Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-11343

Change chunk manipulation commands to require privileges on the sharded collection rather than the cluster resource

    XMLWordPrintableJSON

Details

    • Icon: Improvement Improvement
    • Resolution: Done
    • Icon: Major - P3 Major - P3
    • 2.5.4
    • None
    • Security, Sharding
    • None

    Description

      Currently, commands for manipulating sharding information about a collection (shardCollection, moveChunk, splitChunk, etc.) require privileges on the cluster resource. This means that you can only grant users the ability to shard all collections or none, there's no way to say you can shard collections in this db but not collections in this other db. If we change the access control checks in these commands to use the namespace as the target, this should be easy to fix.

      Attachments

        Activity

          People

            spencer@mongodb.com Spencer Brody (Inactive)
            spencer@mongodb.com Spencer Brody (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: