User created via db.createUser can manipulate other database

[liudonghua_N_A]

Hi, I am new to mongodb, and I want to create a user and grant some permission for it, for example, I create a user1 and allow it to read test and read/write user1 databases, but the created user can manipulate any other database like user2 acturally.

The command I use for creating user1.

db.createUser(
{
    user: "user1",
    pwd: "user1@ynu!@#",
    roles: [{
            role: "readWrite",
            db: "user1"
        },
        {
            role: "read",
            db: "test"
        }
    ]
}
)

[santimir (santi)]

I presume to first created the “admin user” as adviced here.

So currently your video is probably showing this user which is allowed to do anything.

But to understand how more restricted users will actuate on the database, you have to connect and identify as the specific user.

For example,

• connect as admin (user role)
• use admin to move to the admin database, which is useful to identify users
• create the users with the command in the post db.createUser(...)
• log out to the database and connect as a specific user
• check what you can see and do now.

[liudonghua_N_A]

@liudonghua_N_A

db.createUser(
{
    user: "user1",
    pwd: "user1@ynu!@#",
    roles: [{
            role: "readWrite",
            db: "user1"
        },
        {
            role: "read",
            db: "test"
        }
    ]
}
)

Thanks, I have created the normal user1 successfully now.
I created a admin user firstly, then configure security: authorization: enabled in /etc/mongod.conf, execute service mongod restart.
Then log into mongodb use admin, then create other normal users like user1 above.

use admin
db.createUser(
  {
    user: "admin",
    pwd: "xxx",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)
# configure security: authorization: enabled and restart mongodb
mongo -u "admin" -p 'xxx' --authenticationDatabase "admin"
use user1
db.createUser(
{
    user: "user1",
    pwd: "xxx",
    roles: [{
            role: "readWrite",
            db: "user1"
        },
        {
            role: "read",
            db: "test"
        }
    ]
}
)
mongo -u "user1" -p 'xxx' --authenticationDatabase "user1"

see also MongoDB: Server has startup warnings ‘‘Access control is not enabled for the database’’ - Stack Overflow.