Previously in Mongo 2.6 was possible to create super user that will access all databases. However in the documentation of MongoDB 3.2 I don't see this option. My question is, how can I add a user in MongoDB 3.2 that will have access to all databases?
The roles are well documented for MongoDB 3.2
The superuser roles do provide access to all databases, either directly or implicit. However it is bad practice to do the bread and butter CRUD work with a superuser. You should always apply the Principle of least privilege.
If you only want the user to be able to read all databases, that would be the readAnyDatabase role. If the user should be able to modify all databases, that would translate to the readWriteAnyDatabase role.
In MongoDB 3.2 you have a bunch of built in roles. You can see them here :
https://docs.mongodb.org/manual/reference/built-in-roles/
Unfortunatly there is no "super user" role. You have to give several roles to your user.
Personally my super users have these roles :
userAdmin or userAdminAnyDatabase : allow him to create users
clusterAdmin : this role allow me to shutdown databases and manage my cluster
readWriteAnyDatabase : I think you can guess what it does
But you can add other roles to fit your user to your needs.
Related
I want to create multiple databases, say db_1, db_2, etc. I have a single user called dashboard.
Now, I have a dashboard, and I want to limit access to the dbs, i.e. I want to use a connectionString such that the user dashboard only has access to db_1 and another connectionString such that the user dashboard only has access to db_2.
For example, if I were to use mongosh "mongodb+srv://dashboard:MY_PASSWORD#IP_ADDRESS/db1?tls=true&authSource=admin&replicaSet=IP_ADDRESS", you can the change the database to db2 if you want to. But I want to prevent that - that connection should only have access to db1
This can be accomplished by creating different users with limits on what they read, but I was hoping this could be done via a single user.
You can do something like you are wanting if the user dashboard is a user on each individual database, and not in the more "global" admin database.
The authSource=admin in your query string tells MongoDB which database to use to authenticate, and since you are pointing to admin it will always use the same user, the one in the admin database.
If two users have the same name but are created in different databases, they are two separate users. If you want to have a single user with permissions on multiple databases, create a single user with a role for each applicable database.
https://www.mongodb.com/docs/manual/core/security-users/#authentication-database
So you'd need to create a separate dashboard user in each database.
The docs and steps here maybe helpful:
https://www.mongodb.com/docs/manual/tutorial/create-users/#create-additional-users-for-your-deployment
We saw PostgreSQL roles in class this year. Our teacher told us that it is more secure to use different roles with custom rights for every table or even column if necessary.
We have a project in which we have to use PostgreSQL to build a website with restricted access for connected users, who can be of different types (admin, employee, client). To follow the teacher's recommendations, we created different roles with different rights (one for each type of user).
We decided to use Go for our back end (with token auth) but I can't figure it out how to use our roles, which are more groups than users. I read in the doc that you "open" the connection to the DB once for all but to do so you have to give a PostgreSQL role. I didn't find a way to change the connected role without closing and reopening the DB. If I run the application without changing connected roles, how can PostgreSQL control if a user has the right to access tables he needs for the requests.
You can change roles on the fly in PostgreSQL. If you are logged in as nobody, and nobody is a member of role cleve, you can become role admins with
SET ROLE cleve;
But using that during authentication is problematic, because there is nothing that keeps the user from running the statement
RESET ROLE;
to become nobody again and then impersonating somebody else.
Typically, there are two ways how you can use the role system to leverage database permissions:
You have a personalized database user for every user of the application.
That is of course only feasible if the set of users is fairly constant and limited.
Then the individual users have no permissions at all, and there are certain roles like admin, reader, accountant and so on. The login roles are assigned permissions by becoming members of one or more of these roles, and they inherit their permissions.
You don't have personalized database users.
Then you only have one login role per set of permissions, say accountant, admin, viewer and so on.
The application has to decide as which user it should connect before establishing the database connection. If you need database queries for this decision, you perform those as a nobody database user with very limited permissions. For example, it may call a function that verifies a user-supplied password.
You can use the set role command to change the role while the session is open.
