Skip to content

Fixed the problem: the user was not created for Mongodb 4.x#561

Merged
ekohl merged 1 commit intovoxpupuli:masterfrom
identw:fix-create-user-for-4x-versions
Nov 25, 2019
Merged

Fixed the problem: the user was not created for Mongodb 4.x#561
ekohl merged 1 commit intovoxpupuli:masterfrom
identw:fix-create-user-for-4x-versions

Conversation

@identw
Copy link
Copy Markdown
Contributor

@identw identw commented Nov 7, 2019

When creating a user, a password hash is used and the "digestPassword" option is set to "false". By default in Mongodb 4.x the parameter "mechanisms" is set to ["SCRAM-SHA-1","SCRAM-SHA-256"], but according to the documentation (https://docs.mongodb.com/manual/reference/command/createUser/ ) for SCRAM-SHA-256 "digestPassword" cannot be "false".

Example:

$ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false})"

output:

{
	"ok" : 0,
	"errmsg" : "Use of SCRAM-SHA-256 requires undigested passwords",
	"code" : 2,
	"codeName" : "BadValue"
}

If you remove SCRAM-SHA-256, it works correctly:

$ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false, \"mechanisms\":[\"SCRAM-SHA-1\"]})"

output:

{ "ok" : 1 }

Thus, you need to add SCRAM-SHA-256 support, not use "password_hash" and set digestPassword to "true", or just use SCRAM-SHA-1, which seemed to me the simplest solution, which does not require global changes.

Fixes #525

When creating a user, a password hash is used and the "digestPassword" option is set to "false". By default in Mongodb 4.x the parameter "mechanisms" is set to ["SCRAM-SHA-1","SCRAM-SHA-256"], but according to the documentation (https://docs.mongodb.com/manual/reference/command/createUser/ ) for SCRAM-SHA-256 "digestPassword" cannot be "false".

Example:
$ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false})"

output:
{
	"ok" : 0,
	"errmsg" : "Use of SCRAM-SHA-256 requires undigested passwords",
	"code" : 2,
	"codeName" : "BadValue"
}

If you remove SCRAM-SHA-256, it works correctly:
$ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false, \"mechanisms\":[\"SCRAM-SHA-1\"]})"

output:
{ "ok" : 1 }

Thus, you need to add SCRAM-SHA-256 support, not use "password_hash" and set digestPassword to "true", or just use SCRAM-SHA-1, which seemed to me the simplest solution, which does not require global changes.
@identw identw force-pushed the fix-create-user-for-4x-versions branch from 7d1b695 to a7e21ae Compare November 7, 2019 15:48
@bastelfreak bastelfreak requested a review from ekohl November 18, 2019 18:46
@bastelfreak bastelfreak added the bug Something isn't working label Nov 18, 2019
@ekohl ekohl merged commit e19b6a5 into voxpupuli:master Nov 25, 2019
@ekohl
Copy link
Copy Markdown
Member

ekohl commented Nov 25, 2019

Thanks!

@nmaludy nmaludy mentioned this pull request Feb 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Mongo 4.0.x: unable to create user

3 participants