I would like to create a mongo user who can read local database. I try to use command on local database:
db.createUser(
{ user: "readonlyuser", pwd: "loh8Ephi",
roles: [ { role: "read", db: "local" } ]
})
But - it doesn't work. I receive:
connecting to: local
2015-12-21T14:08:07.904+0100 Error: couldn't add user: Cannot create users in the local database at src/mongo/shell/db.js:1054
I've tried to create that user against admin database:
> use admin
switched to db admin
> db.createUser(
... { user: "readonlyuser", pwd: "loh8Ephi", roles: [ { role: "read", db: "local" } ] })
Successfully added user: {
"user" : "readonlyuser",
"roles" : [
{
"role" : "read",
"db" : "local"
}
]
And now i try to connect:
undefine#machine:~$ mongo -u readonlyuser -p loh8Ephi local
MongoDB shell version: 2.6.11
connecting to: local
2015-12-21T15:35:19.190+0100 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18 } at src/mongo/shell/db.js:1292
exception: login failed
How to create readonly user who have access only to local database?
According the documentation, you cannot create users on the local database. Instead you can run your createUser query against the admin database:
use admin
db.createUser(
{ user: "readonlyuser", pwd: "loh8Ephi",
roles: [ { role: "read", db: "local" } ]
})
Please note that you will have to authenticate against the admin database when connecting.
I would do it like below
use admin
db.getSiblingDB("local").runCommand( { "createUser" : "mongoread", "pwd": "read0nly", "customData" : { "description": "mongo readonly user" }, "roles" : [ {"role" : "read","db" : "local"}] },{ w: "majority" , wtimeout: 5000 } );
Related
I just installed a fresh mongodb on Ubuntu server and when i try to adduser i am getting error
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
2018-07-03T13:29:41.556+0530 E QUERY [thread1] Error: couldn't add user: Use of SCRAM-SHA-256 requires undigested passwords :
_getErrorWithCode#src/mongo/shell/utils.js:25:13
DB.prototype.createUser#src/mongo/shell/db.js:1437:15
#(shell):1:1
This works for me:
db.createUser({
user:"test1",
pwd:"test1",
roles:[
{
role:"readWrite",
db:"u8"
}
],
mechanisms:[
"SCRAM-SHA-1"
]
})
Go with following commands in Mongo Shell:
use admin
db.createUser({
user:"admin",
pwd:"abc123",
roles:[{role:"userAdminAnyDatabase",db:"admin"}],
passwordDigestor:"server"
})
Further you can refer enable authentication
If you use User Management Methods you have to set param passwordDigestor.
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor: "<server|client>"
}
)
See the SCRAM-SHA-256 password creation with digest or undigest here
db.createUser(
{
user: "admin",
pwd: "ADYkdfd332##33",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor : "<server|client>"
}
)
This error comes up only when you are accessing it remotely.
If passwordDigestor is client then mechanisms is not compatible with SCRAM-SHA-256 and only SCRAM-SHA-1 can be used.
use admin
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
mechanisms: [ "SCRAM-SHA-1" ],
passwordDigestor: "client"
}
)
If passwordDigestor is server then both mechanisms i.e. SCRAM-SHA-1 and SCRAM-SHA-256 can be used or it works even if you don't specify it at all.
use admin
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ],
passwordDigestor: "server"
}
)
use "database name"
db.createUser(
{
user: "username",
pwd: "password",
roles: [ { role: "dbOwner", db: "database name" } ],
mechanisms:[
"SCRAM-SHA-1"
]
}
)
I am running a windows subsystem for linux using Ubuntu and was getting this error. Sometimes there's an issue that windows doesn't seem to close mongod correctly on exit so you need to Ctrl+Shift+Esc into task manager and close it manually.
Actually, whenever mongo seems to be doing anything unusual this seems to be the problem.
Then run mongod. In another terminal try adding your user again.
