Security

When using MongoDB, database security is of utmost importance. Fortunately, it offers easy installation and other benefits such as encryption to protect your data in-transit (SSL/TLS) and at rest, auditing to track executed operations, and so on. This chapter will cover the key aspects of choosing and correctly implementing the types of authentications and authorizations that exist in MongoDB. You'll also look at how role-based access control (RBAC) works, and how you can effectively manage users in your database environment.

MongoDB offers mechanisms for controlling access and functions that a user can perform. You can imagine these mechanisms as a tripod composed of different authentication methods, types of authorization, and user management. Authentication identifies the user accessing the database (who), while authorization determines the user's allowed actions in the database (what). These actions include data operations (read, insert, update, delete), instance...

Authentication methods

The first pillar of security in MongoDB is authentication. Authentication is responsible for identifying who is accessing the database. For this part, you have four methods.

For the Community version, you have the following methods:

• SCRAM (default)
• x.509

For the Enterprise Advanced version, you also have the following methods:

• LDAP
• Kerberos

Each of these mechanisms has its pros and cons, and to choose the most appropriate one, you must consider your business needs, and the objectives you want to achieve with this step. Let's examine each of these methods in detail.

SCRAM

When you enable authentication in MongoDB, the default method is Salted Challenge Response Authentication Mechanism (SCRAM). Created by the Internet Engineering Task Force (IETF), SCRAM is a robust and secure authentication protocol that enables user authentication without sending the user's password in plain text over the network.

Instead...

Role-based access control (RBAC)

In MongoDB, you can efficiently manage user permissions with RBAC. RBAC allows granularity and flexibility for database resources. You can build functions that define the actions that users can perform, for example, only allowing a user to read data, but not to change or delete it. These can be built-in roles or user-defined roles and can be assigned to any user.

Built-in roles are already defined with MongoDB and you have a variety of them. User-defined roles, as the name implies, are roles that you can create as needed.

Assigning roles to users rather than granting individual permissions simplifies the access management process, especially in large and complex environments.

Using RBAC has several advantages:

• It provides granular control over permissions. Organizations can define a wide range of roles to reflect the different responsibilities and access needs of users.
• It helps enforce the principle of least privilege, a security...

Summary

This chapter discussed the critical role of security in MongoDB, delving into robust authentication methods such as SCRAM, x.509, LDAP, and Kerberos. However, security doesn't stop at authentication; it extends to proper user privilege management through RBAC. By implementing these best practices, MongoDB not only delivers performance and scalability but also remains a secure and dependable data platform.

In the next chapter, you'll see how auditing works in MongoDB. You'll also get to learn how to enable it in various use cases and tackle possible problems.