1Panel-dev/1Panel · error · Error

failed to update mongodb user privileges

Error message

failed to update mongodb user privileges

What it means

Final step of the privilege-change script (database_mongodb.go:804): `updateUser` with the merged roles array returned ok !== 1. The roles array was built by filtering the user's existing roles and pushing `{ role: permission, db: dbName }`, so failure usually means the permission string is not a recognized built-in role, the caller may not grant that role, or a role from another db survived the filter and cannot be re-granted here.

Source

Thrown at agent/app/service/database_mongodb.go:804

const userInfo = targetDb.runCommand({
  usersInfo: userName,
  showCredentials: false,
  showCustomData: false
});
if (!userInfo || userInfo.ok !== 1) {
  throw new Error("failed to load mongodb user privileges");
}
if (!Array.isArray(userInfo.users) || userInfo.users.length === 0) {
  throw new Error("mongodb user not found: " + userName);
}
const roles = (userInfo.users[0].roles || []).filter(role => role.db !== dbName);
roles.push({ role: permission, db: dbName });
const result = targetDb.runCommand({
  updateUser: userName,
  roles: roles
});
if (!result || result.ok !== 1) {
  throw new Error("failed to update mongodb user privileges");
}
`, databaseJSON, usernameJSON, permissionJSON))
	return runMongodbAdminScript(connectionName, script)
}

func loadRemoteMongodbPrivilege(connectionName, dbName, username string) (string, error) {
	info, err := loadRemoteMongodbConnection(connectionName)
	if err != nil {
		return "", err
	}
	client, ctx, cancel, err := newRemoteMongodbClient(info)
	if err != nil {
		return "", err
	}
	defer cancel()
	defer client.Disconnect(ctx)

	targetDB := client.Database(dbName)

View on GitHub (pinned to 5ac7c80881)

Solutions

1. Run updateUser manually with the same roles array and read codeName — 'No role named <x>@<db>' pinpoints a bad permission value
2. Restrict the UI/input permission set to roles that exist on this server (`db.getSiblingDB(dbName).runCommand({rolesInfo:1, showBuiltinRoles:true})`)
3. Grant the admin credential grantRole for the requested role, or use root
4. Drop stale cross-db roles for the user before changing permissions

Example fix

// validate before submit
// const ok = db.getSiblingDB("mydb")
//   .runCommand({rolesInfo:"readWrite", showBuiltinRoles:true}).roles?.length > 0;

// validate the permission against the server's role catalog before submit
// db.getSiblingDB(dbName).runCommand({rolesInfo:1, showBuiltinRoles:true}).roles
// reject permission values not present in that catalog

// Go: whitelist known-good roles before building the script
var mongodbBuiltinRoles = map[string]bool{
    "read": true, "readWrite": true, "dbAdmin": true, "dbOwner": true,
    "readAnyDatabase": true, "readWriteAnyDatabase": true, "userAdminAnyDatabase": true,
}
func validMongodbRole(p string) bool { return mongodbBuiltinRoles[p] }

if err := changePrivilege(...); err != nil && strings.Contains(err.Error(), "failed to update mongodb user privileges") {
    // surface rolesInfo output so the user sees which role name is unknown
}

When it happens

Trigger: Submitting a permission value that is not a valid role on that MongoDB (custom role not defined, typo like 'read_write'); the admin credential can modify the user but lacks grantRole for the requested permission; roles attached to other dbs cause updateUser to fail when re-granted on this db.

Common situations: Custom role names that exist on some deployments but not this one; version differences in role availability; least-privilege admin credentials.

Related errors

• failed to update mongodb user ${userName}
• failed to update mongodb user password ${userName}
• failed to drop users from ${dbName}
• failed to drop database ${dbName}
• failed to load mongodb user ${userName}

AI-assisted analysis of 1Panel-dev/1Panel@5ac7c80881 (2026-08-15). Data as JSON: /api/errors/80a3c922e5f3e3b2. Report an issue: GitHub.