So we want to change our users roles here a bit because right now, our user here, appdev is only able
to read and write in the shop database
and then it's generally all right
but let's say we have another database and that would be a blog that belongs to the shop,
so it's also part of our shop application that we have a blog where we post about the latest new products
and the same kind of app and therefore, the same developer should be able to work with that.
How do we do that?
Well we can update a user with the db update user command.
Now the db update user command takes as a first argument the name of the user
you want the update,
so appdev
in my example
and then the second argument is the document where you describe the change to the user.
Now this does not work like the update on the database with set or so
but instead you now have a couple of key value pairs you can set and the full details can be found in
the official docs of course, a link as always can be found in the last lecture of this module.
So what you can do here is you can for example change the password if you want to but I don't want to,
so what I will do here is I will simply assign new roles and now these roles will not be added to the
old roles but will replace them,
that's important.
So of course I can add
readWrite again to give that user the readWrite access to the database he's in
but I want to do more than that,
I also want to give the user readWrite access to the blog database and to do that, I add a second element
to my roles array
and that will be a document because if I just add a string like this, it will always just give the user
readWrite access to the database the user was registered in.
Now if I want to give access to a different database, I can do that by adding a document where I set
the role to readWrite,
I could also use a different role of course but I want to get readWrite access here and then I set
the db explicitly and there, I could set this to blog.
Now what do you think will happen if I hit enter?
Well let's try out.
We actually get an error that
we are not authorized on shop to execute this command
and the reason of course is that I'm still logged in with appdev and the appdev is allowed to read
write data but not to change users.
So what I actually need to do is I need to log out and switch to the other user, the first user we created
.
We can do this with db auth and there, username and password was Max but this will fail in the shop database
because we created that user in the admin database,
so we need to switch to the admin database and then, we can sign into this user and this now succeeded
and now we can repeat that update command and I will just copy it from up there. It fails because now
we are not finding that user in the admin database because remember, that user exists on the shop database,
so let's actually quickly switch to shop and then execute this again
and now this should have worked. And we can check this with the get user command and get our appdev
user
and we actually see the roles here and we see that now this user has still readWrite on the shop but
also readWrite on the blog. Now with this added, we can log out again,
so now we're logged out of our Max user who is allowed to create and edit the users and we can switch to
shop where we have our other user and now authenticate it with appdev and dev.
Now with this, we can switch to blog and we should be able to go to the post collection and insert one
new post here with the title of this works.
If I hit enter, I seem to have messed up with logging out and logging back in,
so what I will quickly do is I will just restart my mongo shell with appdev dev against shop and
after this succeeded, I'll use my blog database and retry my insert command
and now this works.
So now we can insert a post into the blog database even though the user exists on the shop database
because we assigned two roles, actually the same role but two different databases.
Now this is certainly something you have to grasp but it's actually not that complex.
The database does not per say lock down the access the user has, the roles do
but if you assign a role to a user, by default it is assigned to that user for the database the user was registered
in
but as I showed in this lecture, you can change that or extend that to other databases too if you explicitly
specify the database a role should apply to.
And this gives you as an administrator or as a user administrator
a lot of power and a lot of flexibility of course.