Authorization in mongodb

Question

The readonly users have only read permissions. Thus, a user having readonly true is not authorized to add new user or any write capabilities.

I am building a utility which manages the data in MongoDB. When i log in as readonly user it should not allow me to add new user. When I implement it, it does not actually add a user but it is not throwing any exception.

Here is my commands for adding a readonly user

var credentials = new MongoCredentials(username, password,false);
var addUser = new MongoUser(credentials, readOnly);
var database = server.GetDatabase(databaseName);
database.AddUser(addUser);

Answer 1

Did you start mongod with the --auth command line argument?

Did you use safe=true on your connection string?

Also, you need to use admin credentials to add a user to a database:

var adminCredentials = new MongoCredentials("adminuser", "adminpassword", true);
var userCredentials = new MongoCredentials("username", "password");
var user = new MongoUser(userCredentials, true);
var fooDatabase = server.GetDatabase("foo", adminCredentials);
fooDatabase.AddUser(user);

Notice that there are two sets of credentials: one for the user being added, and another set of admin credentials for your code to be able to add the user.