MongoDB - What is the privilege needed to run setFeatureCompatibilityVersion?

Question

Using mongoDB 3.4.3 I'm facing the problem described in this issue (https://jira.mongodb.org/browse/SERVER-26556) when trying to create an index with collation.

Since I've upgraded from a previous version, it says what is needed is to explicitly allow the backwards-incompatible 3.4 features set, but with a user with role userAdminAnyDatabase I still have no permission:

> db.adminCommand({setFeatureCompatibilityVersion: "3.4"})
{
    "ok" : 0,
    "errmsg" : "not authorized on admin to execute command {setFeatureCompatibilityVersion: \"3.4\" }",
    "code" : 13,
    "codeName" : "Unauthorized"
}

My question is, what role does the user needs to be able to do this?

Answer 1

Using a user with root privilege worked.

After authentication:

> use admin
> db.adminCommand({setFeatureCompatibilityVersion: "3.4"})
{ "ok" : 1 }

Answer 2

I was not able to run the command as I was getting the following error :

db.adminCommand( { setFeatureCompatibilityVersion: "3.4" } )
{
    "ok" : 0,
    "errmsg" : "not authorized on admin to execute command { setFeatureCompatibilityVersion: \"3.4\", $db: \"admin\" }",
    "code" : 13,
    "codeName" : "Unauthorized"
}

The following link gives details :

https://dba.stackexchange.com/questions/159390/mongodb-all-commands-spit-out-not-authorized-on-admin-to-execute-command

Steps I followed (I am using Mac) :

1. sudo nano /usr/local/etc/mongod.conf

2. Comment the security as shown below:

3. Restart MongoDB. sudo brew services restart mongodb

4. Connect using mongodb and run the following code

   use admin

   db.adminCommand( { setFeatureCompatibilityVersion: "3.4" } )

   

5. Uncomment the security in mongod.conf and restart the MongoDB server.

Answer 3

To be able to execute setFeatureCompatibilityVersion user must have "clusterManager" built-in role.

See documentation here: https://docs.mongodb.com/manual/reference/built-in-roles/#clusterManager