执行MongoDB createRole遇Unauthorized错误，求权限配置方案

现有账号权限 #

账号svc-mydbuser的现有权限配置如下：

{
   privileges: [
      {
         actions: ["dropRole", "createRole", "grantRole", "find", "viewRole"],
         resource: { db: "admin", collection: "" }
      },
      {
         actions: [
            "changeStream", "collStats", "createIndex", "dbHash",
            "dbStats", "dropIndex", "find", "killCursors", "listCollections",
            "listIndexes", "planCacheRead", "insert", "update", "remove"
         ],
         resource: { db: "admin", collection: "system.roles" }
      },
      {
         actions: ["dropDatabase", "createDatabase"],
         resource: { db: "core-POC", collection: "" }
      }],
   roles: [
      { role: "readWrite", db: "core-POC" },
      { role: "userAdmin", db: "admin" }
   ]
}

执行操作及报错 #

登录MongoDB后在admin库执行以下创建角色命令：

use admin;

db.adminCommand(
   {
      createRole: "CN=GLB-Admin-S-L,OU=Groups - Applications,OU=Global Admin Groups,DC=dmzprod01,DC=mybank,DC=com",
      privileges: [],
      roles: [
         { role: "read", db: "core-POC" }
      ]
   }
);

返回报错信息：

{
        "operationTime" : Timestamp(1691051515, 106),
        "ok" : 0,
        "errmsg" : "not authorized on admin to execute command { createRole: \"CN=GLB-Admin-S-L,OU=Groups - Applications,OU=Global Admin Groups,DC=dmzprod01,DC=mybank,DC=com\", privileges: [], roles: [ { role: \"read\", db: \"core-POC\" } ], lsid: { id: UUID(\"0174cbc1-0595-40f2-9609-bd43927c06f4\") }, $clusterTime: { clusterTime: Timestamp(1691048964, 1), signature: { hash: BinData(0, 2B98A040357462EBE5CB97642C569DC3A6958C81), keyId: 7216972790308536321 } }, $db: \"admin\" }",    
        "code" : 13,    
        "codeName" : "Unauthorized",    
        "$clusterTime" : {    
                "clusterTime" : Timestamp(1691051515, 106),    
                "signature" : {    
                        "hash" : BinData(0,"ygtzgwKkaNXmNzIXYCzbk9yprbk="),    
                        "keyId" : NumberLong("7216972790308536321")    
                }    
        }    
}

权限配置说明 #

报错原因 #

账号svc-mydbuser已具备admin库的createRole、dropRole权限，但本次创建的角色引用了core-POC数据库的内置read角色，账号缺少对core-POC数据库的grantRole权限，导致无法完成跨库角色的授予操作。

需新增的权限 #

为了成功执行createRole（包含跨库角色引用）和dropRole命令，需要给账号新增以下权限：

• 针对core-POC数据库的grantRole权限，配置如下：

{
  "actions": ["grantRole"],
  "resource": { "db": "core-POC", "collection": "" }
}

关于dropRole权限 #

现有账号已具备admin库的dropRole权限，若删除的是admin库内的角色，现有权限已满足需求；若需删除其他数据库的角色，则需对应添加目标数据库的dropRole权限。

内容的提问来源于stack exchange，提问作者Ashar