2

Hi I created a new using using following command in mongodb,

db.createUser({ user: 'csquad', pwd: 'somepass123', roles: [ { role: "readWrite", db: "cloud"}]});

Now this user is able to login to db Cloud and do any activities. Including he is able to create a user with same readWrite access to database cloud.

Now I wanted to update this user to a new role so that he has only Read and Write access to any Document or create any collections in this DB. Should not have access to create new user.

How or what role I should assign in MongoDB

Even if I create a user with role "read" still he is able to create a new user with readWrite. And the "read" user is still able to create new collections / add documents

Basically any user in the "cloud" database is able to perform any task irrespective of Roles assigned to them. Only restriction is they are able to do all task in the specified database (like they can't login to admin DB etc..)

  • A user with only the readWrite role should not have the permissions necessary to create a new user. The privileges granted by this role can be seen in the MongoDB docs <a href="docs.mongodb.com/manual/reference/built-in-roles/…>. Are you sure that this user only has the readWrite role? – Adam Harrison May 9 '18 at 22:17
3

I look like that you haven't enabled authentication (--auth) at the database. Without authentication, there is no authorization. That's why all users can do now whatever they want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.