Permissions configuration for MongoDB: eval permission after Auth is turned on

This document is a logbook that resolves an issue that causes the inability to use Db.eval () after the--auth of MongoDB is opened.

Problem Description:

Using--auth to start MongoDB, after successful login, execute Db.eval, report the following error:

> Db.eval (' return 1111 ') 2015-03-04t15:18:54.062+0800 {"OK": 0, "errmsg": "Not authorized on test to execute command { $eval: \ "return 1111\"} "," Code ": at src/mongo/shell/db.js:403>

Solution:

On the official website http://docs.mongodb.org/manual/reference/command/eval/#dbcmd. Eval has a description:

If Authorization is enabled and you must has access to all actions on the all resources in order to runEval. Providing such access isn't recommended, but if your organization requires a user to runEval, create a role that grantsanyaction onAnyresource. do not assign the this role to any other user.

Steps to resolve:

1) Start the database without the--auth parameter, so you don't need an account to connect to MongoDB.

2) to create a new role, such as sysadmin, you need to switch to the Admin library to do the following:

> Use adminswitched to DB admin> db.createrole ({role: ' sysadmin ', roles:[],... privileges:[... {resource:{anyresource:true},actions:[' anyaction '} ...]})

3) Then, create a new user, use this role, note that the role of the DB is admin, the operation is as follows:

> Use woplusswitched to DB woplus> db.createuser ({... User: ' Woplus ',... pwd: ' [email protected] ',... roles:[... {role: ' sysadmin ', db: ' admin '} ...]})

4) OK, let's see the effect. First look at the user situation, as follows:

> Use adminswitched to DB admin> Db.system.users.find () {"_id": "Admin.root", "User": "Root", "db": "admin", "cre Dentials ": {" MONGODB-CR ":" dfda4d4e75995650c3e1b3f2b65b1920 "}," Roles ": [{" Role ":" Root "," db ":" Admin "}]} {" _ ID ":" woplus.woplus "," User ":" Woplus "," db ":" Woplus "," credentials ": {" MONGODB-CR ":" bcabae4fe4d7951fad37cb2d09943 7e8 "}," Roles ": [{" Role ":" SysAdmin "," db ":" Admin "}]}

We then restart the database, plus the--auth parameter.

Then log in to MongoDB from the client using the account.

./mongo-u woplus-p [email protected]  192.168.1.84/woplusmongodb shell version:2.6.8connecting to:192.168.1.84/ woplus> > Use woplusswitched to DB woplus> db.eval (' return 222 ') 222

Permissions configuration for MongoDB: eval permission after Auth is turned on