Mongo newb here. I have a mongo installation with four databases and would like to create a user that can read and write to all the databases. I tried:
use admin;
db.addUser({user: "foo" , pwd: "bar", roles: [ "readWriteAnyDatabase" ]})
but when I try to do
mongo someotherdb -u foo -p
and authenticate with the correct password it gives me an authentication error.
I also tried manually adding the users to the other databases by doing this
use someotherdb
db.addUser({user: "foo", roles: ['readWrite'], userSource: "admin"});
and still no dice trying to log in via the mongo shell or using the auth command in the target db.
Am I doing something wrong? How do you go about making a user who can globally read and write to any db? Do you have to add said user to each db's system.users collection or is that not necessary if they have the "readWriteAnyDatabase" role?
I'm using mongo 2.4 on ubuntu.
So, I've finally figured this out. Note, this fix only works for Mongo 2.4.
In 2.4 you can specify a database to authenticate yourself with in the connection string or on the command line
So to create the initial user
use admin
db.createUser({user: "foo" , pwd: "bar", roles: [ "userAdminAnyDatabase","readWriteAnyDatabase" ]})
and to authenticate use
mongo -u foo --authenticationDatabase admin -p
Now you should be able to do whatever you want to any DB
Related
I've an instance of MongoDB 4 running on server with replica set on same machine with differente ports.
I've created a super user using these commands:
use admin
db.createUser({user: "mongo_admin",pwd: "password",roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]);
then I've created a dedicated user for my new db database1
use database1
db.createUser({
user: "user1",
pwd: "password",
roles: ["readWrite", "dbAdmin"]
});
after this, I've enabled auth an so I user db.auth to working with my database1 (using "user1").
That's good and it works.
Now, my problem is: I need to create other database and then create a dedicated user for admin this database but, with auth enabled I can't do anything on the new created database database2. If I try, using my mongo_admin superuser to connect to the new database2 and trying to create a dbAdmin for this database using this command:
mongo
db.auth("mongo_admin", "password")
use database2
db.createUser({user: "user2, pwd: "password",roles: ["readWrite", "dbAdmin"]});
I recive this error:
E QUERY [js] Error: couldn't add user: not authorized on database2 to execute command
So, now I know that I can disable auth and work free on every database but, I don't want to do this because database is on production and I prefer to avoid this.
Any suggestion?
We have a development team that will periodically take a mongodump out of DEV and then restore it back to their local host for work. We have recently implemented authentication in mongodb and i would like to be able to allow our development team do a mongodump on one DB only so they can restore it to their local host.
I have a role that inherits the backup role from Admin, but that is for our DBA to backup the whole system.
My question, how do I allow for this backup role to be used by a specific user (lets call them "webdev") for a specific DB (lets call it "products")?
You can create an user in the products database with read permissions:
> use products
> db.createUser( {
user: "webdev",
pwd: "password",
roles: [ "read" ]
} )
Just remember to call mongodump with --excludeCollectionsWithPrefix=system
mongodump --excludeCollectionsWithPrefix=system
In order to avoid permission errors (assuming you are using Mongo 3)
I am using MongoDB3.4 version, First of all you want one root access for admin database and connect mongo shell,
$ mongo -u username -p xxxxxx --authenticationDatabase admin
After connecting mongoshell, change the database,
use products
After change the DB create the new user,
db.createUser(
{
user: "webdev",
pwd: "xxxxx",
roles: [
{ role: "read", db: "products" },
{ role: "backup", db: "products"}
]
}
)
Above I mentioned, webdev user can be able to read the all collections and take backup access also.
db.auth('webdev', 'xxxxx')
after successfully authenticate, you can able to read and take backup from DEV server.
Below I mentioned mongodump query with new webdev user.
mongodump --host hostname --port 27017 --username webdev --password xxxxx --authenticationDatabase products --db products --collection collection_name --out mongodump_outpath
Refer: https://docs.mongodb.com/manual/reference/built-in-roles/#backup
Note:
Don't take mongodump frequently in production. It will impacts the
performance issue.
Don't give backup and restore access to any other teams like developer,
tester,..etc
Admin or DBA only do every time Backup/Restore.
Thank You. Please revert for any concern.
I have mongodb server with auth=true and many databases. I'm trying to connect to it remotely using admin database:
mongo --host xxx admin --username admin --password secretPassword
(WORK)
mongo --host xxx products --username admin --password secretPassword
(DOESN'T WORK)
I can connect to admin database and switch to products. But developers using connection string to connect to specific database using same username and password.
I can create admin user for each database but databases are pretty dynamic some added some removed. I've read thread about global admin but set up user role doesn't help
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
and
--authenticationDatabase
Is not an option because a lot of code has to be rewritten.
Is there a way to setup one global admin that anyone can connect to remote database with username and password?
