I have a ReplicaSet in which I created a user like this:
db.createUser({
user: "myuser",
pwd:"mypassword",
roles: [
{
role: "userAdminAnyDatabase",
db: "admin"
},
{
role: "dbAdminAnyDatabase",
db: "admin"
},
{
role: "readWriteAnyDatabase",
db:"admin"
},
{
role: "clusterAdmin",
db: "admin"
}
]});
When I activate then authorization in my config file like this:
security:
authorization: enabled
keyFile: /my/file.key
I restart replicaset nodes and try to connect using :
mongo mongodb://myuser:mypassword#host1:port,host2:port,host3:port/?replicaSet=myReplicaName&authSource=myDbName
I get Error: can't connect to new replica set master [ip:port], err: AuthenticationFailed: Authentication failed.
Any idea what could be missing?
Related
What would be the configuration/command for creating a role which can be applied to a user in MongoDB so that the user is unable to drop a collection?
Check the mongoDB documentation for creating user roles and privileges.
http://docs.mongodb.org/manual/tutorial/manage-users-and-roles/
In general, for a non-admin role, only providing read access will prevent a user from dropping a collection. The code below is taken from the mongo docs and demonstrates access modifications for various collections.
use reporting
db.createUser(
{
user: "reportsUser",
pwd: "12345678",
roles: [
{ role: "read", db: "reporting" },
{ role: "read", db: "products" },
{ role: "read", db: "sales" },
{ role: "readWrite", db: "accounts" }
]
}
)
My mongo shell is giving me this error when I am using show dbs command.
not authorized on admin to execute command
I have tried to create a user using
db.createUser(
{
user: "siteUserAdmin",
pwd: "password",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
as on https://docs.mongodb.com/v2.6/tutorial/add-user-administrator/
But it still gives me the same error:
Could not add user: not authorized on admin to execute command.
I am using Ubuntu 16.04 and mongoDB version is 3.4.9
I think you can use the role as root for Ubuntu. Try the below query.
use admin
db.createUser(
{
user: "admin",
pwd: "password",
roles: [ { role: "root", db: "admin" } ]
}
);
exit;
You can give read write permission to user as well
use admin
db.grantRolesToUser("admin",["readWrite"])
EDIT
Since the above didn't work try to start the instance with auth as below
Stop the mongod instance
Start the instance with $ mongod --auth
Now start mongo shell and create user
use admin
db.createUser(
{
user: "admin",
pwd: "password",
roles: [ { role: "root", db: "admin" } ]
}
);
exit;
Now give permission
db.auth("admin", "password")
db.grantRolesToUser("password", [ { role: "readWrite", db: "admin" } ])
Now check show users
I am struggling with the MongoDB authorization system. I have an application with must execute some very precise defined db.eval() statements. As we all know, this function requires special privileges.
I tried
use admin
db.createRole({ role: "dbEval", privileges: [{ resource: {anyResource: true}, actions: ["anyAction"]}], roles:[ { role: "readWrite", db: "test" }]})
use test
db.createUser({ user: "default", pwd: "default", roles: [ { role: "dbEval", db: "test" }] })
But I get the error message
Error: couldn't add user: No role named dbEval#test
How can I create a user in "admin" and let him allow "dbEval" role to be used in "test"?
Thanks!
What would be the configuration/command for creating a role which can be applied to a user in MongoDB so that the user is unable to drop a collection?
Check the mongoDB documentation for creating user roles and privileges.
http://docs.mongodb.org/manual/tutorial/manage-users-and-roles/
In general, for a non-admin role, only providing read access will prevent a user from dropping a collection. The code below is taken from the mongo docs and demonstrates access modifications for various collections.
use reporting
db.createUser(
{
user: "reportsUser",
pwd: "12345678",
roles: [
{ role: "read", db: "reporting" },
{ role: "read", db: "products" },
{ role: "read", db: "sales" },
{ role: "readWrite", db: "accounts" }
]
}
)
First I tried db.eval() for my local mogodb server.It is working fine.I used this example
Then I tried the same thing with MongoLab.But I got this error message.
The error say not authorized to execute command.Can you explain why this error message.thanks
Eval is a powerfull, dangerous and deprecated action that mLab don't give.
In a local mongo db you should create a role:
use admin
db.createRole(
{
role: "dangerEval",
privileges : [
{ resource: {anyResource: true }, actions : ["anyAction"] },
// or this for grant anyAction only on a single db:
{ resource: {db: "myDb", collection: "" }, actions: [ "anyAction" ] }
],
roles: []
}
)
Then you can assign this role to a user:
db.createUser({
user: "temporaneyEvalUser",
pwd: "psw",
roles: [ { role: "dangerEval", db: "myDb" } ]
});
So you have to choose another way to archive your target or change mongo installation.