Now after all the theory, let's finally start working with some users to get a feeling for how that works,
how we can create and edit users and most importantly, how we can then work as a user because right
now, we always worked with
we have all rights mode turned on,
now we will shrink that down to be in a more realistic environment.
Users are created by a user with sufficient permissions with the create user command.
You then create a user with a username and a password
and as I mentioned, this user will have a couple of roles or one role,
so at least one role and then each role will typically contain a bunch of privileges.
Now a user is created on a database, so a user is attached to a database.
Now this does not actually limit the access of the user to that database even though you might think
it does but this is the database against which the user will have to authenticate, the exact rights
the user then has depend on the roles you assigned to that user
and even if a user authenticates against the shop database, the user might still have the role to work
with all databases that exist in your mongodb environment
and whilst this sounds strange right now, it is something which will become clearer over the next lectures
and there, you will understand why we can assign users to different databases
if that doesn't lock down their access.
Now of course we cannot just create users, if we ever need to we can also update users.
Now keep in mind update user here basically means that the administrator updates the user,
so of course you can use that to for example change the password but you should then tell your user
too.
So this is how we create and edit users,
now let's see that in practice. To see that in practice, let's bring up our mongo server again with the
same command we used in the past
but now I will add --auth here and --auth simply means that now you need to authenticate
in order to work with that database.
Previously we did not have that setting and that meant that everyone who connects is allowed to do everything,
well now this ends,
now if we start a server with that, we have a server that will require users to authenticate.
Now with that server up and running, I switch to a new terminal window and now if I type mongo, you might
have expected that this fails but actually we're still able to connect here because there are two different
ways of signing in. You can now either sign in with db auth, this is a command which takes a username
and a password but of course I haven't created any users yet so this won't work
or you can indeed also sign in during the connection process,
so now I quit my mongo process,
you can add the -u key here or flag and then enter your username and -p for the password and
then try connecting like this.
Now I will show a couple of times throughout the lecture,
for now let's connect to mongo like this
and there is one problem
we'll of course face,
do you know which one it is?
The problem we initially face of course is that now we connect it to a database that requires authentication
and we got no user yet
and indeed, if I type show dbs right now, I see nothing,
the same for show collections, I get an error which basically is a cryptic way of telling me you are
not allowed to do that.
Now we got no user
and mongodb has a special solution for that called the localhost exception. When connecting
to your database
in this state where you haven't added any users, you are allowed to add one user and that one user should
of course be a user who is then allowed to create more users and to do this, you first of all should
switch to the admin database and then run db create user.
Now a user is created by passing a document into this function,
the first argument should be user, the value here will be the username and I will use Max,
you can type any name you want.
Then separated by a comma because it's a new key in that document, you add the pwd,
so the password
and that also is a string up to you.
Now you also need to add the roles and for that, you add a roles key which holds an array of roles.
Now you can add multiple roles in different ways,
for now there is one role you should add
and I'll talk more about the available roles in a second
and the role you should add is the user admin
any database role. This is a special built-in role which will grant this user the right to administrate
any database
in this mongodb environment.
Now if you hit enter, you should have successfully created that user, now if you type show dbs,
you will suddenly see a different kind of error.
Now what you will need to do is you now need to authenticate and you can do this with the auth command,
so type Max, Max here if that were your credentials or whatever you did use and hit enter.
Make sure you are in the admin database,
so use admin first in case you switch to a different database in-between.
So then you should be authenticated
and now after being authenticated, you should be able to run show dbs and show collections
but I got none
but I also get no error anymore.
So now we created one user and we created that user with this special role.
Now before we create more users, let's talk about this special role and which built-in roles exist
in general.