MongoDB的RBAC通過角色分配權(quán)限來管理數(shù)據(jù)庫訪問。其核心機(jī)制是將預(yù)定義權(quán)限集合的角色賦予用戶，從而決定其可執(zhí)行的操作及范圍。角色如同職位，如“只讀”或“管理員”，內(nèi)置角色滿足常見需求，也可創(chuàng)建自定義角色。權(quán)限由操作（如insert、find）和資源（如集合、數(shù)據(jù)庫）組成，例如允許在特定集合上執(zhí)行查詢。常用內(nèi)置角色包括read、readWrite、dbAdmin、userAdmin和clusterAdmin等。創(chuàng)建用戶時需指定角色及其作用范圍，如Jane可在sales庫有讀寫權(quán)，在inventory庫僅有讀取權(quán)。角色始終綁定于特定數(shù)據(jù)庫，全局權(quán)限需在admin庫設(shè)置，用戶可跨庫擁有多個角色。

MongoDB’s Role-Based Access Control (RBAC) system is how you manage who can do what in your database. At its core, it works by assigning roles to users, and those roles define what actions they can perform and on which parts of the system.

Here’s a breakdown of how roles and privileges work in MongoDB RBAC:

What Are Roles in MongoDB?

Roles are sets of defined permissions that control what operations a user can perform. Instead of giving each user individual permissions, you assign them a role — like “read-only” or “admin” — and that role determines their access level.

You can think of roles as job titles: someone with the read role can look at data but not change it; someone with the readWrite role can both view and modify data.

MongoDB comes with built-in roles for common use cases, and you can also create custom roles if needed.

How Do Privileges Work?

Privileges are the specific permissions within a role. A privilege usually includes two parts:

• Actions – what operations the user can perform (like insert, delete, find)
• Resource – where those actions apply (a collection, a database, or across the whole cluster)

For example, a privilege might say:

Allow find, insert, and update actions on the orders collection in the sales database.

So when you assign a role to a user, you're really giving them a package of these privileges.

Common Built-In Roles You Should Know

MongoDB has several pre-defined roles that cover most typical needs. Here are some of the most commonly used ones:

• read: Allows read operations on all collections in a specific database
• readWrite: Same as read, but also allows write operations
• dbAdmin: For administrative tasks like creating/dropping collections, indexing, etc.
• userAdmin: Lets you manage users and roles (but not necessarily data itself)
• clusterAdmin: Super-admin-level access across the entire MongoDB deployment

There are also roles like backup and restore for managing backups, and readAnyDatabase or readWriteAnyDatabase for cross-database access.

If none of the built-in roles fit your needs exactly, you can create a custom role that combines only the privileges you want.

How to Assign Roles to Users

When creating or modifying a user in MongoDB, you specify which roles they have and where those roles apply. Here’s an example using the MongoDB shell:

use sales
db.createUser(
  {
    user: "jane",
    pwd: "securePassword123",
    roles: [
      { role: "readWrite", db: "sales" },
      { role: "read", db: "inventory" }
    ]
  }
)

This gives Jane read/write access to the sales database and read-only access to inventory.

Some things to remember:

• Roles are always tied to a specific database
• To grant global access (like cluster-wide admin), you need to assign roles in the admin database
• A user can have multiple roles across different databases

Final Thoughts

Understanding roles and privileges in MongoDB helps you set up secure, well-organized access controls without overcomplicating things. Use built-in roles where possible, combine them when necessary, and don’t hesitate to build custom roles if you need more precise control.

That's the basics of how MongoDB handles RBAC — not too bad once you break it down.

以上是MongoDB基于角色的訪問控制（RBAC）系統(tǒng)中的角色和特權(quán)是什么？的詳細(xì)內(nèi)容。更多信息請關(guān)注PHP中文網(wǎng)其他相關(guān)文章！