In the last lecture, we created our first user with this special localhost exception and we assigned
a role to the user.
Now we did never create that role,
instead mongodb ships with a bunch of built-in roles that basically cover all the typical use cases
you have.
You can also create your own roles but that is beyond the scope of this course because this will be
a pure admin task,
you'll find a link in the last lecture of this module though which links you to the official docs where
you can learn how to create such roles,
it's actually pretty simple.
So let's talk about the built-in roles though.
We got a bunch of built-in roles in mongodb,
for example we got typical roles for users of a database,
so the people who work with the data in there
and there we got two roles, a read and a readWrite role and these roles are pretty self-explanatory.
You either got a role for users who only need to find data, so who can run all these queries, use the
aggregation framework but will not be able to insert or update or delete data, well or you got full
access.
You also get typical database admin roles, like the user admin or the db admin.
Now the db admin is for example a role for people who have that role are able to manage the database
obviously, to create collections, user admin is more geared towards creating and managing users as the
name suggests.
Now these roles will grant the user access to you for example readWrite data but only inside the database
to which you assigned that role and I will show you how you can assign roles to databases in the next
lecture.
We also have special roles of which we used one in the last lecture,
all database roles, you can assign all these roles on the left to users for multiple databases, so you
could give one user the read role for two different databases but of course sometimes you will have
a case where you want to give a user rights to do something
in all databases and also in all future databases and you don't want to manually add like the read role
to a user for every database manually and therefore, you have these all database roles. So we also have
read, readWrite, user admin and db admin, so all the roles we already saw on the left two boxes here
but now in a special set up that will always give the user access to all databases. And that is why we
use the user admin any database role in the last lecture because we want to have a user who is allowed
to create users for any database and in any database no matter if the database already exists or is created
in the future and so on.
Now besides these roles we also have cluster administration roles,
now we haven't talked about clusters at this point.
Clusters are essentially constructs where you have multiple mongodb servers working together,
this is used for scaling so that you can actually well have multiple machines running mongodb servers
and store your data which then work together and managing these clusters of servers is of course a meaningful
task, it is performed by people who know what they're doing and they have their own rights and you can
assign their own rights to let them do their job.
You also have special backup and restore roles in case you have some users who are only responsible
for that,
so these really are roles that just allow you to do that, backup the database or restore it
and then there are super user roles.
Now these are also roles we saw before except for root,
now the idea here is if you assign the db owner or a user admin role to the admin database and I will
show you how to assign roles to a database,
so to a user and then to a specific database, if you assign them to the admin database, this will kind
of be a special case because the admin database is a special database and these users are then able
to create new users and also change their own role
and that's why it's a super user.
All these roles here basically allow a user to create new users and change users, so these users can create
whatever they need
and therefore these are very powerful roles.
The root role is basically the most powerful role,
if you assign this to a user, this user can do everything,
so basically that will then be a user who has the same rights we had previously in this course before
we started locking down the database with --auth.
So these are the built-in roles,
now you can learn way more about them in the official docs of course.
The quickest way to get there is to just google for mongodb built-in roles
and then there is a whole article in the official docs which talks about the official roles, also grouped
in different categories as I did it on the slide and there, you do not only see a description of the
role, you also see which actions this role unlocks because remember, a role is just a group of privileges,
so these are essentially the privileges.
So here you see the read role gives you access to the find command but also to the command to list
collections which you do in the shell with show collections.
So you can read through all the roles here and see what people who have that role are actually allowed
to do
which is of course a very powerful feature.
Now with that, we know which roles exist
but one thing I could imagine that is still unclear is how exactly you assign a role to a user and you
control to which database this role then applies.
So let's have a look at this in the next lectures.