If you are using MongoDB 3.0+, the default location for users is the admin database. You will have to use --authenticationDatabase in this case going forward anyway.
With centralized users, you can define roles with access to all databases as necessary:
https://docs.mongodb.org/manual/reference/built-in-roles/
It sounds like you may want to refactor the database connection code, especially if "a lot of code" has to be rewritten, that sounds like you haven't been following DRY--"don't repeat yourself" principles.
My MongoDB is hosted on compose.io and is called ScroungeBA.
I try to create a user with some built-in roles which by the documentary only work in the admin database:
MongoDB provides all other built-in roles only on the admin database
So my question: What is that admin db about? Is it the standard db which always exists?
Furthermore I have trouble with (using MongoDB shell version: 3.0.5):
$ use admin
switched to db admin
$ db.auth("user", "secret")
Error: 18 Authentication failed.
I guess my user does exist in the ScroungeBA db but not in the admin db? How can I create a user in the admin db since
db.createUser({user:"hello", pwd:"world", roles:[{role: "userAdmin", db: "admin"}]})
results in the error:
Error: couldn't add user: not authorized on admin to execute command { createUser: "hello", pwd: "xxx", roles: [ { role: "userAdmin", db: "admin" } ], digestPassword: false, writeConcern: { w: "majority", wtimeout: 30000.0 } }
at Error (<anonymous>)
at DB.createUser (src/mongo/shell/db.js:1101:11)
at (shell):1:4 at src/mongo/shell/db.js:1101
The admin database is a special database that you automatically have with a MongoDB instance. It contains things like the users of your databases, with roles, custom data, etc.
To create a user in the admin database, you have to temporarily disable auth on your MongoDB instance. I don't know how compose.io works specifically, but I usually modify the mongod.conf file, and comment the line auth=true.
After that, you can connect to your MongoDB shell and create a user in the admin database.
Give the user the role userAdminAnyDatabase instead of just useAdmin.
use admin
db.createUser({ user:"admin", pwd: "pass", roles: [{role: "userAdminAnyDatabase", db: "admin"}] })
An user with the role userAdminAnyDatabase can manage the users of all the databases.
Now enable auth again and restart the service.
As I said, I'm not sure how compose.io actually works and how much control it gives to you. If you don't have an admin account, this should be the way to go.
By the way, I've published an article on Medium about MongoDB 3.0 auth.
This solved my problem:
I finally got it to work on compose.io! So here it what my oplog url ended up looking like:
"MONGO_OPLOG_URL": "mongodb://username:password#single.18.mongolayerhost.com:1111/local?authSource=myDB"
I keep the MONGO_URL exactly the same as the URL compose.io provides with ?replicaSet
But for the OPLOG_URL you can only use a single host, not multiple. So you have to edit the URL compose.io gives you to only have one host. And you can't end the oplog with ?replicaSet. you can only have the ?replicaSet in the MONGO_URL.
source
Flow to set authentication :
Start MongoDB without access control.
mongod --port 27017 --dbpath /data/db1
Connect to the instance.
mongo --port 27017
Create the user administrator.
use admin
db.createUser(
{
user: "myUserAdmin",
pwd: "abc123",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
Re-start the MongoDB instance with access control.
mongod --auth --port 27017 --dbpath /data/db1
Authenticate as the user administrator.
Start a mongo shell with the -u , -p , and the --authenticationDatabase command line options:
mongo --port 27017 -u "myUserAdmin" -p "abc123"
--authenticationDatabase "admin"
An user with the role userAdminAnyDatabase can manage the users of all the databases.
For routine user creation, you must possess the following permissions:
To create a new user in a database, you must have the createUser action on that database resource.
To grant roles to a user, you must have the grantRole action on the role’s database.
MongoDB stores all user information, including name, password, and the user's authentication database, in the system.users collection in the admin database.
More Details : https://docs.mongodb.com/manual/tutorial/enable-authentication/
You can try this:
use admin
db.createUser( { user: "user", pwd: "password", roles: [
"readWriteAnyDatabase","dbAdminAnyDatabase","clusterAdmin" ] } )
I've an annoying problem with my mongo db (v2.6). I've added a root user to it, with role:
{role: "root", db: "admin"}
My problem is, that I wanted to set authentication for other databases, but I can add user, without command line. I've used this in command line:
db.createUser({user: "dbuser", pwd: "dbpass", roles: ["dbAdmin"]})
It's ok. But I'm not a true command-line-lover, so I like AdminUIs. I'm using MongoHUB for it. I can login, add/remove collections on any database, but I can't create user for databases. I get this error:
not authorized on admin to execute command
I've read this on the manual:
"root does not include the ability to insert data directly into the system.users and system.roles collections in the admin database."
So what is the correct role for me?
Thanks for the help.