Access Control

Manage MongoDB users, roles, permissions, and teams from a single dashboard. Create database users with SCRAM, X.509, or external authentication, define custom roles with granular privileges, scope permissions to individual databases, organize users into groups, and audit every administrative action.

Access Control covers the following capabilities:

• MongoDB user management — create, edit, enable/disable, and delete users; assign roles at create time or later
• Built-in role browsing and custom role definitions with granular privileges on cluster, database, and collection resources
• Database-level permission scoping so a single user can hold different roles in different databases
• Group management for teams — grant a bundle of roles to many users at once
• Effective-privilege calculation across every role, inherited role, and group membership
• Audit log of every RBAC action with CSV export for compliance reviews
• Session monitoring for active connections
• Connection-level read-only mode from the Connection Manager as a client-side safety net

Note: Admin access to the admin database is required for full RBAC management. Without admin privileges, you'll have limited functionality — the dashboard falls back to read-only views of the users and roles the current session can see.

Dashboard Overview

The Dashboard tab provides a high-level view of your MongoDB security configuration.

Statistics Cards

• Total Users - Count of all database users
• Active Users - Non-disabled user accounts
• Total Roles - Built-in and custom roles combined
• Custom Roles - User-defined custom roles
• Total Databases - Databases in the deployment
• Active Sessions - Currently active user connections

Quick Actions

• Create User - Opens the create user form
• Create Role - Opens the custom role creation form
• View All Users - Navigate to Users tab
• View Roles - Navigate to Roles tab
• Refresh - Reload dashboard statistics

Users Tab

The Users tab provides comprehensive user management with filtering, search, and bulk operations.

User List Features

• Search - Search by username, principal, or auth database
• Type Filter - Filter by SCRAM, X.509, or External auth
• Role Filter - Filter users by assigned role
• Database Filter - Filter by authentication database
• Bulk Selection - Select multiple users for bulk operations

User Display Columns

Column	Description
Principal	Username@authDB for SCRAM, DN for X.509, or principal for External
Type	Authentication type badge (SCRAM, X509, EXTERNAL)
Roles	Assigned roles in role@database format
Status	Active or Disabled indicator
Actions	View, Enable/Disable, Delete buttons

Creating Users

SCRAM Authentication (Default)

Field	Description	Required
Username	Unique username for database authentication	Yes
Password	User password (masked with show/hide toggle)	Yes
Auth Database	Database where credentials are stored (typically 'admin')	Yes
Roles	Assign roles with database scope (e.g., readWrite@mydb)	At least one

X.509 Certificate Authentication

Field	Description	Required
Distinguished Name	Full X.509 certificate subject DN	Yes
Roles	Assign roles with database scope	At least one

External Authentication (LDAP, Kerberos, AWS IAM)

Field	Description	Required
Principal	External principal identifier (LDAP DN, Kerberos principal, AWS ARN)	Yes
Mechanism	Authentication mechanism (LDAP, GSSAPI, MONGODB-AWS)	Yes
Roles	Assign roles with database scope	At least one

User Detail View

• Overview Tab - Principal, auth type, roles, status, timestamps
• Roles Tab - Manage assigned roles (grant/revoke)
• Effective Privileges Tab - Computed permissions from all roles
• Sessions Tab - Active sessions with client IP and connection time

Roles Tab

Manage built-in MongoDB roles and create custom roles for specific security requirements.

Built-in Database Roles

Role	Description
read	Read-only access to all non-system collections
readWrite	Read and write access to all non-system collections
dbAdmin	Database administration (create collections, indexes)
dbOwner	Full database admin (readWrite + dbAdmin + userAdmin)
userAdmin	Create and manage users and roles

Built-in Cluster Roles

Role	Description
clusterAdmin	Full cluster administration access
clusterMonitor	Read-only monitoring access
backup	Backup operations
restore	Restore from backups
root	Superuser with all privileges

Creating Custom Roles

Role Configuration

Field	Description	Required
Role Name	Unique name for the custom role	Yes
Database	Database where the role is defined	Yes
Description	Human-readable description of the role	No
Privileges	Specific actions on resources	At least one
Inherited Roles	Other roles this role inherits from	No

Privilege Resource Types

• Cluster - Cluster-wide administrative actions
• Database - Database-level operations (createCollection, dropDatabase)
• Collection - Collection-level operations (find, insert, update, remove)
• Any Resource - Grants privilege on all databases/collections

Common Collection Actions

Action	Description
find	Query documents
insert	Insert new documents
update	Modify existing documents
remove	Delete documents
createIndex	Create indexes
dropIndex	Remove indexes

Database-Level Permission Scoping

Every MongoDB role assignment is scoped to a specific database. A user can hold different roles in different databases, which is the primary way you grant least-privilege access in MongoDB.

