Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-17917

Config DB gets updated even though the user has no permissions

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 3.1.2
    • Affects Version/s: 3.0.1
    • Component/s: Security, Sharding
    • None
    • Minor Change
    • ALL
    • Hide
      mongos> use admin
      switched to db admin
      
      mongos> db.createUser({user:"alex", pwd:"pass", roles:[{db:"whatever", role:"readWrite"}]})
      Successfully added user: {
      "user" : "alex",
      "roles" : [
      {
      "db" : "whatever",
      "role" : "readWrite"
      }
      ]
      }
      

      Authenticating as the new user:

      mongos> db.auth("alex", "pass")
      1
      

      Notice the misspelled database name:

      mongos> use whatever3
      switched to db whatever3
      

      And, as expected, trying to access the misspelled database does not work:

      mongos> db.coll.find()
      Error: error: { "$err" : "not authorized for query on whatever3.coll", "code" : 13 }
      

      Switch back to being admin user

      mongos> use admin
      switched to db admin
      
      mongos> db.auth("admin", "pass")
      1
      
      mongos> sh.status()
      --- Sharding Status --- 
      
        sharding version: {
      
      "_id" : 1,
      "minCompatibleVersion" : 5,
      "currentVersion" : 6,
      "clusterId" : ObjectId("552424ff8024973cf28217f2")
      }
      
        shards:
      {  "_id" : "shard0000",  "host" : "localhost:27019" }
        balancer:
      Currently enabled:  yes
      Currently running:  no
      Failed balancer rounds in last 5 attempts:  0
      
      Migration Results for the last 24 hours: 
      No recent migrations
        databases:
      {  "_id" : "admin",  "partitioned" : false,  "primary" : "config" }
      {  "_id" : "whatever",  "partitioned" : false,  "primary" : "shard0000" }
      {  "_id" : "whatever3",  "partitioned" : false,  "primary" : "shard0000" }
      

      And notice in the above that although user alex did not have access to whatever3 database,whatever3 was still created in config database – definitely a source of confusion.

      mongos> show dbs
      admin   0.016GB
      config  0.016GB
      
      mongos> use config
      switched to db config
      
      
      mongos> db.databases.find()
      { "_id" : "admin", "partitioned" : false, "primary" : "config" }
      { "_id" : "whatever", "partitioned" : false, "primary" : "shard0000" }
      { "_id" : "whatever3", "partitioned" : false, "primary" : "shard0000" }
      
      Show
      mongos> use admin switched to db admin mongos> db.createUser({user: "alex" , pwd: "pass" , roles:[{db: "whatever" , role: "readWrite" }]}) Successfully added user: { "user" : "alex" , "roles" : [ { "db" : "whatever" , "role" : "readWrite" } ] } Authenticating as the new user: mongos> db.auth( "alex" , "pass" ) 1 Notice the misspelled database name: mongos> use whatever3 switched to db whatever3 And, as expected, trying to access the misspelled database does not work: mongos> db.coll.find() Error: error: { "$err" : "not authorized for query on whatever3.coll" , "code" : 13 } Switch back to being admin user mongos> use admin switched to db admin mongos> db.auth( "admin" , "pass" ) 1 mongos> sh.status() --- Sharding Status --- sharding version: { "_id" : 1, "minCompatibleVersion" : 5, "currentVersion" : 6, "clusterId" : ObjectId( "552424ff8024973cf28217f2" ) } shards: { "_id" : "shard0000" , "host" : "localhost:27019" } balancer: Currently enabled: yes Currently running: no Failed balancer rounds in last 5 attempts: 0 Migration Results for the last 24 hours: No recent migrations databases: { "_id" : "admin" , "partitioned" : false , "primary" : "config" } { "_id" : "whatever" , "partitioned" : false , "primary" : "shard0000" } { "_id" : "whatever3" , "partitioned" : false , "primary" : "shard0000" } And notice in the above that although user alex did not have access to whatever3 database,whatever3 was still created in config database – definitely a source of confusion. mongos> show dbs admin 0.016GB config 0.016GB mongos> use config switched to db config mongos> db.databases.find() { "_id" : "admin" , "partitioned" : false , "primary" : "config" } { "_id" : "whatever" , "partitioned" : false , "primary" : "shard0000" } { "_id" : "whatever3" , "partitioned" : false , "primary" : "shard0000" }

      In a sharded environment with auth, a user can misspell a database name and although he does not have permissions to that db, an entry is still made in the config DB

            Assignee:
            kaloian.manassiev@mongodb.com Kaloian Manassiev
            Reporter:
            alex.lerner Alex Lerner
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: