Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-11300

Possible to Create Circular Roles

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 2.5.4
    • Affects Version/s: 2.5.3
    • Component/s: Security
    • Labels:
    • ALL

      Using updateRole, it is possible to create a role that contains a reference to itself:

      > db.runCommand(

      { updateRole: "king", roles: [ "king" ] }

      )

      Running this command gives the following error:

      ERROR: Inconsistent role graph during authorization manager intialization. Only direct privileges available. Cycle in dependency graph: king@test -> king@test after applying oplog entry u

      Querying for the role afterwards with rolesInfo yields the following result:
      {"roles":[
      {"role":"king",
      "db":"test",
      "roles":[

      {"role":"king","db":"test"}

      ],
      "indirectRoles":[],
      "privileges":[],
      "warnings":["Role graph state inconsistent; only direct privileges available."]}],
      "ok":1}

      afterwards, subsequent role-related commands (like createRole, dropRole) throw the same error that the updateRole command generated.

      It seems that grantRolesToRole also allows for this:

      > db.runCommand(

      { createRole: "princess", privileges: [], roles: [] }

      );
      > db.runCommand(

      { grantRolesToRole: "princess", grantedRoles: [ "princess" ] }

      );

      ERROR: Inconsistent role graph during authorization manager intialization. Only direct privileges available. Cycle in dependency graph: princess@testAuth -> princess@testAuth after applying oplog entry u

      {"roles":[
      {"role":"princess",
      "db":"testAuth",
      "roles":[

      {"role":"princess","db":"testAuth"}

      ],
      "indirectRoles":[],
      "privileges":[],
      "warnings":["Role graph state inconsistent; only direct privileges available."]}],
      "ok":1}

            Assignee:
            spencer@mongodb.com Spencer Brody (Inactive)
            Reporter:
            samantha.ritter@mongodb.com Samantha Ritter (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: