Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-19131

clusterManager role does not have permission for adding tag ranges

          Details

          • Type: Bug
          • Status: Closed
          • Priority: Critical - P2
          • Resolution: Fixed
          • Affects Version/s: 2.6.5
          • Fix Version/s: 3.0.7, 3.1.7
          • Component/s: Security
          • Labels:
          • Environment:
            2.6.x
          • Backwards Compatibility:
            Fully Compatible
          • Operating System:
            ALL
          • Backport Completed:
          • Steps To Reproduce:
            Hide
            • Launch an auth enabled cluster
            • Add user with [userAdminAnyDatabase, clusterManager] role at cluster level
            • Add a tag range enabled sharded cluster 

              sh.enableSharding("test")
              		 
              sh.shardCollection("test.test", {_id: 1})
              		 
              sh.addTagRange("test.test", {_id: 1}, {_id: 10}, "S1")
              		 
              # The above statement should fail with authorization error.

            Show
            Launch an auth enabled cluster Add user with [userAdminAnyDatabase, clusterManager] role at cluster level Add a tag range enabled sharded cluster sh.enableSharding("test") sh.shardCollection("test.test", {_id: 1}) sh.addTagRange("test.test", {_id: 1}, {_id: 10}, "S1") # The above statement should fail with authorization error.
          • Sprint:
            Security 7 08/10/15, Security 8 08/28/15

            Description

            The clusterManager role provides the necessary authorizations for managing cluster. Although most of the commands and the explicit updates on the collections like config.settings are authorized, some of lesser used operations like sh.addTagRange that performs an operation directly on the underlying collection config.tag are not authorized and needs an additional readWrite permission to be granted on the config database.

              Attachments

                Issue Links

                related to

                Improvement - An improvement or enhancement to an existing feature or task. SERVER-6357 Add tag based sharding commands

                • Major - P3 - Major loss of function.
                • Closed

                  Activity

                    People

                    • Votes:
                      0 Vote for this issue
                      Watchers:
                      5 Start watching this issue

                      Dates

                      • Created:
                        Updated:
                        Resolved: