Skip to content

Commit 7d83399

Browse files
author
Ed Costello
committed
formatting tweaks and cleanup
1 parent 78e795c commit 7d83399

File tree

1 file changed

+44
-40
lines changed

1 file changed

+44
-40
lines changed

draft/tutorial/use-authentication-to-control-access-to-mongodb.txt

Lines changed: 44 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Basic authentication and access control is enabled with the
88
:option:`--auth <mongod --auth>`
99
or
1010
:option:`--keyFile <mongod --keyFile>`
11-
options in versions of MongoDB up to and including version 2.2
11+
options in versions of MongoDB up to and including version 2.2.
1212

1313
Some important things to note about authentication:
1414

@@ -24,7 +24,7 @@ have read access.
2424
Each database contains a "system.users" collection, which contains
2525
all the user information. For example:
2626

27-
... code-block:: javascript
27+
.. code-block:: javascript
2828

2929
> db.system.users.find()
3030
{ "_id": ObjectId("5075362366b2b6e3603b65c9"), "user": "readOnly", "readOnly": true, "pwd": "76841722f39207db6b332e64bfacd4ba" }
@@ -36,9 +36,9 @@ with only two roles – "read" and "normal" (i.e. full read/write
3636
access). There are several tickets related to improving the
3737
implementation of authorization within MongoDB:
3838

39-
:jira:`SERVER-3198`
40-
:jira:`SERVER-7122`
41-
:jira:`SERVER-7124`
39+
* :issue:`SERVER-3198`
40+
* :issue:`SERVER-7122`
41+
* :issue:`SERVER-7124`
4242

4343
The admin database is special. Several administrative commands
4444
can only run on the admin database (and so can only be run by an
@@ -59,14 +59,17 @@ Adding Users
5959

6060
You must either:
6161

62-
have added a user to the admin db before starting the server with -auth,
62+
#. have added a user to the admin db before starting the server with
63+
:option:`--auth <mongod --auth>`,
6364

64-
added the first user from a localhost connection (you cannot add the first user from a connection that is not local with respect to the `mongod` process).
65+
#. added the first user from a localhost connection (you cannot add
66+
the first user from a connection that is not local with respect to
67+
the :program:`mongod` process).
6568

6669
.. note::
6770

6871
Option (2) to add a user via localhost does not work in
69-
sharded clusters running v2.2+ due to :jira:`SERVER-6591`. If you are
72+
sharded clusters running v2.2+ due to :issue:`SERVER-6591`. If you are
7073
running 2.2 with a sharded cluster and want to use secure mode you
7174
must setup the cluster and add an admin user before restarting the
7275
cluster to run with :option:`--keyFile <mongod --keyFile>`.
@@ -163,44 +166,45 @@ Authentication on Localhost
163166

164167
.. versionadded:: 2.0
165168

166-
The trust model, in this version, dictates that that if the
167-
user has access to running the mongo shell on localhost
168-
(127.0.0.1) then the user has write access to add users
169-
regardless of what authentication is enforced in the :program:`mongod`
170-
configuration, i.e. authentication does not apply to users
171-
logging into `mongod` on localhost.
169+
The trust model, in this version, dictates that that if the
170+
user has access to running the mongo shell on localhost
171+
(127.0.0.1) then the user has write access to add users
172+
regardless of what authentication is enforced in the :program:`mongod`
173+
configuration, i.e. authentication does not apply to users
174+
logging into `mongod` on localhost.
175+
172176

173177
.. versionadded:: 2.2
174178

175-
The trust model changed for MongoDB 2.2. If :program:`mongod`
176-
is started with the :option:`--auth <mongod --auth>` option then
177-
authentication is applied to local users.
178-
179-
For example, below the user connects as a read-only user to the
180-
test database and tries to insert a collection but cannot.
179+
The trust model changed for MongoDB 2.2. If :program:`mongod`
180+
is started with the :option:`--auth <mongod --auth>` option then
181+
authentication is applied to local users.
181182

182-
.. code-block:: sh
183-
184-
$ mongo localhost/test -u readOnly -p test
185-
186-
.. code-block:: javascript
187-
188-
MongoDB shell version: 2.2.0
189-
connecting to: localhost/test
183+
For example, below the user connects as a read-only user to the
184+
test database and tries to insert a collection but cannot.
185+
186+
.. code-block:: sh
187+
188+
$ mongo localhost/test -u readOnly -p test
189+
190+
.. code-block:: javascript
191+
192+
MongoDB shell version: 2.2.0
193+
connecting to: localhost/test
190194

191-
test > db.coll.insert({foo:'bar'})
192-
unauthorized
195+
test > db.coll.insert({foo:'bar'})
196+
unauthorized
193197

194-
test > db.system.users.find()
195-
error: {
196-
"$err": "unauthorized db:test ns:test.system.users lock type:1 client:127.0.0.1",
197-
"code": 10057
198-
}
198+
test > db.system.users.find()
199+
error: {
200+
"$err": "unauthorized db:test ns:test.system.users lock type:1 client:127.0.0.1",
201+
"code": 10057
202+
}
199203

200-
However, when connecting to MongoDB over localhost with
201-
authentication enabled but without any admin users, the user may
202-
access the database from the localhost interface without
203-
authenticating.
204+
However, when connecting to MongoDB over localhost with
205+
authentication enabled but without any admin users, the user may
206+
access the database from the localhost interface without
207+
authenticating.
204208

205209
In summary, below is a table of the scenarios for accessing the
206210
database when running with authentication enabled:
@@ -240,7 +244,7 @@ This authentication schema is working as designed and is
240244
consistent with the MongoDB trust model up to and including 2.2.
241245
Subsequent versions of MongoDB will contain more secure and
242246
enterprise-type authentication models. For further information,
243-
please see :jira:`SERVER-3198` and :jira:`SERVER-7155`.
247+
please see :issue:`SERVER-3198` and :issue:`SERVER-7155`.
244248

245249
Below is a step-by-step walkthrough.
246250

0 commit comments

Comments
 (0)