Closed dblock closed 3 years ago
dblock
commented
3 years ago > db.runCommand({connectionStatus : 1})
{
"authInfo" : {
"authenticatedUsers" : [
{
"user" : "admin",
"db" : "admin"
}
],
"authenticatedUserRoles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
}
]
},
"ok" : 1
}
JanRuettinger
commented
3 years ago I get a similar error when I try to call list_collections() with pymongo from a python app.
josegonzalez
commented
3 years ago Does this require admin credentials? The default credentials aren't admin, you'd need to do mongo:connect-admin and then authorize the user to give them access to those commands.
JanRuettinger
commented
3 years ago I tried to do that but there is no user except admin. Do we need to create a new user manually?
What I tried:
dokku mongo:connect-admin
use admin;
db.getUsers();I can only see the admin user.
josegonzalez
commented
3 years ago Default username is the service username... it def should be there (idk anything about mongodb though).
JanRuettinger
commented
3 years ago I just destroyed all dbs, deleted the plugin, reinstalled it and created a new service.
> db.getUsers();
[
{
"_id" : "admin.admin",
"userId" : UUID("d0a2fa45-ff50-49cf-8adf-489c458f5f27"),
"user" : "admin",
"db" : "admin",
"roles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
},
{
"role" : "__system",
"db" : "admin"
},
{
"role" : "root",
"db" : "admin"
}
]
}
]There is no user with the service name. I guess a quick fix is to create the user manually.
BTW: I am on Debian 10.
EDIT: When I create the user manually I need to use the same password as in the MONGO_URL env variable, right?
josegonzalez
commented
3 years ago What is the output of mongodb:info for that service?
JanRuettinger
commented
3 years ago Output of dokku mongo:info <service_name>
=====> test_mongodb mongo service information
Config dir: /var/lib/dokku/services/mongo/test_mongodb/config
Data dir: /var/lib/dokku/services/mongo/test_mongodb/data
Dsn: mongodb://test_mongodb:85b1e50b3de319091c33fb252d174713@dokku-mongo-test-mongodb:27017/test_mongodb
Exposed ports: -
Id: 4959752c30771c0100d7ff5fe7de62d86b707aa5aae16f85cd0d0968283600a9
Internal ip: 172.17.0.3
Links: -
Service root: /var/lib/dokku/services/mongo/test_mongodb
Status: running
Version: mongo:3.6.15
➜ ~So test_mongodb is... somewhere. Where is that user?
JanRuettinger
commented
3 years ago So
test_mongodbis... somewhere. Where is that user?
I wish I knew that. I am trying to figure that out for a couple of hours already. No luck so far.
After a new service is created I get the following two warnings:
2021-04-28T15:36:40.466+0000 I STORAGE [initandlisten]
2021-04-28T15:36:40.466+0000 I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2021-04-28T15:36:40.466+0000 I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem
2021-04-28T15:36:41.085+0000 I CONTROL [initandlisten]
2021-04-28T15:36:41.085+0000 I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2021-04-28T15:36:41.085+0000 I CONTROL [initandlisten] ** We suggest setting it to 'never'
2021-04-28T15:36:41.085+0000 I CONTROL [initandlisten]Does this help to pinpoint where my error is?
josegonzalez
commented
3 years ago Just tried this out:
# dokku mongo:create test
Waiting for container to be ready
=====> MongoDB container created: test
=====> test mongo service information
Config dir: /var/lib/dokku/services/mongo/test/config
Data dir: /var/lib/dokku/services/mongo/test/data
Dsn: mongodb://test:ace043160321d352f4d78d91ae6902d9@dokku-mongo-test:27017/test
Exposed ports: -
Id: aae8d589ccc7a7b5cbe0c3b460a91b4ad5e39cd8139dd7c0e6dc54909ed5582f
Internal ip: 172.17.0.7
Links: -
Service root: /var/lib/dokku/services/mongo/test
Status: running
Version: mongo:3.6.15
# dokku mongo:connect-admin test
MongoDB shell version v3.6.15
connecting to: mongodb://127.0.0.1:27017/test?authSource=admin&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("3ddb7215-18d6-4322-bb2b-ecb97b436306") }
MongoDB server version: 3.6.15
Server has startup warnings:
2021-04-28T19:31:34.865+0000 I STORAGE [initandlisten]
2021-04-28T19:31:34.865+0000 I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2021-04-28T19:31:34.865+0000 I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem
> db.getUsers();
[
{
"_id" : "test.test",
"userId" : UUID("aec7071b-ec6e-4bbc-9989-0aa01e3ddd9e"),
"user" : "test",
"db" : "test",
"roles" : [
{
"role" : "readWrite",
"db" : "test"
}
]
}
]
>
byeHm weird. Why don't you have an admin user? I feel like we are coming closer ;) Thank so much for your help!
josegonzalez
commented
3 years ago Can you show me the output of:
dokku report | grep mongo
josegonzalez
commented
3 years ago Note, for the initial issue, the requested command works fine for me. Might just be an issue with an older version of the image that is in use (im on 3.6.15 and the issue referenced 3.2.1).
