Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-7604

On MongoS read-only users should be denied access to system.users collection

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 2.2.4
    • Affects Version/s: 2.2.1
    • Component/s: Security
    • None
    • ALL

      On MongoD

      Steps to reproduce:

      Create a read-only user in any database:

      > db.addUser('mod', 'pass', true)
      

      Restart with mongod --auth.

      > db.auth('mod','pass')
      > db.system.users.find()
      error: {
        "$err": "unauthorized db:test ns:test.system.users lock type:1 client:127.0.0.1",
        "code": 10057
      }
      

      On MongoS started --keyFile filename and members with --auth --keyFile filename

      > db.auth('mod','pass')
      > db.system.users.find()
      
      { "_id": ObjectId("509cea7b45f86c6fcc64b71c"), "user": "mod", "readOnly": true, "pwd": "aa387b99960161d09f7a38d57fd7a15a" }
      

      Note that the mongoD is not part of the mongoS shard. And same occurs on localhost and connecting from a remote host in LAN.

            Assignee:
            spencer@mongodb.com Spencer Brody (Inactive)
            Reporter:
            gianfranco Gianfranco Palumbo
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: