{"record":{"id":"4a5ea79d1b9f09b5","repo":"1Panel-dev/1Panel","slug":"failed-to-update-mongodb-user-password-username","errorCode":null,"errorMessage":"failed to update mongodb user password ${userName}","messagePattern":"failed to update mongodb user password (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"agent/app/service/database_mongodb.go","lineNumber":520,"sourceCode":"\tusernameJSON, err := json.Marshal(username)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tpasswordJSON, err := json.Marshal(password)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn strings.TrimSpace(fmt.Sprintf(`\nconst dbName = %s;\nconst userName = %s;\nconst password = %s;\nconst targetDb = db.getSiblingDB(dbName);\nconst result = targetDb.runCommand({\n  updateUser: userName,\n  pwd: password\n});\nif (!result || result.ok !== 1) {\n  throw new Error(\"failed to update mongodb user password \" + userName);\n}\n`, dbNameJSON, usernameJSON, passwordJSON)), nil\n}\n\ntype mongodbSyncItem struct {\n\tName     string `json:\"name\"`\n\tUsername string `json:\"username\"`\n}\n\nfunc loadMongodbDatabases(req dto.MongodbLoadDB) ([]mongodbSyncItem, error) {\n\tif req.From == constant.AppResourceRemote {\n\t\treturn loadRemoteMongodbDatabases(req.Database)\n\t}\n\treturn loadLocalMongodbDatabases(req.Database)\n}\n\nfunc loadLocalMongodbDatabases(database string) ([]mongodbSyncItem, error) {\n\tscript := strings.TrimSpace(`","sourceCodeStart":502,"sourceCodeEnd":538,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/app/service/database_mongodb.go#L502-L538","documentation":"buildMongodbPasswordScript (database_mongodb.go:520) runs a bare `updateUser` with only a new pwd. Unlike the bind script it performs no usersInfo pre-check, so the most common ok:0 cause is updating a user that does not exist on that db (MongoDB code 11 UserNotFound); the second cause is password policy rejection.","triggerScenarios":"updateMongodbPassword (database_mongodb.go:346) called with a `database/connectionName` whose target db does not own the user; user was deleted beforehand; new password violates passwordValidationRegex.","commonSituations":"Password rotation for a user that was moved to the admin authenticationDatabase; rotation immediately after someone deleted the user; strict password policy deployments.","solutions":["Verify the user exists on the exact db: `db.getSiblingDB(\"<db>\").runCommand({usersInfo:\"<u>\"})` — if empty, the user is elsewhere or gone","If the user is missing, re-create it via the bind flow, then rotate the password","Run updateUser manually and read codeName; fix password strength if validation failed","Ensure the exec'd admin credential may changePassword for that user"],"exampleFix":"// before: blind update\n// db.getSiblingDB(\"mydb\").runCommand({updateUser:\"appuser\", pwd:NEWPASS})\n// after: guarded update\n// const t = db.getSiblingDB(\"mydb\");\n// if ((t.runCommand({usersInfo:\"appuser\"}).users||[]).length) t.runCommand({updateUser:\"appuser\", pwd:NEWPASS});","handlingStrategy":"validation","validationCode":"// verify the user exists on the target db before rotating\nscript := fmt.Sprintf(`print(db.getSiblingDB(%s).runCommand({usersInfo:%s}).users ? 1 : 0)`, dbNameJSON, userJSON)\nif out, _ := runMongodbAdminScriptWithStdout(database, script); strings.TrimSpace(out) != \"1\" {\n    return fmt.Errorf(\"user %s not found on %s; bind first\", username, dbName)\n}","typeGuard":null,"tryCatchPattern":"if err := updateMongodbPassword(...); err != nil {\n    if strings.Contains(err.Error(), \"failed to update mongodb user password\") {\n        // differentiate UserNotFound vs password policy via manual updateUser + docker logs\n    }\n}","preventionTips":["Rotate passwords only for users the panel created (home db is then known)","Keep username casing consistent — copy from the users list, never retype"],"tags":["mongodb","updateuser","user-not-found","password-policy"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}