I'm writing an app in python that requires some simple user management functions off mongodb. I've hit a snag on "updateUser" with the dreaded
Updating user failed: not authorized on admin to execute command and was hoping someone can give me some pointers here. I've set up 2 custom roles in the admin database since I'm using that as the auth db. Here are the roles:
db.createRole({
role: "mydbAdmin",
privileges: [],
roles: [
{role: "userAdmin", db: "admin"},
{role: "dbAdmin", db: "admin"},
{role: "readWrite", db: "admin"},
{role: "dbAdmin", db: "mydb"},
{role: "readWrite", db: "mydb"}
]});
and
db.createRole({
role: "mydbUser",
privileges: [{
resource: {db: "mydb", collection: ""},
actions: ["changeOwnPassword", "changeOwnCustomData"]
}],
roles: [{role: "readWrite", db: "mydb"}]});
my users are created on the admin database with either "mydbUser" or "mydbAdmin". The "mydbAdmin" can create, grant roles, revoke roles and drop the user as it's suppose to however, when I issue a general "updateUser" to change customData and roles, I get the following error as seen in the pix below:
> db.createUser({user: "someuser", pwd: "password", customData: {fullname: "Some"}, roles: ["mydbAdmin"]})
Successfully added user: {
"user" : "someuser",
"customData" : {
"fullname" : "Some"
},
"roles" : [
"mydbAdmin"
]
}
> db.updateUser("someuser", {customData: {fullname: "Some User"}})
> db.updateUser("someuser", {customData: {fullname: "Some User"}, roles: ["mydbUser"]})
uncaught exception: Error: Updating user failed: not authorized on admin to execute command { updateUser: "someuser", customData: { fullname: "Some User" }, roles: [ "mydbUser" ], writeConcern: { w: "majority", wtimeout: 600000.0 }, lsid: { id: UUID("c8753cab-e1ce-4ef4-8824-894bbbcd3315") }, $db: "admin" } :
_getErrorWithCode#src/mongo/shell/utils.js:25:13
DB.prototype.updateUser#src/mongo/shell/db.js:1436:11
#(shell):1:1
Would really appreciate if someone can give me some pointers as to what I'm doing wrong.
P/S - if I login as the "admin" that has the *AnyDatabase roles, I can issue that command without errors so clearly I'm missing something in my "mydbAdmin" roles. Any help would really be great as I'm at a loss on how to proceed forward.
Related
I just installed a fresh mongodb on Ubuntu server and when i try to adduser i am getting error
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
2018-07-03T13:29:41.556+0530 E QUERY [thread1] Error: couldn't add user: Use of SCRAM-SHA-256 requires undigested passwords :
_getErrorWithCode#src/mongo/shell/utils.js:25:13
DB.prototype.createUser#src/mongo/shell/db.js:1437:15
#(shell):1:1
This works for me:
db.createUser({
user:"test1",
pwd:"test1",
roles:[
{
role:"readWrite",
db:"u8"
}
],
mechanisms:[
"SCRAM-SHA-1"
]
})
Go with following commands in Mongo Shell:
use admin
db.createUser({
user:"admin",
pwd:"abc123",
roles:[{role:"userAdminAnyDatabase",db:"admin"}],
passwordDigestor:"server"
})
Further you can refer enable authentication
If you use User Management Methods you have to set param passwordDigestor.
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor: "<server|client>"
}
)
See the SCRAM-SHA-256 password creation with digest or undigest here
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor : "<server|client>"
}
)
This error comes up only when you are accessing it remotely.
If passwordDigestor is client then mechanisms is not compatible with SCRAM-SHA-256 and only SCRAM-SHA-1 can be used.
use admin
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
mechanisms: [ "SCRAM-SHA-1" ],
passwordDigestor: "client"
}
)
If passwordDigestor is server then both mechanisms i.e. SCRAM-SHA-1 and SCRAM-SHA-256 can be used or it works even if you don't specify it at all.
use admin
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor: "server"
}
)
use "database name"
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "dbOwner", db: "database name" } ],
mechanisms:[
"SCRAM-SHA-1"
]
}
)
I am running a windows subsystem for linux using Ubuntu and was getting this error. Sometimes there's an issue that windows doesn't seem to close mongod correctly on exit so you need to Ctrl+Shift+Esc into task manager and close it manually.
Actually, whenever mongo seems to be doing anything unusual this seems to be the problem.
Then run mongod. In another terminal try adding your user again.
