Skip to content

Commit a7e21ae

Browse files
committed
Fixed the problem: the user was not created for Mongodb 4.x
When creating a user, a password hash is used and the "digestPassword" option is set to "false". By default in Mongodb 4.x the parameter "mechanisms" is set to ["SCRAM-SHA-1","SCRAM-SHA-256"], but according to the documentation (https://docs.mongodb.com/manual/reference/command/createUser/ ) for SCRAM-SHA-256 "digestPassword" cannot be "false". Example: $ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false})" output: { "ok" : 0, "errmsg" : "Use of SCRAM-SHA-256 requires undigested passwords", "code" : 2, "codeName" : "BadValue" } If you remove SCRAM-SHA-256, it works correctly: $ mongo admin --quiet --host 127.0.0.1:27017 --eval "load('/root/.mongorc.js'); db.runCommand({\"createUser\":\"test\",\"pwd\":\"398fefcb5925a718fd0c812bbeb7e101\",\"customData\":{\"createdBy\":\"Puppet Mongodb_user['test']\"},\"roles\":[\"clusterMonitor\"],\"digestPassword\":false, \"mechanisms\":[\"SCRAM-SHA-1\"]})" output: { "ok" : 1 } Thus, you need to add SCRAM-SHA-256 support, not use "password_hash" and set digestPassword to "true", or just use SCRAM-SHA-1, which seemed to me the simplest solution, which does not require global changes.
1 parent c2511c1 commit a7e21ae

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

lib/puppet/provider/mongodb.rb

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,4 +174,13 @@ def self.mongo_26?
174174
def mongo_26?
175175
self.class.mongo_26?
176176
end
177+
178+
def self.mongo_4?
179+
v = mongo_version
180+
!v[%r{^4\.}].nil?
181+
end
182+
183+
def mongo_4?
184+
self.class.mongo_4?
185+
end
177186
end

lib/puppet/provider/mongodb_user/mongodb.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ def create
5353
digestPassword: false
5454
}
5555

56+
if mongo_4?
57+
# SCRAM-SHA-256 requires digestPassword to be true.
58+
command[:mechanisms] = ['SCRAM-SHA-1']
59+
end
60+
5661
mongo_eval("db.runCommand(#{command.to_json})", @resource[:database])
5762
else
5863
Puppet.warning 'User creation is available only from master host'

0 commit comments

Comments
 (0)