Mongo: Unable to set up default credentials using environment variables

[fcanela]

Hello. I am using docker-compose to initialize a mongo database using this image.

Reading the scripts and some StackOverflow questions looks like MONGO_INITDB_ environment variables are used to achieve this.

After running the following docker-compose.yml:

version: '2'
services:
  mongodb:
    image: mongo:3.6
    environment:
      - MONGO_INITDB_ROOT_USERNAME=user
      - MONGO_INITDB_ROOT_PASSWORD=password
      - MONGO_INITDB_DATABASE=collection
    ports:
      - 27017:27017

I am unable to connect using mongo cli or mongoose node.js library:

➔ mongo -u user -p password --verbose localhost:27017/collection
MongoDB shell version: 2.6.10
connecting to: localhost:27017/collection
2018-04-10T12:29:46.386+0200 creating new connection to:localhost:27017
2018-04-10T12:29:46.386+0200 [ConnectBG] BackgroundJob starting: ConnectBG
2018-04-10T12:29:46.387+0200 connected to server localhost:27017 (127.0.0.1)
2018-04-10T12:29:46.387+0200 connected connection!
2018-04-10T12:29:46.391+0200 User Assertion: 18:{ ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" }
2018-04-10T12:29:46.392+0200 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" } at src/mongo/shell/db.js:1287
2018-04-10T12:29:46.392+0200 User Assertion: 12514:login failed
2018-04-10T12:29:46.393+0200 freeing 1 uncollected N5mongo12DBClientBaseE objects
exception: login failed

Am I doing something wrong?

[fcanela]

I tried connecting to /admin collection as set up in https://github.com/docker-library/mongo/blob/b96fddd1e1a100c01f0ea6d28e1c7ccc750fd5c0/3.6/docker-entrypoint.sh#L292

but it did not work.

[fcanela]

Derick, from irc.freenode.org #mongodb channel, suggested that it may be not picking the --auth flag. I tried to log in without credentials (mongo --verbose localhost:27017/admin) and it worked. I am still having the issue of establishing defaults credentials, so issue is not yet solved for me.

[yosifkit]

My best guess is the same as I described for postgres: https://github.com/docker-library/postgres/issues/203#issuecomment-255200501.

[fcanela]

Thanks for your fast answer, @yosifkit. Unfortunately, I have already tried to purge all volumes, images and containers from my system and the result keeps being the same. I tried running your exact command for volume deletion and after ensuring no volume is left:

➔ docker volume ls                                                                                                            
DRIVER              VOLUME NAME                                                                                                                    

I have relauched the container (using docker-compose down -v && docker-compose up --force-recreate --build mongodb) and the result is still the same:

➔ mongo -u user -p password --verbose localhost:27017/admin
MongoDB shell version: 2.6.10
connecting to: localhost:27017/admin
2018-04-11T00:45:24.147+0200 creating new connection to:localhost:27017
2018-04-11T00:45:24.148+0200 [ConnectBG] BackgroundJob starting: ConnectBG
2018-04-11T00:45:24.148+0200 connected to server localhost:27017 (127.0.0.1)
2018-04-11T00:45:24.148+0200 connected connection!
2018-04-11T00:45:24.152+0200 User Assertion: 18:{ ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" }
2018-04-11T00:45:24.153+0200 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" } at src/mongo/shell/db.js:1287
2018-04-11T00:45:24.153+0200 User Assertion: 12514:login failed
2018-04-11T00:45:24.153+0200 freeing 1 uncollected N5mongo12DBClientBaseE objects
exception: login failed