I would like to create a mongo user who can read local database. I try to use command on local database:
db.createUser(
{ user: "readonlyuser", pwd: "loh8Ephi",
roles: [ { role: "read", db: "local" } ]
})
But - it doesn't work. I receive:
connecting to: local
2015-12-21T14:08:07.904+0100 Error: couldn't add user: Cannot create users in the local database at src/mongo/shell/db.js:1054
I've tried to create that user against admin database:
> use admin
switched to db admin
> db.createUser(
... { user: "readonlyuser", pwd: "loh8Ephi", roles: [ { role: "read", db: "local" } ] })
Successfully added user: {
"user" : "readonlyuser",
"roles" : [
{
"role" : "read",
"db" : "local"
}
]
And now i try to connect:
undefine#machine:~$ mongo -u readonlyuser -p loh8Ephi local
MongoDB shell version: 2.6.11
connecting to: local
2015-12-21T15:35:19.190+0100 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18 } at src/mongo/shell/db.js:1292
exception: login failed
How to create readonly user who have access only to local database?
According the documentation, you cannot create users on the local database. Instead you can run your createUser query against the admin database:
use admin
db.createUser(
{ user: "readonlyuser", pwd: "loh8Ephi",
roles: [ { role: "read", db: "local" } ]
})
Please note that you will have to authenticate against the admin database when connecting.
I would do it like below
use admin
db.getSiblingDB("local").runCommand( { "createUser" : "mongoread", "pwd": "read0nly", "customData" : { "description": "mongo readonly user" }, "roles" : [ {"role" : "read","db" : "local"}] },{ w: "majority" , wtimeout: 5000 } );
i have added auth to my MongoDB instance. I created a user with the following command
db.createUser(
{ user: "cocodrile", pwd: "amazonas",
roles: [
{ role: "userAdminAnyDatabase", db: "admin"},
{ role: "dbOwner", db: "admin"},
{ role: "dbOwner", db: "brasil_database"},
{ role: "dbOwner", db: "usa_database"} ,
{ role: "dbOwner", db: "argentina_database"},
{ role: "dbOwner", db: "test"}] })
I want to perform a db.fsyncLock() and it says:
db.fsyncLock()
{
"ok" : 0,
"errmsg" : "not authorized on admin to execute command { fsync: 1.0, lock: true }",
"code" : 13
}
What i am doing wrong?
Thanks!
You're missing the hostManager built-in role, which has permissions to monitor and manage servers and perform some cluster-as-a-whole actions like fsync.
I have a mongo user with backup role, when running mongodump, I got the following error:
014-06-13T14:10:53.226-0400 test.system.profile to /backup/mongodb/06-13-2014/test/system.profile.bson
assertion: 11010 count fails:{ ok: 0.0, errmsg: "not authorized on test to execute command { count: "system.profile", query: {} }", code: 13 }
Here is the user setting:
"_id" : "admin.backupAdmin",
"user" : "backupAdmin",
"db" : "admin",
"roles" : [
{
"role" : "backup",
"db" : "admin"
}
]
any help is very appreciated.
In case someone still have problem with that. This is a bug in MongoDB bult-in roles: https://jira.mongodb.org/browse/SERVER-21724
If you don't want to update, here is an online fix without granting dbAdmin:
db.createRole({
role: "backup_fix",
privileges: [
{ resource: { db: "", collection: "system.profile" }, actions: [ "find"] },
],
roles: [
]
})
db.grantRolesToUser("YOUR_BACKUP_USER", [{"role": "backup_fix", "db": "admin"}]);
The backup role you are using provides sufficient privileges to use the MongoDB Management Service (MMS) backup agent to use mongodump or to back up an entire mongod instance.
To backup a given database, you must have read access on the database.To backup the system.profile collection in a database, you must have read access on certain system collections in the database.
So in case you have single instance its enough to have the following role:
db.grantRolesToUser("backupUser", [{role: "dbAdmin", db:"admin"}])
Incase you maintain any shard or replica you can have the below role:
db.grantRolesToUser("backupUser", [{role: "clusterAdmin", db:"admin"}])
I believe you need the dbAdmin role to backup system.profile.
It might not be the best approach, but the error can be fixed by granting the dbAdminAnyDatabase role for the backup user.
db.grantRolesToUser("backupUser", [{role: "dbAdminAnyDatabase", db:"admin"}])
Is there a super UNIX like "root" user for MongoDB? I've been looking at http://docs.mongodb.org/manual/reference/user-privileges/ and have tried many combinations, but they all seem to lack in an area or another. Surely there is a role that is above all the ones listed there.
The best superuser role would be the root.The Syntax is:
use admin
db.createUser(
{
user: "root",
pwd: "password",
roles: [ "root" ]
})
For more details look at built-in roles.
While out of the box, MongoDb has no authentication, you can create the equivalent of a root/superuser by using the "any" roles to a specific user to the admin database.
