Skip to content

Commit

Permalink
formatting tweaks and cleanup
Browse files Browse the repository at this point in the history
  • Loading branch information
Ed Costello committed Oct 24, 2012
1 parent 78e795c commit 7d83399
Showing 1 changed file with 44 additions and 40 deletions.
84 changes: 44 additions & 40 deletions draft/tutorial/use-authentication-to-control-access-to-mongodb.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ Basic authentication and access control is enabled with the
:option:`--auth <mongod --auth>`
or
:option:`--keyFile <mongod --keyFile>`
options in versions of MongoDB up to and including version 2.2
options in versions of MongoDB up to and including version 2.2.

Some important things to note about authentication:

Expand All @@ -24,7 +24,7 @@ have read access.
Each database contains a "system.users" collection, which contains
all the user information. For example:

... code-block:: javascript
.. code-block:: javascript

> db.system.users.find()
{ "_id": ObjectId("5075362366b2b6e3603b65c9"), "user": "readOnly", "readOnly": true, "pwd": "76841722f39207db6b332e64bfacd4ba" }
Expand All @@ -36,9 +36,9 @@ with only two roles – "read" and "normal" (i.e. full read/write
access). There are several tickets related to improving the
implementation of authorization within MongoDB:

:jira:`SERVER-3198`
:jira:`SERVER-7122`
:jira:`SERVER-7124`
* :issue:`SERVER-3198`
* :issue:`SERVER-7122`
* :issue:`SERVER-7124`

The admin database is special. Several administrative commands
can only run on the admin database (and so can only be run by an
Expand All @@ -59,14 +59,17 @@ Adding Users

You must either:

have added a user to the admin db before starting the server with -auth,
#. have added a user to the admin db before starting the server with
:option:`--auth <mongod --auth>`,

added the first user from a localhost connection (you cannot add the first user from a connection that is not local with respect to the `mongod` process).
#. added the first user from a localhost connection (you cannot add
the first user from a connection that is not local with respect to
the :program:`mongod` process).

.. note::

Option (2) to add a user via localhost does not work in
sharded clusters running v2.2+ due to :jira:`SERVER-6591`. If you are
sharded clusters running v2.2+ due to :issue:`SERVER-6591`. If you are
running 2.2 with a sharded cluster and want to use secure mode you
must setup the cluster and add an admin user before restarting the
cluster to run with :option:`--keyFile <mongod --keyFile>`.
Expand Down Expand Up @@ -163,44 +166,45 @@ Authentication on Localhost

.. versionadded:: 2.0

The trust model, in this version, dictates that that if the
user has access to running the mongo shell on localhost
(127.0.0.1) then the user has write access to add users
regardless of what authentication is enforced in the :program:`mongod`
configuration, i.e. authentication does not apply to users
logging into `mongod` on localhost.
The trust model, in this version, dictates that that if the
user has access to running the mongo shell on localhost
(127.0.0.1) then the user has write access to add users
regardless of what authentication is enforced in the :program:`mongod`
configuration, i.e. authentication does not apply to users
logging into `mongod` on localhost.


.. versionadded:: 2.2

The trust model changed for MongoDB 2.2. If :program:`mongod`
is started with the :option:`--auth <mongod --auth>` option then
authentication is applied to local users.

For example, below the user connects as a read-only user to the
test database and tries to insert a collection but cannot.
The trust model changed for MongoDB 2.2. If :program:`mongod`
is started with the :option:`--auth <mongod --auth>` option then
authentication is applied to local users.

.. code-block:: sh

$ mongo localhost/test -u readOnly -p test

.. code-block:: javascript

MongoDB shell version: 2.2.0
connecting to: localhost/test
For example, below the user connects as a read-only user to the
test database and tries to insert a collection but cannot.

.. code-block:: sh

$ mongo localhost/test -u readOnly -p test

.. code-block:: javascript

MongoDB shell version: 2.2.0
connecting to: localhost/test

test > db.coll.insert({foo:'bar'})
unauthorized
test > db.coll.insert({foo:'bar'})
unauthorized

test > db.system.users.find()
error: {
"$err": "unauthorized db:test ns:test.system.users lock type:1 client:127.0.0.1",
"code": 10057
}
test > db.system.users.find()
error: {
"$err": "unauthorized db:test ns:test.system.users lock type:1 client:127.0.0.1",
"code": 10057
}

However, when connecting to MongoDB over localhost with
authentication enabled but without any admin users, the user may
access the database from the localhost interface without
authenticating.
However, when connecting to MongoDB over localhost with
authentication enabled but without any admin users, the user may
access the database from the localhost interface without
authenticating.

In summary, below is a table of the scenarios for accessing the
database when running with authentication enabled:
Expand Down Expand Up @@ -240,7 +244,7 @@ This authentication schema is working as designed and is
consistent with the MongoDB trust model up to and including 2.2.
Subsequent versions of MongoDB will contain more secure and
enterprise-type authentication models. For further information,
please see :jira:`SERVER-3198` and :jira:`SERVER-7155`.
please see :issue:`SERVER-3198` and :issue:`SERVER-7155`.

Below is a step-by-step walkthrough.

Expand Down

0 comments on commit 7d83399

Please sign in to comment.