Ruby on Rails Mongoid and Webfaction: Not Authorized For Query (Error 16550)

Question

I am using version 2.4.4, followed the procedures at http://docs.webfaction.com/software/mongodb.html and am using Mongoid with Ruby on Rails. I also have created a user at the db I am using with the "userAdminAnyDatabase" permission and am using it with this rails mongoid config:

production:
  sessions:
    default:
      database: <table>
      hosts:
        - localhost:<port>
      username: <user>
      password: <password>

I have the server runing with --auth flags and I also tried the user with the mongodb cpmmand line and it works but with my Rails app deployed I am still getting:

failed with error 16550: "not authorized for query on

Is there something I am missing? Perhaps a special user I need to create?

Answer 1

The userAdminAnyDatabase role doesn't quite do what you might think it does. Here's what the MongoDB docs say about it:

Important: Because users with userAdminAnyDatabase and userAdmin have the ability to create and modify permissions in addition to their own level of access, this role is effectively the MongoDB system superuser. However, userAdminAnyDatabase and userAdmin do not explicitly authorize a user for any privileges beyond user administration.

Giving the user you created the userAdminAnyDatabase role, actually only allows them to administer the database (create new users, remove users, access system.* collections) but it doesn't actually authorize them to read or write any data.

If you want to create a super user who has all admin privileges and can also read and write in any database, you'll need to also give the user the readWriteAnyDatabase role.

db.addUser({user: 'username', pwd: 'password', roles: ['readWriteAnyDatabase', 'userAdminAnyDatabase']})