Major - P3 The legacy method to create users, db.system.users.insert, can fail if the user does not have the proper access. In this case the password is exposed in both the mongod log and the error message propagated to the client:
> db.system.users.insert({user:'dbuser', pwd: 'pwd', roles: ['readWrite']});
m27000| 2014-06-06T13:13:28.706-0400 [conn1] Unauthorized not authorized on admin to execute command { insert: "system.users", documents: [ { _id: ObjectId('5391f6b83cbc4b1dc741c821'), user: "dbuser", pwd: "pwd", roles: [ "readWrite" ] } ], ordered: true }
WriteResult({
"writeError" : {
"code" : 13,
"errmsg" : "not authorized on admin to execute command { insert: \"system.users\", documents: [ { _id: ObjectId('5391f6b83cbc4b1dc741c821'), user: \"dbuser\", pwd: \"pwd\", roles: [ \"readWrite\" ] } ], ordered: true }"
}
})