0

I am trying to set up a MongoDB user that only has access to certain collections across several databases. The issue is that these databases are created dynamically at runtime.

I decided to employ collection level access in order to do this with the following permission on the user role:

"db" : "admin",
"privileges" : [ 
    {
        "resource " : {
            "cluster" : true
        },
        "actions" : [ 
            "listDatabases"
        ]
    }, 
    {
        "resource" : {
            "db" : "",
            "collection" : "packages"
        },
        "actions" : [ 
            "find", 
            "insert", 
            "remove", 
            "update", 
            "listCollections"
        ]
    }]

What I want is for any user with this role to be able to read/write/remove in any database but only on the packages collection inside of that database, and be unable to read or write to any other collection. When I launch mongod in --auth I do not see any databases besides admin.

I am certain this is just me being unable to figure out exactly what actions / resources / roles I am supposed to grant.

1

Not clear what you mean but this could be a solution:

var role = "<role name>"; 
admin = db.getSiblingDB("admin");
if (admin.getRoles({ rolesInfo: role }).length == 0)
   admin.createRole({ role: role, privileges: [], roles: [] });
admin.grantRolesToUser(<the user>, [role]);
   

Then you would have to run this code every time when a new database is created.

db.getSiblingDB(<your dynamic database name>).getCollectionNames().forEach(function (item) {
   db.getSiblingDB("admin").grantPrivilegesToRole(role, [{
      resource: {
         db: <your dynamic database name>, collection: item }, 
         actions: ["find", "insert", "remove", "update"] }])
   })
7
  • Hi, thanks for responding, From what I understand according to this documentation: docs.mongodb.com/manual/core/collection-level-access-control I should be able to set a role to look at any database by setting the resource value to db: "". I then should be able to access a collection by setting the resource to collection: "MyCollection" However, when I use the role above, I can only see the system collections in the Admin db. Does this better explain my problem? I would prefer not to do what you suggested when the above linked method seems cleaner. – mdschurr Nov 10 '20 at 14:34
  • No, the user can see collection MyCollection in db: <xyz> database - admin is the database where the role is defined. Yes, you can use db: "" - however if by chance somebody creates a collection called MyCollection then the user can see it. So, it might be a security flaw. – Wernfried Domscheit Nov 10 '20 at 15:50
  • It would only be a security flaw if MyCollection ever had data that was never intended for the user to see, which shouldn't be an issue. I don't really know if Mongo would suggest in their own documentation about security to do something that would be a security risk. The problem I am experiencing is that using db: "" and collection:MyCollection doesn't give access to the DBs with MyCollection available. I only have access to the System collections in Admin, which is not what I want. – mdschurr Nov 10 '20 at 16:05
  • I created the user in admin -- according to the documentation that is required to use this type of collection-level access. It connects to the DB through the 27017 default port, though the user does not work properly when connecting directly through the mongo shell either. I imagine there is some basic permission I am missing that I am just overlooking. I tried to give the role permissions to a specific DB and a specific collection and that is not working either. I also verified the user does have the proper role just to make sure I didn't make a big oversight there. – mdschurr Nov 10 '20 at 16:55
  • getRoles does not return any of my user-defined roles (I made sure to set rolesInfo to 1). However, System.Roles does show the roles I have created. I created the roles using db.createRole() – mdschurr Nov 10 '20 at 17:44
1

TLDR for anyone having a similar issue:

It seems like there was an issue when initially creating the roles through Robo3T instead of through the mongo shell. I created the same user through the shell and it works properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.