Accessed Denied "bypassDocumentValidation"

[RenDev_N_A]

Took a break from a project that uses Mongodb but now my group wants to use the project again. I turned everything back on and I was able to connect to mongodb from python easily. The only issue is that I can read/write to only one collection. I am authenticated as a maximum privilege user so I was surprised to see an error that says

pymongo.errors.OperationFailure: user is not allowed to do action [bypassDocumentValidation] on [TicketSystem.done]

Not sure what changed in the matter of 4 months but here we are.

My connection settings are

mongodb+srv://<username>:<password>@<name_of_database>.<server_address>.mongodb.net/?retryWrites=true&w=majority

[Jason_Tran]

Hi @RenDev_N_A - Welcome to the community

@RenDev_N_A

I am authenticated as a maximum privilege user

For the built-in database user roles in Atlas, the atlasAdmin role would have the most access so it would be odd if this error was generated with a user with this role.

In terms of the error, it seems bypassDocumentValidation is attempting to be executed. As per the Bypass Schema Validation documentation:

For deployments that have enabled access control, to bypass document validation, the authenticated user must have bypassDocumentValidation action. The built-in roles dbAdmin and restore provide this action.

I assume if the associated database user has the atlasAdmin (or either the two roles mentioned above dbAdmin and/or restore), then this error should not occur.

However, just to be sure, can you advise the following:

1. The role associated with the user attempting to perform the action
2. Any relevant commands / code snippets in which the bypassDocumentValidation action is being used

For troubleshooting purposes and possible use in future, you can Configure Custom Database Roles with the bypassDocumentValidation action. There’s also an interesting example of this action for a particular user mentioned in the Considerations documentation for the custom database roles which may be of use.

Regards,
Jason

[RenDev_N_A]

Thanks for your help. Seems that the admin account was “AdminReadWriteAnyDatabase” was not the highest privilege. Not sure why it changed 4 months ago but your solution worked. Thanks!