{"record":{"id":"266e18a8828f01b6","repo":"1Panel-dev/1Panel","slug":"failed-to-update-mongodb-user-username","errorCode":null,"errorMessage":"failed to update mongodb user ${userName}","messagePattern":"failed to update mongodb user (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"agent/app/service/database_mongodb.go","lineNumber":482,"sourceCode":"const password = %s;\nconst targetDb = db.getSiblingDB(dbName);\nconst userInfo = targetDb.runCommand({\n  usersInfo: userName,\n  showCredentials: false,\n  showCustomData: false\n});\nif (!userInfo || userInfo.ok !== 1) {\n  throw new Error(\"failed to load mongodb user \" + userName);\n}\nconst roles = [{ role: \"readWrite\", db: dbName }];\nif (Array.isArray(userInfo.users) && userInfo.users.length > 0) {\n  const result = targetDb.runCommand({\n    updateUser: userName,\n    pwd: password,\n    roles: roles\n  });\n  if (!result || result.ok !== 1) {\n    throw new Error(\"failed to update mongodb user \" + userName);\n  }\n} else {\n  const result = targetDb.runCommand({\n    createUser: userName,\n    pwd: password,\n    roles: roles\n  });\n  if (!result || result.ok !== 1) {\n    throw new Error(\"failed to create mongodb user \" + userName);\n  }\n}\n`, dbNameJSON, usernameJSON, passwordJSON)), nil\n}\n\nfunc buildMongodbPasswordScript(dbName, username, password string) (string, error) {\n\tdbNameJSON, err := json.Marshal(dbName)\n\tif err != nil {\n\t\treturn \"\", err","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/app/service/database_mongodb.go#L464-L500","documentation":"In buildMongodbBindUserScript, usersInfo succeeded and found the user, but the follow-up `updateUser` (new pwd + readWrite role) returned `ok !== 1`. updateUser fails with ok:0 when the caller lacks grant/rename/changePassword privileges for that user, when the new password violates the server's password validation/dictionary rules, or when the user actually lives on a different database than the one being updated.","triggerScenarios":"bindMongodbUser on an existing user whose password fails MongoDB's configured passwordValidationRegex; the exec'd admin user has viewUser but not userAdmin; attempting updateUser on `db` when the user was created on `admin`.","commonSituations":"Generated or short passwords rejected by a hardened password policy; custom non-root admin; users provisioned by an external tool on the admin db.","solutions":["Run the updateUser manually and read `codeName` (e.g. AuthenticationFailed/Password fails validation) to get the exact cause","If password validation rejects it, generate a longer/stronger password in the 1Panel form and retry","Verify the user's actual home db with usersInfo on admin, and update it there if it differs","Confirm the admin credential has userAdmin on the db that owns the user"],"exampleFix":"// before: password that fails server policy\nupdateMongodbPassword(..., \"aB1!\")\n// after: length/policy-compliant generated secret\nupdateMongodbPassword(..., \"xK7#mQ9$vL2pW8zR\")","handlingStrategy":"validation","validationCode":"// client-side: enforce server password policy before submitting\nif len(password) < 8 || !hasUpper(password) || !hasDigit(password) { return errors.New(\"password too weak for server policy\") }","typeGuard":null,"tryCatchPattern":"if err := bindMongodbUser(...); err != nil {\n    if strings.Contains(err.Error(), \"failed to update mongodb user\") {\n        // suggest password policy / privilege fix, keep original input for retry\n    }\n}","preventionTips":["Generate passwords with 1Panel's generator (length ≥ 16, mixed classes)","After any bind failure, re-check usersInfo before retrying so state is known"],"tags":["mongodb","updateuser","password-policy","authorization"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}