When securing a Mongo instance, you can add user credentials and roles into the built-in "admin" database or into any number of other custom databases that you may add to the instance.
It seems to me that having all the credentials and roles stored centrally in the "admin" database would make sense from a management point of view (easy to locate, everything in one place, don't need to connect to multiple databases to find all users, predictability, etc), so why would you use a custom database as the "authSource"? The docs don't explain why you would use "admin" over a custom database or vice versa.
So my question is:
Is it best practice to store all users and roles in the "admin" database or in each custom database to which that user will be connecting? Why?
Is there any best practice in MongoDB as to where I should put my database users?
I've just set up a local MongoDB server and I've added users in the admin database and granted them access to "their" (by their I mean the only database the users have access to) database.
Do you think it would be better to just put the users in "their" database and not in the admin database?
Regardless of the user's authentication database, Mongo always stores user information in admin.
MongoDB stores all user information, including name, password, and the user's authentication database, in the system.users collection in the admin database.
See centralized-user-data and system-users-collection.
When you create a user and grant that user access to a single database (aka their authentication database) then that information can only be stored in the admin database.
So, it's not really a question of "best practice"; storing user details in admin is MongoDB's choice, as implemented by their user management commands.
Update in response to this comment:
Ok, so the users are always located in the admin db, but I may also add "duplicates" to the other dbs? Maybe the question should be whether there any advantage in adding users to the other "non admin" dbs?
If you intend to have a single user with access to multiple databases then create a single user with roles in each of those databases rather than creating that user multiple times i.e. once in each of those databases. For example:
use admin;
db.createUser({user:'userName', pwd:'passwordValue', roles:[
{role:'readWrite', db:'DatabaseA'},
{role:'readWrite', db:'DatabaseB'}
]});
I know there are other threads that are similar, but I am not sure if they are relevant to Postgres.
I am reading the PostgreSQL documentation which it reads as follows:
Note: As explained in Chapter 20, PostgreSQL actually does privilege
management in terms of "roles". In this chapter, we consistently use
database user to mean "role with the LOGIN privilege".
Does this basically mean a role is a database user? Or is there a difference between a role and a user? Do users have the potential to not have full privileges while roles are users who always do have full privileges?
Previous versions of Postgres, and some other DB systems, have separate concepts of "groups" (which are granted access to database objects) and "users" (who can login, and are members of one or more groups).
In modern versions of Postgres, the two concepts have been merged: a "role" can have the ability to login, the ability to "inherit" from other roles (like a user being a member of a group, or a group being a member of another group), and access to database objects.
For convenience, many tools and manuals refer to any user with login permission as a "user" or "login role", and any without as a "group" or "group role", since it is useful and common practice to keep roughly to that structure. This is entirely a convention of terminology, and to understand the permissions, you need only understand the options available when creating roles and granting them access.
Again purely for convenience, Postgres still accepts commands using the old terminology, such as CREATE USER and CREATE GROUP which are both aliases for CREATE ROLE. If you write CREATE USER, the LOGIN permission will be added to the new role by default, to emulate the old behaviour when that was a separate command.
I found this link pretty useful.
The final goal is that some user/role can readwrite, some rule/user can be only read.
https://aws.amazon.com/blogs/database/managing-postgresql-users-and-roles/#:~:text=Users%2C%20groups%2C%20and%20roles%20are,to%20log%20in%20by%20default.&text=The%20roles%20are%20used%20only,grant%20them%20all%20the%20permissions.
Users, groups, and roles
Users, groups, and roles are the same thing in PostgreSQL, with the only difference being that users have permission to log in by default. The CREATE USER and CREATE GROUP statements are actually aliases for the CREATE ROLE statement.
enter image description here
In other relational database management systems (RDBMS) like Oracle, users and roles are two different entities. In Oracle, a role cannot be used to log in to the database. The roles are used only to group grants and other roles. This role can then be assigned to one or more users to grant them all the permissions. For more details with a focus on how to migrate users, roles, and grants from Oracle to PostgreSQL, see the AWS blog post Use SQL to map users, roles, and grants from Oracle to PostgreSQL.