In mongo logs, a "user not found" error appears:

mongodb_1  | 2018-04-10T22:45:24.150+0000 I NETWORK  [listener] connection accepted from 172.18.0.1:53112 #2 (1 connection now open)
mongodb_1  | 2018-04-10T22:45:24.152+0000 I ACCESS   [conn2]  authenticate db: admin { authenticate: 1, nonce: "xxx", user: "user", key: "xxx", $db: "admin" }
mongodb_1  | 2018-04-10T22:45:24.152+0000 I ACCESS   [conn2] Failed to authenticate user@admin from client 172.18.0.1:53112 with mechanism MONGODB-CR: AuthenticationFailed: UserNotFound: Could not find user user@admin
mongodb_1  | 2018-04-10T22:45:24.153+0000 I NETWORK  [conn2] end connection 172.18.0.1:53112 (0 connections now open)

Anonymous connections with mongo localhost:27017/admin using the minimal example provided still works after volume deletion and restart.

[tianon]

I can't reproduce: :confused:

$ docker pull mongo:3.6
3.6: Pulling from library/mongo
Digest: sha256:d969194a7c4dcd817cae5dc726b1493547a3ad3f1b30f7f58857adc9ae6a4483
Status: Image is up to date for mongo:3.6

$ docker run -dit --name mongodb-test -e MONGO_INITDB_ROOT_USERNAME=user -e MONGO_INITDB_ROOT_PASSWORD=password -e MONGO_INITDB_DATABASE=collection mongo:3.6
225b0cb932a22f1222a091cea861afca6f60bd7d442c90576bcebb8996a97825

$ docker run -it --rm --link mongodb-test mongo:3.6 bash
root@212ab4b2bf42:/# mongo -u user -p password --verbose mongodb-test:27017/admin
MongoDB shell version v3.6.3
connecting to: mongodb://mongodb-test:27017/admin
2018-04-11T19:26:45.951+0000 D NETWORK  [thread1] creating new connection to:mongodb-test:27017
2018-04-11T19:26:45.951+0000 D NETWORK  [thread1] connected to server mongodb-test:27017 (172.18.0.22)
2018-04-11T19:26:45.951+0000 D NETWORK  [thread1] connected connection!
MongoDB server version: 3.6.3
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
    http://docs.mongodb.org/
Questions? Try the support group
    http://groups.google.com/group/mongodb-user
Server has startup warnings: 
2018-04-11T19:25:49.408+0000 I STORAGE  [initandlisten] 
2018-04-11T19:25:49.408+0000 I STORAGE  [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2018-04-11T19:25:49.408+0000 I STORAGE  [initandlisten] **          See http://dochub.mongodb.org/core/prodnotes-filesystem
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] 
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] **        We suggest setting it to 'never'
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] 
> 

$ docker logs --tail=10 mongodb-test
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] 
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] **        We suggest setting it to 'never'
2018-04-11T19:25:50.007+0000 I CONTROL  [initandlisten] 
2018-04-11T19:25:50.012+0000 I FTDC     [initandlisten] Initializing full-time diagnostic data capture with directory '/data/db/diagnostic.data'
2018-04-11T19:25:50.012+0000 I NETWORK  [initandlisten] waiting for connections on port 27017
2018-04-11T19:26:45.951+0000 I NETWORK  [listener] connection accepted from 172.18.0.23:54738 #1 (1 connection now open)
2018-04-11T19:26:45.951+0000 I NETWORK  [conn1] received client metadata from 172.18.0.23:54738 conn: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.6.3" }, os: { type: "Linux", name: "PRETTY_NAME="Debian GNU/Linux 8 (jessie)"", architecture: "x86_64", version: "Kernel 4.14.0-3-amd64" } }
2018-04-11T19:26:45.964+0000 I ACCESS   [conn1] Successfully authenticated as principal user on admin
2018-04-11T19:27:01.316+0000 I NETWORK  [conn1] end connection 172.18.0.23:54738 (0 connections now open)

[tianon]

Are you running another instance of MongoDB on your host that might be interfering? I can't think of any other reason for this to be failing with up-to-date images.

Since I can't reproduce the issue, I'm going to close, but for further help debugging, I'd recommend trying the Docker Community Forums, the Docker Community Slack, or Stack Overflow.

