-
Type: Bug
-
Resolution: Won't Fix
-
Priority: Major - P3
-
None
-
Affects Version/s: 2.3.2
-
Component/s: Security
-
None
-
ALL
db.addUser({user:'admin', pwd:'password', roles:['nonsenseRole']})
succeeds and inserts the document into system.users. Authenticating with that user will also succeed, though no privileges will be granted (in the logs there's a message "Privilege acquisition failed for admin@admin in database admin: No such role, nonsenseRole, in database admin (BadValue)")
- related to
-
SERVER-8597 Authenticating as a user that has a non-existent role prevents acquiring any privileges, even if that user has other valid roles
- Closed