In VisuaLeaf, the role picker on both the Create User and User Detail views uses the role@database format:

• read@reporting — read-only access to the reporting database
• readWrite@orders — full document access to the orders database only
• dbAdmin@analytics — administer indexes and collections in analytics, with no data access anywhere else
• read@admin paired with readWrite@app — a common pattern for users that need to inspect server-level metadata but only write to a single application database

Scoping Workflow

1. Open the Users tab and click Create User (or edit an existing user)
2. Enter the Username and select the Auth Database (typically admin)
3. In the Roles field, start typing a role name and pick a built-in or custom role
4. Choose the target database from the second dropdown — this is what limits the grant
5. Repeat to add additional role@database grants; each row is an independent scope
6. Use the Effective Privileges tab on the user detail view to verify the resolved permissions per database

Tip: Grants against the special anyResource or cluster resource cannot be limited to a single database — if you see those in the Effective Privileges panel, review which role introduced them.

Effective Privileges

View the complete set of permissions a user or role has, including inherited privileges and group grants.

• Privilege Aggregation - Computes all privileges from direct roles, inherited roles, and group memberships
• Resource Grouping - Organizes by resource type (cluster, database, collection)
• Inheritance Chain - Shows which role or group granted each privilege
• Per-Database View - Filter the tree to a single database to confirm the scope of granted privileges

Groups and Teams

Groups let you bundle a set of roles and assign that bundle to many users at once. They are ideal for teams (e.g., "Data Analysts", "Support Engineers", "SREs") where every member should hold the same set of grants.

Creating a Group

1. Open the Groups tab from the Access Control dashboard
2. Click Create Group and enter a name and optional description
3. Add one or more role@database grants — these apply to every member
4. Save the group, then add users from the Members panel or from an individual user's detail view

Managing Membership

• Add or remove members from the group's Members panel
• Group membership shows up in the user's Effective Privileges with the group name as the inheritance source
• Removing a role from a group revokes it from every member simultaneously — audit the impacted user list before saving

Audit Log

Every RBAC action performed through VisuaLeaf is recorded in the audit log so you can trace who did what, when, and against which target. The log is stored server-side and survives client restarts.

Audit Log Contents

Field	Description
Timestamp	UTC timestamp of the action (millisecond precision)
Actor	The VisuaLeaf user and MongoDB principal that initiated the action
Action	e.g., user.create, user.grant-role, role.update, group.add-member, user.disable
Target	The user, role, group, or database the action applied to
Details	Before/after snapshot of the change (roles added, privileges revoked, etc.)
Client IP	Source IP of the actor's session
Result	Success or failure, with the server error message if applicable

Filtering the Audit Log

• Date range — pick a preset (last hour, last 24h, last 7 days) or a custom range
• Actor — narrow to a single VisuaLeaf user or MongoDB principal
• Action — multi-select action types (create/update/delete/grant/revoke/disable/enable)
• Target — search by user, role, or group name
• Result — show only successes, only failures, or both

Exporting to CSV

The audit log can be exported to CSV for compliance reviews, ticket attachments, or downstream SIEM ingestion.

1. Open the Audit Log tab
2. Apply the filters you want the export to include (date range, actor, action, etc.) — the export honors the current filter set
3. Click the Export CSV button in the toolbar
4. Choose whether to include the "Details" column — unchecked produces a compact log, checked produces a full change-record export
5. Confirm the file name and destination when the browser download prompt appears

The exported file uses UTF-8 with a BOM (so Excel opens it cleanly), comma delimiters, and RFC 4180 quoting. Each row corresponds to a single audit event; multi-value fields (e.g., "roles added") are JSON-encoded inside their cell so the CSV stays flat.

Tip: Schedule a monthly export against a fixed date range and archive the CSVs alongside your access-review artifacts — this is usually enough evidence to satisfy SOC 2, ISO 27001, and PCI DSS access-review controls.

Session Monitoring

Monitor active user sessions to track database connections.

Session Information

Field	Description
Session ID	Unique identifier for the connection
Client IP	Source IP address
Connection Time	When the session started
Last Active	Timestamp of last operation
Client App	Driver or application name

Tips

• Least Privilege - Grant only minimum permissions needed for tasks, and prefer database-scoped grants (role@database) over cluster-wide roles
• Use Built-in Roles First - Create custom roles only when the built-in ones do not fit
• Role Composition - Build complex roles by inheriting from simpler ones instead of duplicating privileges
• Group by Team - Manage team access through groups so joiners/leavers can be handled in one place
• Regular Audits - Export the audit log to CSV monthly and reconcile against your HR system for departed users
• Belt and Braces - Combine a MongoDB user that only holds read with a Connection Manager read-only toggle to prevent accidental writes from the UI
• Disable vs Delete - Disable accounts temporarily instead of deleting so their audit trail stays linked

Related Features

• Connection Manager - Configure SSL/TLS for X.509, LDAP, Kerberos, AWS IAM, and OIDC authentication, and toggle client-side read-only mode
• Query Monitor - See what queries users are running in real time
• Database Statistics - Monitor resource usage by users and databases