[fcanela]

Hello. Before closing, could you try to reproduce with the minimal docker-compose provided, please?

I am running no other mongo. If I were and it was in the same port an error would arise because the port was already being used.

[tianon]

My docker run line is equivalent to your docker-compose.yml, but just to be clear:

$ cat docker-compose.yml
version: '2'
services:
  mongodb:
    image: mongo:3.6
    environment:
      - MONGO_INITDB_ROOT_USERNAME=user
      - MONGO_INITDB_ROOT_PASSWORD=password
      - MONGO_INITDB_DATABASE=collection
    ports:
      - 27017:27017

$ docker-compose pull
Pulling mongodb (mongo:3.6)...
3.6: Pulling from library/mongo
Digest: sha256:d969194a7c4dcd817cae5dc726b1493547a3ad3f1b30f7f58857adc9ae6a4483
Status: Image is up to date for mongo:3.6

$ docker-compose up -d
Creating network "tmp_default" with the default driver
Creating tmp_mongodb_1 ... done

$ docker exec -it tmp_mongodb_1 bash
root@aca003728288:/# mongo -u user -p password localhost:27017/admin
MongoDB shell version v3.6.3
connecting to: mongodb://localhost:27017/admin
MongoDB server version: 3.6.3
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
    http://docs.mongodb.org/
Questions? Try the support group
    http://groups.google.com/group/mongodb-user
Server has startup warnings: 
2018-04-11T20:17:45.692+0000 I STORAGE  [initandlisten] 
2018-04-11T20:17:45.692+0000 I STORAGE  [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
2018-04-11T20:17:45.692+0000 I STORAGE  [initandlisten] **          See http://dochub.mongodb.org/core/prodnotes-filesystem
2018-04-11T20:17:46.242+0000 I CONTROL  [initandlisten] 
2018-04-11T20:17:46.242+0000 I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2018-04-11T20:17:46.242+0000 I CONTROL  [initandlisten] **        We suggest setting it to 'never'
2018-04-11T20:17:46.242+0000 I CONTROL  [initandlisten] 
> 

[fcanela]

I tried in several machines, one with a fresh Ubuntu install, and was able to reproduce the issue

[fcanela]

Yes, it should be equivalent. That is why I am surprised because I replicated the issue in several environments with the provided docker-compose proof of concept. I can record few screencasts replicating the issue if needed.

[fcanela]

Issue solved.

I have downloaded the repo, added some debugging lines to mongo/3.6/docker-entrypoint.sh and run the same docker-compose file but using the repo Dockerfile:

➔ cat docker-compose.yml 
version: '2'
services:
  mongodb:
    # image: mongo:3.6
    build: ./mongo/3.6/
    environment:
      - MONGO_INITDB_ROOT_USERNAME=user
      - MONGO_INITDB_ROOT_PASSWORD=password
      - MONGO_INITDB_DATABASE=collection
    ports:
      - 27017:27017

Looking to the logs (I placed some echo lines to check code paths) it looks like the credentials are created:

mongodb_1  | 2018-04-12T10:04:54.261+0000 I NETWORK  [conn2] received client metadata from 127.0.0.1:39844 conn: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.6.3" }, os: { type: "Linux", name: "PRETTY_NAME="Debian GNU/Linux 8 (jessie)"", architecture: "x86_64", version: "Kernel 4.4.0-119-generic" } }
mongodb_1  | 2018-04-12T10:04:54.277+0000 I STORAGE  [conn2] createCollection: admin.system.users with generated UUID: 8691db7c-78de-481c-beb4-81bcccc560fe
mongodb_1  | Successfully added user: {
mongodb_1  |    "user" : "user",
mongodb_1  |    "roles" : [
mongodb_1  |        {
mongodb_1  |            "role" : "root",
mongodb_1  |            "db" : "admin"
mongodb_1  |        }
mongodb_1  |    ]
mongodb_1  | }
mongodb_1  | 2018-04-12T10:04:54.320+0000 E -        [main] Error saving history file: FileOpenFailed: Unable to open() file /home/mongodb/.dbshell: No such file or directory
mongodb_1  | 2018-04-12T10:04:54.322+0000 I NETWORK  [conn2] end connection 127.0.0.1:39844 (0 connections now open)

