MongoDB provides a basic authentication system. Has it changed in version 2.2.3?

Question

Scenario: Installed MongoDB 2.2.3 on the machine (Windows 64-bit)

Followed all the steps to enforce authentication on MongoDB server.

1. Added User to admin database

   use admin
   db.addUser('me_admin', '12345');
   db.auth('me_admin','12345');
   

2. Ran database server (mongod.exe process) with the --auth option to enable authentication

Followed all answers for similar question: How to secure MongoDB with username and password

Issue: With new version 2.2.3 I am not able set up authentication. After following the same steps I was able to set up the authentication for the version 2.0.8 on the same machine. But its mentioned somewhere in MongoDB docs that "Authentication on Localhost varies slightly between before and after version 2.2"

Question: What is the change and how can enforce the authentication in new versions i.e. 2.2 onwards. Can anybody give some idea or solution to proceed the same with new MongoDB 2.2.3?

---

Update: I had checked that authentication works same on 2.2.3 when I start mongod.exe process with --auth parameter from command prompt.

I was using auth=true parameter in config file as mentioned in docs, but this did not work.

Research done:

1. When mongod.cfg file contains following configurations

   logpath=c:\mongodb\log\mongo.log, auth=true, profile=2

   The log.txt file contains following logs

   Mon Mar 11 15:06:35 Trying to start Windows service 'MongoDB'
   Mon Mar 11 15:06:35 Service running
   Mon Mar 11 15:06:35 [initandlisten] MongoDB starting : pid=7152 port=27017 dbpath=\data\db\ 64-bit host=AMOL-KULKARNI
   Mon Mar 11 15:06:35 [initandlisten] db version v2.2.3, pdfile version 4.5
   Mon Mar 11 15:06:35 [initandlisten] git version: f570771a5d8a3846eb7586eaffcf4c2f4a96bf08
   Mon Mar 11 15:06:35 [initandlisten] build info: windows sys.getwindowsversion(major=6, minor=1, build=7601, platform=2, service_pack='Service Pack 1') BOOST_LIB_VERSION=1_49
   Mon Mar 11 15:06:35 [initandlisten] options: { config: "C:\mongodb\mongod.cfg", logpath: "c:\mongodb\log\mongo.log auth=true profile=2", service: true }
   Mon Mar 11 15:06:35 [initandlisten] journal dir=/data/db/journal
   Mon Mar 11 15:06:35 [initandlisten] recover : no journal files present, no recovery needed
   Mon Mar 11 15:06:35 [initandlisten] waiting for connections on port 27017
   Mon Mar 11 15:06:35 [websvr] admin web console waiting for connections on port 28017
   

2. When I run from command prompt mongod --auth, following log will be displayed:

       Mon Mar 11 15:09:40 [initandlisten] MongoDB starting : pid=6536 port=27017 dbpath=\data\db\ 64-bit host=AMOL-KULKARNI
       Mon Mar 11 15:09:40 [initandlisten] db version v2.2.3, pdfile version 4.5
       Mon Mar 11 15:09:40 [initandlisten] git version: f570771a5d8a3846eb7586eaffcf4c2f4a96bf08
       Mon Mar 11 15:09:40 [initandlisten] build info: windows sys.getwindowsversion(major=6, minor=1, build=7601, platform=2, service_pack='Service Pack 1') BOOST_LIB_VERSION=1_49
       Mon Mar 11 15:09:40 [initandlisten] options: { auth: true }
       Mon Mar 11 15:09:40 [initandlisten] journal dir=/data/db/journal
       Mon Mar 11 15:09:40 [initandlisten] recover : no journal files present, no recovery needed
       Mon Mar 11 15:09:40 [initandlisten] waiting for connections on port 27017
       Mon Mar 11 15:09:40 [websvr] admin web console waiting for connections on port 28017
   

Note: The change in the options:

1. options:{ config: "C:\mongodb\mongod.cfg", logpath: "c:\mongodb\log\mongo.log auth=true profile=2", service: true } //Does not work

2. options: { auth: true } //Works

Interesting to observe is that,

When its ran from config file.

logpath=c:\mongodb\log\mongo.log, auth=true, profile=2

It got changed to:

logpath: "c:\mongodb\log\mongo.log auth=true profile=2", service: true

I know here is the issue. It should be like:

logpath: "c:\mongodb\log\mongo.log", auth=true, profile="2", service: true

So, the question is how to pass auth=true parameter from config file and run mongod.exe process as service on Windows7

Answer 1

The change is only minor as described under the part you quoted:

In general if there are no users for the admin database, you may connect via the localhost interface. For sharded clusters running version 2.2, if mongod is running with auth then all users connecting over the localhost interface must authenticate, even if there aren’t any users in the admin database.

Basically before 2.2 if you were in a sharded cluster you could connect to localhost and not be forced to auth if there are no users found in the admin database. This means that if you set-up a sharded cluster it might be wise to setup a default user, which you have already done.

Can anybody give some idea or solution to proceed the same with new MongoDB 2.2.3?

The new auth system will just be there, you don't need to do anything; it just will be.

Answer 2

Found out the solution.

To run MongoDB process (mongod.exe) as service with auth=true, following has to be taken care while registering MongoDB service itself (not mentioned in docs)

Service has to be registered with following command:

C:\mongodb\bin\mongod.exe --config C:\mongodb\mongod.cfg --auth --install

mongod.cfg file will have only logpath=c:\mongodb\log\mongo.log

Shared with you all so that effort & time will not be put on the same issue again.

Happy exploring to all.. :-)

Note this time log contains:

Mon Mar 11 15:58:06 Trying to start Windows service 'MongoDB'
Mon Mar 11 15:58:06 Service running
Mon Mar 11 15:58:06 [initandlisten] MongoDB starting : pid=6800 port=27017 dbpath=\data\db\ 64-bit host=AMOL-KULKARNI
Mon Mar 11 15:58:06 [initandlisten] db version v2.2.3, pdfile version 4.5
Mon Mar 11 15:58:06 [initandlisten] git version: f570771a5d8a3846eb7586eaffcf4c2f4a96bf08
Mon Mar 11 15:58:06 [initandlisten] build info: windows sys.getwindowsversion(major=6, minor=1, build=7601, platform=2, service_pack='Service Pack 1') BOOST_LIB_VERSION=1_49
Mon Mar 11 15:58:06 [initandlisten] options: { auth: true, config: "C:\mongodb\mongod.cfg", logpath: "c:\mongodb\log\mongo.log", service: true }
Mon Mar 11 15:58:06 [initandlisten] journal dir=/data/db/journal
Mon Mar 11 15:58:06 [initandlisten] recover : no journal files present, no recovery needed
Mon Mar 11 15:58:06 [initandlisten] waiting for connections on port 27017
Mon Mar 11 15:58:06 [websvr] admin web console waiting for connections on port 28017