当我尝试获取有关副本的信息时,我会收到以下错误:
rep0:PRIMARY> rs.printReplicationInfo()
2015-05-19T13:30:29.231+0200 error: {
"$err" : "not authorized for query on local.system.namespaces",
"code" : 13
} at src/mongo/shell/query.js:131
我试图使用以下两个用户执行命令:
[
{
"_id" : "admin.siteRootAdmin",
"user" : "siteRootAdmin",
"db" : "admin",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
]
},
{
"_id" : "admin.mongoadmin",
"user" : "mongoadmin",
"db" : "admin",
"roles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
},
{
"role" : "dbOwner",
"db" : "admin"
},
{
"role" : "clusterAdmin",
"db" : "admin"
}
]
}
]
尽管我有clusterAdmin
可以与副本一起工作,但我试图更新MongoAdmin的角色来读取本地数据库(因为所有角色均在Admin DB上授予),但我会收到以下错误:
rep0:PRIMARY> db.system.users.update({"user":"mongoadmin"},{$addToSet:{"roles":"readAnyDatabase"}})
WriteResult({
"writeError" : {
"code" : 13,
"errmsg" : "not authorized on admin to execute command { update: "system.users", updates: [ { q: { user: "mongoadmin" }, u: { $addToSet: { roles: "readAnyDatabase" } }, multi: false, upsert: false } ], ordered: true }"
}
})
- 为了完全访问所有人,我需要拥有什么副本命令除了
clusterAdmin
角色吗? - 如果两个用户都有管理DB的权限(MongoAdmin是dbowner),为什么我没有更新命令的权限?
我正在用错误的命令更新角色是正确的:
db.grantRolesToUser( "mongoadmin", [{ role: "read", db: "local"}])
现在我可以检查replicainfo:
rep0:PRIMARY> rs.printReplicationInfo()
configured oplog size: 990MB
log length start to end: 617347secs (171.49hrs)
oplog first event time: Thu May 14 2015 14:25:04 GMT+0200 (CEST)
oplog last event time: Thu May 21 2015 17:54:11 GMT+0200 (CEST)
now: Thu May 21 2015 17:54:24 GMT+0200 (CEST)