But when trying to connect with the established credentials I receive the same error:

➔ mongo -u user -p password --verbose localhost:27017/admin                                                                                                                                                                        
MongoDB shell version: 2.6.10                                                                                                                                                                                                      
connecting to: localhost:27017/admin                                                                                                                                                                                               
2018-04-12T12:05:04.413+0200 creating new connection to:localhost:27017                                                                                                                                                            
2018-04-12T12:05:04.413+0200 [ConnectBG] BackgroundJob starting: ConnectBG                                                                                                          
2018-04-12T12:05:04.413+0200 connected to server localhost:27017 (127.0.0.1)                                                                                                        
2018-04-12T12:05:04.413+0200 connected connection!                                                                                                                                    
2018-04-12T12:05:04.418+0200 User Assertion: 18:{ ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" }                                                                             
2018-04-12T12:05:04.419+0200 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18, codeName: "AuthenticationFailed" } at src/mongo/shell/db.js:1287                 
2018-04-12T12:05:04.419+0200 User Assertion: 12514:login failed                                                                                                                    
2018-04-12T12:05:04.419+0200 freeing 1 uncollected N5mongo12DBClientBaseE objects                                                                                        
exception: login failed           

And in the server logs can be seen the credentials being refused:

mongodb_1  | 2018-04-12T10:05:04.413+0000 I NETWORK  [listener] connection accepted from 172.19.0.1:39896 #1 (1 connection now open)
mongodb_1  | 2018-04-12T10:05:04.416+0000 I ACCESS   [conn1]  authenticate db: admin { authenticate: 1, nonce: "xxx", user: "user", key: "xxx", $db: "admin" }
mongodb_1  | 2018-04-12T10:05:04.418+0000 I ACCESS   [conn1] Failed to authenticate user@admin from client 172.19.0.1:39896 with mechanism MONGODB-CR: AuthenticationFailed: MONGODB-CR credentials missing in the user document
mongodb_1  | 2018-04-12T10:05:04.420+0000 I NETWORK  [conn1] end connection 172.19.0.1:39896 (0 connections now open)

This line arose my curiosity: mongodb_1 | 2018-04-12T10:05:04.418+0000 I ACCESS [conn1] Failed to authenticate user@admin from client 172.19.0.1:39896 with mechanism MONGODB-CR: AuthenticationFailed: MONGODB-CR credentials missing in the user document

I though that maybe my client was outdated (it is MongoDB shell version: 2.6.10) so I tried with Robomongo last version (currently Robo 3T 1.2.1). Using MONGODB-C3 with Robomongo arised the same failure and log line:

mongodb_1  | 2018-04-12T10:31:17.036+0000 I ACCESS   [conn1]  authenticate db: admin { authenticate: 1, nonce: "xxx", user: "user", key: "xxx", $db: "admin" }
mongodb_1  | 2018-04-12T10:31:17.038+0000 I ACCESS   [conn1] Failed to authenticate user@admin from client 172.19.0.1:40676 with mechanism MONGODB-CR: AuthenticationFailed: MONGODB-CR credentials missing in the user document

But changing auth method to SCRAM-SHA-1 resulting in a successful connection. The problem seems to arise from the fact that Mongo 3.0 switched away from using MONGODB-CR credentials for user authentication.

Solution: upgrade the client to ensure it supports the new authentication method. Also, change the connection string so, even if it connects to another db/collection, it authenticates against admin: mongodb://user:password@localhost:27017/yourcollection?authSource=admin