Something like this:
use admin
db.addUser( { user: "<username>",
pwd: "<password>",
roles: [ "userAdminAnyDatabase",
"dbAdminAnyDatabase",
"readWriteAnyDatabase"
] } )
Update for 2.6+
While there is a new root user in 2.6, you may find that it doesn't meet your needs, as it still has a few limitations:
Provides access to the operations and all the resources of the
readWriteAnyDatabase, dbAdminAnyDatabase, userAdminAnyDatabase and
clusterAdmin roles combined.
root does not include any access to collections that begin with the
system. prefix.
Update for 3.0+
Use db.createUser as db.addUser was removed.
Update for 3.0.7+
root no longer has the limitations stated above.
The root has the validate privilege action on system. collections.
Previously, root does not include any access to collections that begin
with the system. prefix other than system.indexes and
system.namespaces.
Mongodb user management:
roles list:
read
readWrite
dbAdmin
userAdmin
clusterAdmin
readAnyDatabase
readWriteAnyDatabase
userAdminAnyDatabase
dbAdminAnyDatabase
create user:
db.createUser(user, writeConcern)
db.createUser({ user: "user",
pwd: "pass",
roles: [
{ role: "read", db: "database" }
]
})
update user:
db.updateUser("user",{
roles: [
{ role: "readWrite", db: "database" }
]
})
drop user:
db.removeUser("user")
or
db.dropUser("user")
view users:
db.getUsers();
more information: https://docs.mongodb.com/manual/reference/security/#read
There is a Superuser Roles: root, which is a Built-In Roles, may meet your need.
I noticed a lot of these answers, use this command:
use admin
which switches to the admin database. At least in Mongo v4.0.6, creating a user in the context of the admin database will create a user with "_id" : "admin.administrator":
> use admin
> db.getUsers()
[ ]
> db.createUser({ user: 'administrator', pwd: 'changeme', roles: [ { role: 'root', db: 'admin' } ] })
> db.getUsers()
[
{
"_id" : "admin.administrator",
"user" : "administrator",
"db" : "admin",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
],
"mechanisms" : [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}
]
I emphasize "admin.administrator", for I have a Mongoid (mongodb ruby adapter) application with a different database than admin and I use the URI to reference the database in my mongoid.yml configuration:
development:
clients:
default:
uri: <%= ENV['MONGODB_URI'] %>
options:
connect_timeout: 15
retry_writes: false
This references the following environment variable:
export MONGODB_URI='mongodb://administrator:changeme#127.0.0.1/mysite_development?retryWrites=true&w=majority'
Notice the database is mysite_development, not admin. When I try to run the application, I get an error "User administrator (mechanism: scram256) is not authorized to access mysite_development".
So I return to the Mongo shell delete the user, switch to the specified database and recreate the user:
$ mongo
> db.dropUser('administrator')
> db.getUsers()
[]
> use mysite_development
> db.createUser({ user: 'administrator', pwd: 'changeme', roles: [ { role: 'root', db: 'admin' } ] })
> db.getUsers()
[
{
"_id" : "mysite_development.administrator",
"user" : "administrator",
"db" : "mysite_development",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
],
"mechanisms" : [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}
]
Notice that the _id and db changed to reference the specific database my application depends on:
"_id" : "mysite_development.administrator",
"db" : "mysite_development",
After making this change, the error went away and I was able to connect to MongoDB fine inside my application.
Extra Notes:
In my example above, I deleted the user and recreated the user in the right database context. Had you already created the user in the right database context but given it the wrong roles, you could assign a mongodb built-in role to the user:
db.grantRolesToUser('administrator', [{ role: 'root', db: 'admin' }])
There is also a db.updateUser command, albiet typically used to update the user password.
It is common practice to have a single db that is used just for the authentication data for a whole system.
On the connection uri, as well as specifying the db that you are connecting to use, you can also specify the db to authenticate against.
"mongodb://usreName:passwordthatsN0tEasy2Gue55#mongodb.myDmoain.com:27017/enduserdb?authSource=myAuthdb"
That way you create all your user credentions AND roles in that single auth db.
If you want a be all and end all super user on a db then, you just givem the role of "root#thedbinquestion"
for example...
use admin
db.runCommand({
"updateUser" : "anAdminUser",
"customData" : {
},
"roles" : [
{
"role" : "root",
"db" : "thedbinquestion"
} ] });
now you can change your built-in role to atlas admin in the console;
this fixed my issue.
"userAdmin is effectively the superuser role for a specific database. Users with userAdmin can grant themselves all privileges. However, userAdmin does not explicitly authorize a user for any privileges beyond user administration." from the link you posted