0

This is the script I am using to create user accounts in MongoDB:

mongo <<EOF
use admin;
db.createUser({user:ram", pwd: "ram123!", roles:['root']});
db.createUser({user:"sam", pwd: "sam123!", roles:[{db:"config", role:'readWrite'}]});
EOF

This works for the creating first user, but not the second user. This is the error that is returned:

connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("f648b868-7863-4d5c-9912-e3e87b24f4e8") }
MongoDB server version: 4.4.6
switched to db admin
Successfully added user: { "user" : "ram", "roles" : [ "root" ] }
uncaught exception: Error: couldn't add user: command createUser requires authentication :
_getErrorWithCode@src/mongo/shell/utils.js:25:13
DB.prototype.createUser@src/mongo/shell/db.js:1386:11
@(shell):1:1
bye
0

The problem appears to be the different databases that are expected when creating the accounts. The first one, ram is created against the admin database. The second one, sam is expected to be made on the config database, but you're connected to admin, making this impossible.

In order to do this correctly, you need to first connect to the config database and run the script there for users who will have access to config.

7
  • how can i make my admin user "ram" create other users in other databases through the script? – Acmakala Eesha May 31 at 5:16
  • and who is creating the user in config database in the above script? is it "Ram" – Acmakala Eesha May 31 at 5:20
  • In your script you have USE admin. That ensures the database is admin. If you want to have accounts in other databases created, you'll need to switch to those DBs using an account that has a role allowing for account creation. You can use additional USE {dbname} commands to accomplish this. As for "who", it's the account you are running the script under. There is nothing in your script that disconnects and re-authenticates as ram. – matigo May 31 at 5:29
  • can i disconnect and reauthenticate as 'ram' to create users in admin database? – Acmakala Eesha May 31 at 7:26
  • It's your database and your script. You can do whatever you'd like – matigo May 31 at 7:39
0

After creating the first user on admin database (the user "ram", which you had created successfully) which can administrate users and roles (a user administrator), you need to do these following steps to create other users:

Shutdown the mongod instance, from the mongo shell:

use admin
db.shutdownServer();

Exit the shell.

Start the mongod again with the auth option:

The --auth option enables authorization to control user's access to database resources and operations. When authorization is enabled, MongoDB requires all clients to authenticate themselves first in order to determine the access for the client.

mongod --auth --port 27017 --dbpath ...

From now onward, clients that connect to this instance must authenticate themselves as a MongoDB user. The clients can only perform actions as determined by their assigned roles.

Connect to the instance from mongo shell:

mongo --port 27017  --authenticationDatabase "admin" -u "ram" -p "rams_password"

Now you have authenticated yourself as a user administrator. So, you can create other users with various roles.

Create additional users as needed, now (for example):

use db2
db.createUser(
  {
    user: "db2User",
    pwd:  "db2_pass",
    roles: [ { role: "readWrite", db: "db2" } ]
  }
)

This will create a user "db2User" which has the role "readWrite" on the database "db2". Note the use db2 command before the createUser(); it means that the authentication database for this user is "db2". When this user needs to read or write data to the "db2" database he/she needs to authenticate against this database, like this from mongo shell:

mongo --port 27017  --authenticationDatabase "db2" -u "db2User" -p "db2_pass"

Note that, your authentication database can be different from that of the database you specify in the roles, for example:

use db2
db.createUser(
  {
    user: "mongoUser",
    pwd:  "mongo_pass",
    roles: [ { role: "read", db: "myDB" } ]
  }
)

The Error:

The error you are getting is because that you have not authenticated yourself as a user administrator, before creating new users.

To understand this in detail, you need to get familiar with MongoDB Security aspects of Authentication and Authorization.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.