{"record":{"id":"7e90d6af134bc87d","repo":"1Panel-dev/1Panel","slug":"failed-to-create-mongodb-user-username","errorCode":null,"errorMessage":"failed to create mongodb user ${userName}","messagePattern":"failed to create mongodb user (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"agent/app/service/database_mongodb.go","lineNumber":491,"sourceCode":"}\nconst roles = [{ role: \"readWrite\", db: dbName }];\nif (Array.isArray(userInfo.users) && userInfo.users.length > 0) {\n  const result = targetDb.runCommand({\n    updateUser: userName,\n    pwd: password,\n    roles: roles\n  });\n  if (!result || result.ok !== 1) {\n    throw new Error(\"failed to update mongodb user \" + userName);\n  }\n} else {\n  const result = targetDb.runCommand({\n    createUser: userName,\n    pwd: password,\n    roles: roles\n  });\n  if (!result || result.ok !== 1) {\n    throw new Error(\"failed to create mongodb user \" + userName);\n  }\n}\n`, dbNameJSON, usernameJSON, passwordJSON)), nil\n}\n\nfunc buildMongodbPasswordScript(dbName, username, password string) (string, error) {\n\tdbNameJSON, err := json.Marshal(dbName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tusernameJSON, err := json.Marshal(username)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tpasswordJSON, err := json.Marshal(password)\n\tif err != nil {\n\t\treturn \"\", err\n\t}","sourceCodeStart":473,"sourceCodeEnd":509,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/app/service/database_mongodb.go#L473-L509","documentation":"The createUser branch of buildMongodbBindUserScript: usersInfo returned no users, then `createUser` returned `ok !== 1`. Even after an existence check, createUser fails when the user already exists (race or stale view), the caller lacks createUser privilege, or the password fails validation.","triggerScenarios":"Two concurrent bind operations for the same username; the user exists on the `admin` db but not the target db (usersInfo on target sees nothing, createUser on target may conflict or be forbidden); weak password rejected by passwordValidationRegex.","commonSituations":"Re-binding a user that was created outside 1Panel; parallel UI actions creating the same user; hardened password policy enabled on the deployment.","solutions":["Run createUser manually in the container and read codeName/errmsg — 'UserAlreadyExists' means a race or wrong db","Check `db.getSiblingDB(\"admin\").runCommand({usersInfo:{user:\"<u>\",db:\"<db>\"}})` to see where the user really lives","Retry the bind once the conflicting user is dropped or the password meets policy","Ensure the admin credential has createUser on the target db"],"exampleFix":"// idempotent manual equivalent\n// const t = db.getSiblingDB(\"mydb\");\n// const exists = t.runCommand({usersInfo:\"appuser\"}).users?.length > 0;\n// if (!exists) t.runCommand({createUser:\"appuser\", pwd:PASS, roles:[{role:\"readWrite\",db:\"mydb\"}]});","handlingStrategy":"retry","validationCode":"// serialize binds per username to avoid the create race\n// e.g. per-user mutex or single-flight around bindMongodbUser","typeGuard":null,"tryCatchPattern":"// createUser races are retryable after re-checking existence\nerr := bindMongodbUser(...)\nif err != nil && strings.Contains(err.Error(), \"failed to create mongodb user\") {\n    time.Sleep(200 * time.Millisecond) // let the concurrent create settle\n    err = bindMongodbUser(...)         // now takes the updateUser branch\n}","preventionTips":["Disable double-submit in the UI while a bind is in flight","Prefer the bind (upsert) flow over raw createUser wherever possible","Check usersInfo on both target db and admin before deciding a user is absent"],"tags":["mongodb","createuser","race-condition","password-policy"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}