In Mongo, I've created a database and created a user specifically for that database. When I type "show users" I get this:
rs0:PRIMARY> show users;
{
"_id" : "sampleuser.sampleuser",
"user" : "sampleuser",
"db" : "sampledb",
"roles" : [
{
"role" : "readWrite",
"db" : "sampledb"
},
{
"role" : "dbAdmin",
"db" : "sampledb"
}
]
}
But when I try to execute a command with that user, I get the following:
not authorized on sampledb to execute command { find: "social_posts", filter: { customer_id: "123", 0: { posted: { $ne: 1 } } } }
What permissions are setup wrong?
You have to use db.auth() to authenticate to the database before executing any query.
From db.auth() doc
db.auth()
Allows a user to authenticate to the database from within the shell.
The db.auth() method can accept:
the username and password.
db.auth( <username>, <password> )
a user document that contains the username and password, and optionally, the authentication mechanism and a digest password flag.
db.auth( {
user: <username>,
pwd: <password>,
mechanism: <authentication mechanism>,
digestPassword: <boolean>
}
Returns: db.auth() returns 0 when authentication is not successful, and 1 when the operation is successful.
I'm starting with MongoDB and I would like to user/pass access to the dbs.
The first thing I did was to create and admin user and start mongodb with auth activate, this is my created user:
db.getUser("admin")
{
"_id" : "admin.admin",
"user" : "admin",
"db" : "admin",
"roles" : [
{
"role" : "dbAdminAnyDatabase",
"db" : "admin"
},
{
"role" : "clusterAdmin",
"db" : "admin"
}
] }
}
After that, I try to create users with the following commands:
use newdb
db.createUser(
{
user: "newuser",
pwd: "12345678",
roles: [ { role: "readWrite", db: "newdb" } ]
}
)
But I got this error:
Error: couldn't add user: not authorized on newdb to execute command {
createUser: "newuser", pwd: "xxx", roles: [ { role: "readWrite", db:
"newdb" } ], digestPassword: false, writeConcern: { w: "majority",
wtimeout: 30000.0 } } at src/mongo/shell/db.js:1004
I have googled about it but there are only two results, one on Chinese and the other not related, so I'm a little lost. Any idea ? It looks like my admin user doesn't have privilege, I access to the mongodb with the following command:
$mongo --port 27017 -u adminUser -p adminPass --authenticationDatabase admin
Thanks in advance.
Stop the running instance of mongod
mongod --config /usr/local/etc/mongod.conf --auth
then start without --auth like
mongod --config /usr/local/etc/mongod.conf
then update your roles like
db.updateUser("admin",{roles :
["userAdminAnyDatabase","userAdmin","readWrite","dbAdmin","clusterAdmin","readWriteAnyDatabase","dbAdminAnyDatabase"]});
Now again start mongod with --auth and try.
The idea is you have to create user under "admin" database with all the ROLES mentioned above.
But this user is not part of other databases. So once you created the admin user,
then login as that admin user,
SERVER: mongod --config /usr/local/etc/mongod.conf --auth
CLIENT: ./mongodb/bin/mongo localhost:27017/admin -u adminUser -p
123456
use APPLICATION_DB
again create a new user (say APP_USER) for this APPLICATION_DB. This time for this application user you need only "dbOwner" role.
db.createUser({user:"test", pwd:"test", roles:['dbOwner']})
Now your application has to use this APP_USER and APP_DB.
I fixed the same problem just exit and login as admin
mongo -u admin
enter your admin user password
after login, create a user as usual you mentioned
use newdb
db.createUser(
{
user: "newuser",
pwd: "12345678",
roles: [ { role: "readWrite", db: "newdb" } ]
}
)
in my case:
1.stop mongodb :
$ service mongod stop
2.editing this /etc/mongod.conf:
security:
authorization: "disabled"
3.then I start again service:
$ service mongod start
4.Add user:
$ mongo mongodb://localhost:27017
use admin
db.createUser(
{
user: "myUserAdmin",
pwd: "abc123",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
5.comment lines from /etc/mongod.conf added in step 2
6.restart mongod
service mongod restart
You should exit the current mongod process and restart it again without parameter --auth.
