Major - P3 Noticed the following inconsistency while testing 2.6 user-defined roles.
When logged in as a user with userAdminAnyDatabase, it's not possible to create a role in a non-admin database that has privileges outside of that database (good). However, it is possible to create a user in a non-admin database that has privileges outside of that database (see below). This struck me as a little inconsistent. Is there a reason for this? Should it be fixed?
> use admin
|
switched to db admin
|
> db.auth("jon","password")
|
1
|
>
|
> use foo
|
switched to db foo
|
>
|
>
|
> db.createRole({role:"readinany", privileges:[{resource:{db:"", collection:""}, actions:["find"]}], roles:[]})
|
2013-12-03T17:56:48.579+0000 Error: Roles on the 'foo' database cannot be granted privileges that target other databases
|
or the cluster at src/mongo/shell/db.js:1294
|
>
|
>
|
> db.createUser({user:"bob",pwd:"password",roles:[{role:"readWrite", db:"bar"}]})
|
Successfully added user: {
|
"user" : "bob",
|
"roles" : [
|
{
|
"role" : "readWrite",
|
"db" : "bar"
|
}
|
]
|
}
|
>
|