so like we are doing it in this course or you could also talk about an application here,
so the user would then kind of be the mongodb driver or your overall application code using
the driver to connect to your database.
So this is not the user of your application, not the user of the online shop you're building, it's really
your application or if it's a real person that we're talking about a person who directly connects like
we are doing it in this course.
So we got a user who wants to interact with the mongo database and we now need to log in with a username
and password because authentication was enabled
and mongodb automatically has a process in place where we then have to enter a username and
password.
Now that of course means that the user needs to exist on the mongodb server, otherwise logging
in will be impossible
and that is exactly what we will do in the next lectures,
we will create such users.
So let's say the user exists and we log in,
so now suddenly we are logged in as a user,
let's say our app is logged in or we as a data analyst are logged in.
But with that information only, so only with the information that we are logged in, we're not allowed
to do anything
instead users in mongodb are not just entities that are made up of a username and a password but
they also are assigned some roles and these roles are essentially groups of privileges.
Now what's a privilege? A privilege is a combination of a resource and an action
and that sounds very cryptic but it becomes clear with a concrete example. A resource would be something
like the products collection in our shop database and an action would be an insert command.
So actions are essentially the kinds of tasks, the commands we can execute,
we can do in our mongo database and the resource is on well which resource can we execute this command.
So for example, this little example here would mean that we can insert documents into the products collection
in the shop database
and this now allows us to do something as a logged in user.
And as I mentioned, this is a privilege,
typically you don't just have one privilege but instead multiple privileges are grouped into so-called
roles and therefore a user has a role and that role includes all the privileges,
so actions and resources that make sense for this user. And this is the model mongodb uses and
we'll see that in action in the next lectures.
This is a very flexible model because it allows us to create multiple users where we as a database owner
or administrator can give every user exactly the rights the user needs
and that's important,
we don't want to give every user all the rights because if someone, let's say the data analyst has all
the rights, this person or this app it could be an app too, is suddenly able to start deleting databases or
insert documents even though in the case of the data analyst, we only want this person to be able to
read data and it's not necessarily required that the person wants to do anything bad, this could even
happen on accident.
So only granting what a person really needs or what an app, a user in general really needs is a common
approach not just in mongodb but it exists here too, it makes a lot of sense
and it's therefore the approach we will use in this module too.