On Terminal type: mongod
After the process of mongod gets started then you can open new terminal tab to run mongo shell command :
mongo --shell
use new_your_database
db.createUser(
{
user: "mongo_admin",
pwd: "mongo_admin",
roles: [ "readWrite", "dbAdmin" ]
}
)
it should be done successfully....
Below command says, you have created admin user and password.
db.getUser("admin")
{
"_id" : "admin.admin",
"user" : "admin",
"db" : "admin",
"roles" : [
{
"role" : "dbAdminAnyDatabase",
"db" : "admin"
},
{
"role" : "clusterAdmin",
"db" : "admin"
}
] }
}
Once you create the admin user and password, Mongo will not allow you to do any schema update as normal a admin user which you used to login previously.
Use newly created admin user and password to create new users or do any updates. It should work.
If you're here with the same issue & having a config file to trigger mongod instances- then go ahead and exit from the running process of mongod & in your config file make sure you make security.authorization : disabled, in addition if you've keyFile (i.e; path to a cert file), then comment that spec as well, now start you mongod process using that config file - you should be able to create an user using admin db.
If you work on replica set : Once if you're done with creating a primary node + a user, make sure you initiate & connect to replica set (which again internally connects to primary node),here you can do anything with earlier created user, but when you connect directly to primary node again to execute few commands like rs.initiate()/rs.status()/show dbs/show users, you would end-up getting errors like (there are no users authenticated).
security:
authorization: disabled
# keyFile: /opt/mongodb/keyfile
i have added auth to my MongoDB instance. I created a user with the following command
db.createUser(
{ user: "cocodrile", pwd: "amazonas",
roles: [
{ role: "userAdminAnyDatabase", db: "admin"},
{ role: "dbOwner", db: "admin"},
{ role: "dbOwner", db: "brasil_database"},
{ role: "dbOwner", db: "usa_database"} ,
{ role: "dbOwner", db: "argentina_database"},
{ role: "dbOwner", db: "test"}] })
I want to perform a db.fsyncLock() and it says:
db.fsyncLock()
{
"ok" : 0,
"errmsg" : "not authorized on admin to execute command { fsync: 1.0, lock: true }",
"code" : 13
}
What i am doing wrong?
Thanks!
You're missing the hostManager built-in role, which has permissions to monitor and manage servers and perform some cluster-as-a-whole actions like fsync.
Is there a super UNIX like "root" user for MongoDB? I've been looking at http://docs.mongodb.org/manual/reference/user-privileges/ and have tried many combinations, but they all seem to lack in an area or another. Surely there is a role that is above all the ones listed there.
The best superuser role would be the root.The Syntax is:
use admin
db.createUser(
{
user: "root",
pwd: "password",
roles: [ "root" ]
})
For more details look at built-in roles.
While out of the box, MongoDb has no authentication, you can create the equivalent of a root/superuser by using the "any" roles to a specific user to the admin database.
Something like this:
use admin
db.addUser( { user: "<username>",
pwd: "<password>",
roles: [ "userAdminAnyDatabase",
"dbAdminAnyDatabase",
"readWriteAnyDatabase"
] } )
Update for 2.6+
While there is a new root user in 2.6, you may find that it doesn't meet your needs, as it still has a few limitations:
Provides access to the operations and all the resources of the
readWriteAnyDatabase, dbAdminAnyDatabase, userAdminAnyDatabase and
clusterAdmin roles combined.
root does not include any access to collections that begin with the
system. prefix.
Update for 3.0+
Use db.createUser as db.addUser was removed.
Update for 3.0.7+
root no longer has the limitations stated above.
The root has the validate privilege action on system. collections.
Previously, root does not include any access to collections that begin
with the system. prefix other than system.indexes and
system.namespaces.
