2

I'm trying to allow a mongo user to connect to a mongo database, but regardless of what roles I give the user, the authentication fails with this error in the logs:

2019-08-09T17:03:05.486+0000 I ACCESS   [conn13] SCRAM-SHA-1 authentication failed for username on dbname from client 127.0.0.1:38790 ; UserNotFound: Could not find user username@dbname
2019-08-09T17:03:05.488+0000 I NETWORK  [conn13] end connection 127.0.0.1:38790 (0 connections now open)

Here are the contents of /etc/mongodb.conf

# mongodb.conf

# Where to store the data.
dbpath=/var/lib/mongodb

#where to log
logpath=/var/log/mongodb/mongodb.log

logappend=true

bind_ip = 0.0.0.0
port = 27017

# Enable journaling, http://www.mongodb.org/display/DOCS/Journaling
journal=true

auth=true

And here is how I created the user:

db.createUser({
  user: "username",
  pwd: "secret",
  roles: [
    { role: "userAdmin", db: "dbname" },
    { role: "dbAdmin",   db: "dbname" },
    { role: "readWrite", db: "dbname" }
  ]
});

I also granted the dbOwner role to the user on the database dbname. What is happening here? Why can't I connect to the database if the user is the owner and has read/write privileges? Do I have to create a user with the name username@dbname?

EDIT: Just tried adding a user with the username username@dbname, but that user also fails to connect.

I can also connect to mongo with the same command minus the /dbname at the end and then run use dbname. I have no clue why this would work, but connecting directly wouldn't.

SimpleJ
  • 13,812
  • 13
  • 53
  • 93

2 Answers2

23

The issue is that the database user is being created on the admin database instead of dbname.

Omitting the /dbname from the connection string / mongo shell / etc. means the connection string will authenticate to the admin database. Quoting the docs:

If '/database' is not specified and the connection string includes credentials, the driver will authenticate to the admin database

(https://docs.mongodb.com/manual/reference/connection-string/#components).

If /dbname is defined, then the connection string will authenticate against dbname unless the authSource parameter is configured to specify the database in which the user resides.

You can confirm that this is the case by either adding authSource=admin to the connection string or --authenticationDatabase admin to the mongo shell command.

Alternatively, you can use db.getUsers() to see the database in which a user was created.

Adam Harrison
  • 3,323
  • 2
  • 17
  • 25
  • 1
    The issue was related to `authenticationDatabase`. For some reason my users all got created on the `test` database (which I didn't create). – SimpleJ Aug 09 '19 at 20:05
4

I faced with the same error and my solution was adding ?authSource=admin to the end of the connection string:

MONGODB_URI="mongodb://username:password@localhost:27017/db_name?authSource=admin"
Arsham Arya
  • 1,461
  • 3
  • 17
  • 25