# dokku mongo:create test
Waiting for container to be ready
=====> MongoDB container created: test
=====> test mongo service information
Config dir: /var/lib/dokku/services/mongo/test/config
Data dir: /var/lib/dokku/services/mongo/test/data
Dsn: mongodb://test:a098fe92faef8d1abf5ab6c7ab9c86a1@dokku-mongo-test:27017/test
Exposed ports: -
Id: 983f88455ac387c3081dca54275114bcbc03b15b6e8f9fcd0e9207ea8976991c
Internal ip: 172.17.0.7
Links: -
Service root: /var/lib/dokku/services/mongo/test
Status: running
Version: mongo:3.6.15
root@dokku:~# dokku mongo:connect-admin test
MongoDB shell version v3.6.15
connecting to: mongodb://127.0.0.1:27017/test?authSource=admin&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("83a26e71-37c8-4225-bd1c-edf970e82161") }
MongoDB server version: 3.6.15
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
http://docs.mongodb.org/
Questions? Try the support group
http://groups.google.com/group/mongodb-user
Server has startup warnings:
2021-04-28T19:55:53.576+0000 I STORAGE [initandlisten]
2021-04-28T19:55:53.576+0000 I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2021-04-28T19:55:53.576+0000 I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem
> show collections
>
bye@JanRuettinger users in mongodb seem to be scoped to specific databases. Are you switching databases before calling getUsers()? When I call it on the admin database, seems to list the admin user.
root@dokku:~# dokku mongo:create test
Waiting for container to be ready
=====> MongoDB container created: test
=====> test mongo service information
Config dir: /var/lib/dokku/services/mongo/test/config
Data dir: /var/lib/dokku/services/mongo/test/data
Dsn: mongodb://test:0e46e8460eddbdb2b7802622ce545fc0@dokku-mongo-test:27017/test
Exposed ports: -
Id: 409913c34f343c37db94e1bfed48b4afe428d021c841c3047e271252343b67ea
Internal ip: 172.17.0.7
Links: -
Service root: /var/lib/dokku/services/mongo/test
Status: running
Version: mongo:3.6.15
root@dokku:~# dokku mongo:connect-admin test
MongoDB shell version v3.6.15
connecting to: mongodb://127.0.0.1:27017/test?authSource=admin&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("ae655117-3130-4123-a9ef-7f2091c33978") }
MongoDB server version: 3.6.15
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
http://docs.mongodb.org/
Questions? Try the support group
http://groups.google.com/group/mongodb-user
Server has startup warnings:
2021-04-28T19:59:18.794+0000 I STORAGE [initandlisten]
2021-04-28T19:59:18.795+0000 I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2021-04-28T19:59:18.795+0000 I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem
> db.system.users.find({}, {"_id" : 1})
>
> db.system.users.find({}, {"_id" : 2})
> db.getUsers()
[
{
"_id" : "test.test",
"userId" : UUID("29589cbb-fbfb-41e2-a693-d228c38884d7"),
"user" : "test",
"db" : "test",
"roles" : [
{
"role" : "readWrite",
"db" : "test"
}
]
}
]
> show users;
{
"_id" : "test.test",
"userId" : UUID("29589cbb-fbfb-41e2-a693-d228c38884d7"),
"user" : "test",
"db" : "test",
"roles" : [
{
"role" : "readWrite",
"db" : "test"
}
]
}
> db.getSiblingDB('admin').getUsers()
[
{
"_id" : "admin.admin",
"userId" : UUID("cf885bc0-f04b-4835-980f-d4e94e93e92a"),
"user" : "admin",
"db" : "admin",
"roles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
},
{
"role" : "__system",
"db" : "admin"
},
{
"role" : "root",
"db" : "admin"
}
]
}
]
>Ah okay I found my error. Yes you are right they are scoped that's why I didn't see the user. I tried show dbs and couldn't see the the db test. I think that's because it's empty. I then tried to create a new database with the test user and that didn't work.
josegonzalez
commented
3 years ago Alright it seems like user scope is the problem here, and using the correct scope for the database in question will allow you to do things on that database. Closing.
dblock
commented
3 years ago Does this require admin credentials? The default credentials aren't admin, you'd need to do
mongo:connect-adminand then authorize the user to give them access to those commands.
I don't think I understand. What do i need to do, specifically, in my example after mongo:connect-admin to be able to run show collections or eventually compact a database?
mawoka-myblock
commented
3 years ago Does this require admin credentials? The default credentials aren't admin, you'd need to do
mongo:connect-adminand then authorize the user to give them access to those commands.I don't think I understand. What do i need to do, specifically, in my example after
mongo:connect-adminto be able to runshow collectionsor eventually compact a database?
You are not the only one who does not understand it.
josegonzalez
commented
3 years ago If anyone is still having this issue, please open a new ticket with the output of dokku report and the exact commands you are running to:
With all the output as well.
Description of problem
Unauthorized to run mongo commands such as
show collections(my goal is to compact a collection). What am I missing?How reproducible
Always.
Steps to Reproduce
Actual Results
Not authorized to execute command.
Expected Results
Show collections since I'm admin.
Environment Information
dokku report APP_NAMEoutputHow (deb/make/rpm) and where (AWS, VirtualBox, physical, etc.) was Dokku installed?:
DigitalOcean, deb I believe