MongoDB Cluster – Can’t access member of shard with credentials

It looks like the current MongoDB 3.0 upgrade instructions are missing mention of two important parameters for backing up and restoring users and roles:

• mongodump --dumpDbUsersAndRoles (see also: Required Access to Backup User Data).
• mongorestore --restoreDbUsersAndRoles (see also: Required Access to Restore User Data)

I can think of several approaches to fix:

1. If you don't have many user accounts on the config servers, recreate the administrator & user accounts. This isn't ideal, but is probably the fastest approach.

2. Export the users from your mmap database. This is more involved, but saves you recreating the users & roles. I've described steps for this below.

3. Redo the config server migration with the user & role information included. I expect this is the least desirable option.

Exporting the users

Assuming you have already upgraded all of your config servers to WiredTiger, here are some steps to add the user information:

1. Disable the balancer

2. Stop the last config server listed in your mongos' configDB setting (will call that config3 for the purpose of these steps). This will ensure your sharded cluster metadata remains read-only for the following steps.

3. Re-start config2 using the mmap data directory

   At this stage you should have:

   • config1 (running WiredTiger)
   • config2 (running mmap with user/role data)
   • config3 (stopped)

4. Export the data from config2:

   mongodump --db config --dumpDbUsersAndRoles --username .. --password ..

   Add any other parameters needed, eg --authenticationDatabase .. if you need to auth against another database.

5. If you have users in the admin database on your config server, you will also want to dump that as well.

6. (optional) Remove files from your dump except for the user/role information. If you are certain nothing has changed since you did the original migration from mmap to WiredTiger you could skip this step, however it would be safer to not overwrite any existing data.

   Preview the files to remove:

   find ./dump -type f -not -name "\$admin.system*"

   WARNING: removing files, make sure you have previewed to confirm:

   find ./dump -type f -not -name "\$admin.system*" | xargs rm

7. Re-start config2 using the wiredTiger storage engine

8. Run: mongorestore --db config --restoreDbUsersAndRoles dump/config/

   You should see messages about restoring users & roles, for example:

   2015-03-18T02:41:34.887+1100 restoring users from dump/config/$admin.system.users.bson

   2015-03-18T02:41:34.887+1100 restoring roles from dump/config/$admin.system.roles.bson

9. Login to config2 and confirm the users are correctly setup (i.e. auth with admin account, use db.getUsers() to check).

   At this stage you should have:

   • config1 (running WiredTiger)
   • config2 (running WiredTiger with user/role data)
   • config3 (stopped)

10. Copy the dump directory to config1 and repeat the mongorestore step.

11. Shutdown config2 (to keep the sharded cluster metadata readonly for the next step).

    At this stage you should have:

    • config1 (running WiredTiger with user/role data)
    • config2 (stopped)
    • config3 (stopped)

12. Start config3. Copy the dump directory to config3, and repeat the mongorestore step.

    At this stage you should have:

    • config1 (running WiredTiger with user/role data)
    • config2 (stopped)
    • config3 (running WiredTiger with user/role data)

13. Start config2. At this point all config servers should be online with the user information.

14. Re-enable the balancer so normal balancing activity & chunk migration can resume.

Check to see what processes you have running:

ps aux | grep mongod

You should see something like that:

mongod --port 27017 --replSet replica --dbpath s1 --logpath s1/monogd.log --fork
mongod --port 27018 --replSet replica --dbpath s2 --logpath s2/monogd.log --fork
mongod --port 27019 --replSet replica --dbpath s3 --logpath s3/monogd.log --fork

You will be able to connect using:

mongo "mongodb://localhost:27017, localhost:27018, localhost:27019/?replicaSet=replica"