1Panel-dev/1Panel · error · Error

failed to create mongodb user ${userName}

Error message

failed to create mongodb user ${userName}

What it means

The createUser branch of buildMongodbBindUserScript: usersInfo returned no users, then `createUser` returned `ok !== 1`. Even after an existence check, createUser fails when the user already exists (race or stale view), the caller lacks createUser privilege, or the password fails validation.

Source

Thrown at agent/app/service/database_mongodb.go:491

}
const roles = [{ role: "readWrite", db: dbName }];
if (Array.isArray(userInfo.users) && userInfo.users.length > 0) {
  const result = targetDb.runCommand({
    updateUser: userName,
    pwd: password,
    roles: roles
  });
  if (!result || result.ok !== 1) {
    throw new Error("failed to update mongodb user " + userName);
  }
} else {
  const result = targetDb.runCommand({
    createUser: userName,
    pwd: password,
    roles: roles
  });
  if (!result || result.ok !== 1) {
    throw new Error("failed to create mongodb user " + userName);
  }
}
`, dbNameJSON, usernameJSON, passwordJSON)), nil
}

func buildMongodbPasswordScript(dbName, username, password string) (string, error) {
	dbNameJSON, err := json.Marshal(dbName)
	if err != nil {
		return "", err
	}
	usernameJSON, err := json.Marshal(username)
	if err != nil {
		return "", err
	}
	passwordJSON, err := json.Marshal(password)
	if err != nil {
		return "", err
	}

View on GitHub (pinned to 5ac7c80881)

Solutions

1. Run createUser manually in the container and read codeName/errmsg — 'UserAlreadyExists' means a race or wrong db
2. Check `db.getSiblingDB("admin").runCommand({usersInfo:{user:"<u>",db:"<db>"}})` to see where the user really lives
3. Retry the bind once the conflicting user is dropped or the password meets policy
4. Ensure the admin credential has createUser on the target db

Example fix

// idempotent manual equivalent
// const t = db.getSiblingDB("mydb");
// const exists = t.runCommand({usersInfo:"appuser"}).users?.length > 0;
// if (!exists) t.runCommand({createUser:"appuser", pwd:PASS, roles:[{role:"readWrite",db:"mydb"}]});

// serialize binds per username to avoid the create race
// e.g. per-user mutex or single-flight around bindMongodbUser

// createUser races are retryable after re-checking existence
err := bindMongodbUser(...)
if err != nil && strings.Contains(err.Error(), "failed to create mongodb user") {
    time.Sleep(200 * time.Millisecond) // let the concurrent create settle
    err = bindMongodbUser(...)         // now takes the updateUser branch
}

When it happens

Trigger: Two concurrent bind operations for the same username; the user exists on the `admin` db but not the target db (usersInfo on target sees nothing, createUser on target may conflict or be forbidden); weak password rejected by passwordValidationRegex.

Common situations: Re-binding a user that was created outside 1Panel; parallel UI actions creating the same user; hardened password policy enabled on the deployment.

Related errors

• failed to update mongodb user ${userName}
• failed to update mongodb user password ${userName}
• failed to drop users from ${dbName}
• failed to drop database ${dbName}
• failed to load mongodb user ${userName}

AI-assisted analysis of 1Panel-dev/1Panel@5ac7c80881 (2026-08-15). Data as JSON: /api/errors/7e90d6af134bc87d. Report an issue: GitHub.