Error with provisioning users using Vault Plugin

MongoDB Atlas
1

Running into below error when trying to create a user using Vault Mongo DB plug-in. Using Free Cluster, not sure if that is the limitation. I have done all the steps to set up vault configuration pointing to my Atlas Cluster - but does not allow me create users.

Here are the commands run.
vault write database/roles/my-role db_name=my-mongodb-database creation_statements=‘{ “db”: “admin”, “roles”: [{ “role”: “readWriteAnyDatabase” }] }’

and then

vault read database/creds/my-role ( to provision the user )

Vault Mongo DB Steps

  • 1 error occurred:
    • (AtlasError) (Unauthorized) not authorized on admin to execute command { createUser: “v-root-my-role-2Bm3dGlXcLUuiOYWnH9o-1608868364”, pwd: “5SmigEJy-5XdWD8kPVHf”, roles: [readWriteAnyDatabase], lsid: { id: {4 [47 83 197 251 22 245 68 196 158 92 40 152 189 22 242 218]} }, $clusterTime: { clusterTime: {1608868356 2}, signature: { hash: {0 [111 108 164 134 246 202 230 244 69 101 241 172 112 18 239 176 163 153 146 202]}, keyId: 6909548871030931456.000000 } }, $db: “admin”, $readPreference: { mode: “primary” } }
1 Like
2

Hi @Kishore_Kumar_Kota,

Welcome to MongoDB community.

Atlas database users are only allowed to br created from UI or api.

You cannot use createUser commands.
This is why this plugin fails.

Thanks
Pavel

1 Like
3

Hi @Kishore_Kumar_Kota,

Thanks to my colleague @Andrew_Davidson, I was informed that there is a vault api to create the users called “vault secrets”

MongoDB Atlas - Secrets Engines | Vault | HashiCorp Developer

Thanks
Pavel

1 Like
4

Thank you for pointing me to correct documentation on this. I am seeing a different error now.

I did follow the steps - I have installed Vault in my local and set up the config to point to my mongo db atlas account using programmatic access keys.

Error reading mongodbatlas/creds/test: Error making API request.

URL: GET http://127.0.0.1:8200/v1/mongodbatlas/creds/test

Code: 400. Errors:

5

Hi @Kishore_Kumar_Kota,

It might be that either this vault software is out of date and it has not calling the up to date api end points.

It look like it hits a deprecated api whitelist one.

Have a look at this blog

Thanks
Pavel

6

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.