[SERVER-12562] Possible to run user mgmt read commands on secondary Created: 31/Jan/14  Updated: 11/Jul/16  Resolved: 05/Feb/14

Status: Closed
Project: Core Server
Component/s: Security
Affects Version/s: 2.5.4
Fix Version/s: 2.6.0-rc0

Type: Bug Priority: Minor - P4
Reporter: Andreas Nilsson Assignee: Andreas Nilsson
Resolution: Done Votes: 0
Labels: 26qa
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
Backwards Compatibility: Fully Compatible
Operating System: ALL
Steps To Reproduce:

Start a replica set, it will run with read preference Primary by default.
Connect with the shell to the secondary:

rs0:SECONDARY> db.getRole('a')
2014-01-31T14:15:31.288-0500 Error: Role a@test not found at src/mongo/shell/db.js:1373
rs0:SECONDARY> db.getRoles()
[ ]
rs0:SECONDARY> db.getUser('a')
2014-01-31T14:19:37.017-0500 Error: User a@test not found at src/mongo/shell/db.js:1253
rs0:SECONDARY> db.getUsers()
[ ]

Participants:

 Description   

It is possible to successfully run the commands usersInfo and rolesInfo on a secondary without setting slaveOk=true in the command.

That is, the command's corresponding slaveOk() virtual functions are returning true when they should return false. When changing slaveOk() also implement slaveOverrideOk() to return true for these commands so that specifying slaveOk=true in the command will be honored.



 Comments   
Comment by Githook User [ 05/Feb/14 ]

Author:

{u'username': u'agralius', u'name': u'Andreas Nilsson', u'email': u'andreas.nilsson@10gen.com'}

Message: SERVER-12562 Prevent user mgmt read commands on secondary
Branch: master
https://github.com/mongodb/mongo/commit/2005c58876346dba6cdc67025b8d244aca8e4e2c

Comment by Andreas Nilsson [ 04/Feb/14 ]

http://codereview.10gen.com/5408376666193920/

Generated at Thu Feb 08 03:28:53 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.