CODEWITHSUNDEEP
mongodbspring-data-mongodb
ashwini
ashwini

Reputation: 601

MongoDB-CR Authentication failed

I am getting following error while authenticating user : purchase_user@purchase failed. MongoDB-CR Authentication failed. Missing credentials in user document when I access webservice through browser.

But I am able to authenticate purchase_user from mongo it returns 1 .

Upvotes: 47

Views: 50851

Answers (13)

ak1ra
ak1ra

Reputation: 401

For those who is struggling to update auth schema (see the accepted answer) in MongoDB 3.6 due to the not authorized on admin to execute command and removing FeatureCompatibilityVersion document is not allowed errors, this is what's worked for me.

To resolve the first error:

> db.system.version.remove({})
WriteResult({
        "writeError" : {
                "code" : 13,
                "errmsg" : "not authorized on admin to execute command { update: \"system.version\", ordered: true, lsid: { id: UUID(\"58e86006-d889-440a-bd83-ad09fcd81747\") }, $db: \"admin\" }"
        }
})

I had to create a custom role that permits any action on any resource and a user with this role, then login to the admin database with that new user:

mongo admin

db.createUser({user: 'admin', pwd: 'mypwd', roles: ['root']})
exit

mongo admin -u admin -p

db.createRole({role: 'fullaccess', privileges: [{resource: {anyResource: true}, actions: ["anyAction"]}], roles: []})
db.createUser({user: 'superadmin', pwd: 'mypwd', roles: ['fullaccess']})
exit

mongo admin -u superadmin -p

(Just using the admin user with root role or disabling security.authorization in config didn't work for me and still had the same error when trying to update the system.version table.)

After that I had another error:

> db.system.version.remove({})
WriteResult({
        "nRemoved" : 0,
        "writeError" : {
                "code" : 40670,
                "errmsg" : "removing FeatureCompatibilityVersion document is not allowed"
        }
})

To resolve it, we should only update the authSchema document instead of removing the whole collection.

(Generally speaking, you shouldn't blindly remove everything from system tables in production and always check what would be the implications of updating them, so that's another reason to update the needed record only.)

db.system.version.update({"_id": "authSchema"}, {currentVersion: 3})

Now you should be able to create a user with the old authentication mechanism. You also might need to switch to your database first, so that the user is created in that database rather than in admin one. Otherwise you'd have to use the authSource=admin parameter in your connection string.

(I'm actually lying here - it still will be created in admin database, just with mydb.myuser id instead of admin.myuser. But I use the same way of describing these things that's being used in MongoDB documentation. I suppose this is how it actually used to work in previous versions and in general we shouldn't care about the internal implementation details.)

use mydb
db.createUser({user: 'myuser', pwd: 'mypwd', roles: [{role: 'dbOwner', db: 'mydb'}]})

And don't forget to cleanup:

use admin
db.system.version.update({"_id": "authSchema"}, {currentVersion: 5})
exit

mongo admin -u admin -p

db.dropUser('superadmin')
db.dropRole('fullaccess')

You may want to keep the admin user - I was not able to create it again even with security.authorization setting disabled. It looks like if there are any records in admin.system.users table, the setting does not work anymore and mongo requires authentication to do something.

Upvotes: 0

vivex
vivex

Reputation: 2515

go to mongoDB console and delete your current user & set authSchema version to 3 instead of 5 , follow these commands in mongo console -

mongo
use admin
db.system.users.remove({})    <== removing all users
db.system.version.remove({}) <== removing current version 
db.system.version.insert({ "_id" : "authSchema", "currentVersion" : 3 })

Now restart the mongod and create new user then it should work fine.

Note: use remove commands in test db only, if in production use update.

Authentication information for Kubernetes Helm Chart

If you delete the all users and authentication is enabled in the configuration (or --auth param which is set per default on the Kubernetes helm chart), it's not possible to access MongoDB any more. Its required to disable authentication, create a new user and then re-enable it.

On Kubernetes you need to edit the parameters and add --noauth as argument, since it's not the default there as on a classic installed MongoDB. Please see the CLI documentation for more information about --noauth and the corresponding --auth.

Upvotes: 84

Brad Hein
Brad Hein

Reputation: 11047

June 2018 I got this error after trying to connect to my Mongodb version 3.6 from an ancient client installed in /usr/bin. I installed the mongo DB in a separate folder outside of the OS standard directory, and so my installation was conflicting with the ancient version installed by the package manager.

