Upgrading to 5.0 ; Error checking feature compatibility version

[Stevie_M]

I came across and error which states “not authorized on admin to execute command” . I tried running the feature compatibility version command but it would not show me the output and just shows the error . Nor can i set it and i have to make these changes in DEV, TEST and PROD. I am not to run any queries against the Production database - i assume the db.commands would not any impact on a production instance of mongo? Would those db.commands count as a queries against the database or more so as an administrative task/command?

For content, I am using SSL connection and the current user - upon login - seems to an ‘external’ user and db .
Db.getUsers - empty results come up and querying the user which i log into shows they have a role of “USerAdeminAnydatabase” with db”admin”. I figure this would let me run the db.adminCommand on the admin DB but I still see the error above. Open to any suggestions. I figure I would create a super user “admin” on “admin” to query the feature compatibility version and then drop the user - but not sure what kind of impacts this would have. Open to any suggestions or ways of finding this version out if there is another

[chris (Chris Dellaway)]

Hi @Stevie_M

UserAdminAnyDatabase is a role that can create any user on any database.

The role grants user and role management privileges as well as a few others. It does not specifically grant getParameter privileges. But as is can grant any privilege the role is considered a superuser role.

The most appropriate role to clusterAdmin as this will later allow the execution of setFeatureCompatibilityVersion if this is too permissive consider a custom role.

https://www.mongodb.com/docs/manual/reference/built-in-roles/#built-in-roles

[Stevie_M]

HI Chris , thanks for the prompt response here.

Does this hold true if this is still a stand-alone instance which is using a community version. Not running anything Atlas or clustered.

[chris (Chris Dellaway)]

Yes. I assume Community/Self-Hosted unless I see an Atlas tag or Atlas mentioned in the post