Mongodb user management:
roles list:
read
readWrite
dbAdmin
userAdmin
clusterAdmin
readAnyDatabase
readWriteAnyDatabase
userAdminAnyDatabase
dbAdminAnyDatabase
create user:
db.createUser(user, writeConcern)
db.createUser({ user: "user",
pwd: "pass",
roles: [
{ role: "read", db: "database" }
]
})
update user:
db.updateUser("user",{
roles: [
{ role: "readWrite", db: "database" }
]
})
drop user:
db.removeUser("user")
or
db.dropUser("user")
view users:
db.getUsers();
more information: https://docs.mongodb.com/manual/reference/security/#read
There is a Superuser Roles: root, which is a Built-In Roles, may meet your need.
I noticed a lot of these answers, use this command:
use admin
which switches to the admin database. At least in Mongo v4.0.6, creating a user in the context of the admin database will create a user with "_id" : "admin.administrator":
> use admin
> db.getUsers()
[ ]
> db.createUser({ user: 'administrator', pwd: 'changeme', roles: [ { role: 'root', db: 'admin' } ] })
> db.getUsers()
[
{
"_id" : "admin.administrator",
"user" : "administrator",
"db" : "admin",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
],
"mechanisms" : [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}
]
I emphasize "admin.administrator", for I have a Mongoid (mongodb ruby adapter) application with a different database than admin and I use the URI to reference the database in my mongoid.yml configuration:
development:
clients:
default:
uri: <%= ENV['MONGODB_URI'] %>
options:
connect_timeout: 15
retry_writes: false
This references the following environment variable:
export MONGODB_URI='mongodb://administrator:changeme#127.0.0.1/mysite_development?retryWrites=true&w=majority'
Notice the database is mysite_development, not admin. When I try to run the application, I get an error "User administrator (mechanism: scram256) is not authorized to access mysite_development".
So I return to the Mongo shell delete the user, switch to the specified database and recreate the user:
$ mongo
> db.dropUser('administrator')
> db.getUsers()
[]
> use mysite_development
> db.createUser({ user: 'administrator', pwd: 'changeme', roles: [ { role: 'root', db: 'admin' } ] })
> db.getUsers()
[
{
"_id" : "mysite_development.administrator",
"user" : "administrator",
"db" : "mysite_development",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
],
"mechanisms" : [
"SCRAM-SHA-1",
"SCRAM-SHA-256"
]
}
]
Notice that the _id and db changed to reference the specific database my application depends on:
"_id" : "mysite_development.administrator",
"db" : "mysite_development",
After making this change, the error went away and I was able to connect to MongoDB fine inside my application.
Extra Notes:
In my example above, I deleted the user and recreated the user in the right database context. Had you already created the user in the right database context but given it the wrong roles, you could assign a mongodb built-in role to the user:
db.grantRolesToUser('administrator', [{ role: 'root', db: 'admin' }])
There is also a db.updateUser command, albiet typically used to update the user password.
It is common practice to have a single db that is used just for the authentication data for a whole system.
On the connection uri, as well as specifying the db that you are connecting to use, you can also specify the db to authenticate against.
"mongodb://usreName:passwordthatsN0tEasy2Gue55#mongodb.myDmoain.com:27017/enduserdb?authSource=myAuthdb"
That way you create all your user credentions AND roles in that single auth db.
If you want a be all and end all super user on a db then, you just givem the role of "root#thedbinquestion"
for example...
use admin
db.runCommand({
"updateUser" : "anAdminUser",
"customData" : {
},
"roles" : [
{
"role" : "root",
"db" : "thedbinquestion"
} ] });
now you can change your built-in role to atlas admin in the console;
this fixed my issue.
"userAdmin is effectively the superuser role for a specific database. Users with userAdmin can grant themselves all privileges. However, userAdmin does not explicitly authorize a user for any privileges beyond user administration." from the link you posted