Upvotes: 0

rajivm1991
rajivm1991

Reputation: 21

  • uninstall mongodb-clients packages provided by Ubuntu
  • install mongodb-org-shell provided by official MongoDB

This solved the problem, because The unofficial mongodb package provided by Ubuntu is not maintained by MongoDB. You should always use the official MongoDB mongodb-org packages, which are kept up-to-date with the most recent major and minor MongoDB releases.

Upvotes: 1

user7911771
user7911771

Reputation: 1

I had the same error with a Spring Boot app using a new MongoDB 3.2.8 database. By upgrading to the latest version of the Java Mongo driver (3.2.2) and then adding the authentication mechanism param to the URI in my application.properties, I was able to get it working:

spring.data.mongodb.uri=mongodb://myusername:mypassword@localhost/?authSource=admin&authMechanism=SCRAM-SHA-1
spring.data.mongodb.database=test

Upvotes: -1

Derrick Petzold
Derrick Petzold

Reputation: 1148

For me I was using a mongo 2 client trying to connect to a mongo 3 server. Upgrading the client fixed the issue.

Upvotes: 3

Zubair Alam
Zubair Alam

Reputation: 8937

Adding to above solution by Vivek & explanation taken from here

use admin
db.system.users.remove({})    <== removing all users
db.system.version.remove({}) <== removing current version 
db.system.version.insert({ "_id" : "authSchema", "currentVersion" : 3 })
  • you only need to downgrade the schema to create MONGODB-CR users. Once they are there the old drivers will work regardless of the value of authSchemaVersion. However if you run authSchemaUpgrade to change from "3" to "5" the users will obviously be upgraded.
  • My comment regarding new users was that if you have existing SCRAM users and change the schema manually to "3" the user documents won't be consistent with the new schema. This is not enforced however but the SCRAM users will still work for any driver supporting SCRAM.

Upvotes: 9

TylerD75
TylerD75

Reputation: 1

Probably old news, and problem solved, but adding my experience with the same error:

I had the exact same problem (using MongoDB 3.0), and a C# driver that was setup to use a pre 3.0 db.

In C# I used "MongoDB.Driver.CreateMongoCRCredentials()", which caused the error the OP was getting.

The fix (for me), was to switch the command above to "MongoDB.Driver.CreateCredential()".

I guess this could be caused by using "old" users (from pre 3.0) on an upgraded system. Which either forces you to upgrade your users to the new authentication mechanism, or downgrade the authentication mechanism on your server.

Upvotes: 0

sonal kumar sinha
sonal kumar sinha

Reputation: 37

Upgrade mongo-java-driver to 3.0.3 and use :-

MongoCredential.createScramSha1Credential instead of MongoCredential.createMongoCRCredential

MongoCredential createMongoCRCredential = MongoCredential.createScramSha1Credential(mongoConfiguration.getDatabaseUserName(), mongoConfiguration.getAuthenticationDatabase(),mongoConfiguration.getDatabasePassword().toCharArray());

http://docs.mongodb.org/master/release-notes/3.0-scram/

Upvotes: 3

Ahmed Haque
Ahmed Haque

Reputation: 7514

I think this is the answer you need:

1) Start 3.0 without auth enabled. (Auth needs to be disabled otherwise you'll get the not authorized error).

2) Run (after selecting "admin"use db):

var schema = db.system.version.findOne({"_id" : "authSchema"})

schema.currentVersion = 3

db.system.version.save(schema)

3) restart mongodb with auth enabled.

4) Create a new admin user (the old one, the one you created before this workaround won't work).

Things should work now. This issue was driving me crazy as well.

Answer came from here: https://jira.mongodb.org/browse/SERVER-17459

Upvotes: 13

technocrat
technocrat

Reputation: 3695

I was getting this error as well.

Check your Spring Config file.. I had a constructor arg named "MONGODB-CR" which I swapped to "SCRAM-SHA-1" and it fixed my issue.

tailing the mongodb log file helped me diagnose this.

Upvotes: 1

Winston Lee
Winston Lee

Reputation: 261

Had the same issue. What was happening to me was that when I use MongoDB 3 to create my user, it was using SCRAM-SHA-1 as it's authentication mechanism instead of MongoDB-CR. What I had to do was:

  1. List item
  2. Delete the created user.
  3. Modify the collection admin.system.version such that the authSchema's currentVersion is 3 instead of 5 (3 is using MongoDB-CR).
  4. Recreate your user.

Should work without problems now.

Upvotes: 20

acabra85
acabra85

Reputation: 369

The step number 2. above is not detailed explicitly, I found this solution and worked for me.

var schema = db.system.version.findOne({"_id" : "authSchema"})
schema.currentVersion = 3
db.system.version.save(schema)

Upvotes: 19

Related Questions