Security

Hunk 6.2 and MongoDB with CR authentication: Why am I getting search error "MongoException: not authorized for query on Northwind.products"?

ashish_ray
New Member

I am able to connect to mongoDB using a mongo client from the command line and am able to read data from Northwind DB, but when I run a query from Hunk using mongoDB virtual index, I get no result. I am using the same user/password authentication from Hunk and mongo.

search log Error "MongoException: not authorized for query on Northwind.products"

I gave the read/write permissions to user "north user" and DB: Northwind.

Am I missing some authentication setting either on the mongdb side or Hunk side?

Hunk ver: 6.2

my indexes.conf:

[provider:local-mongodb]
vix.mongodb.host = ma1.site.com:27017
vix.output.buckets.max.network.bandwidth = 0
vix.description = Test MongoDB with Hunk
vix.mongodb.auth.mechanism = CR
vix.mongodb.auth.password = north123$
vix.mongodb.auth.username = northuser

[northwind_products]
vix.description = with Auth enabled
vix.input.1.path = /tmp
vix.mongodb.collection = products
vix.mongodb.db = Northwind
vix.mongodb.field.time = _id
vix.mongodb.field.time.format = ObjectId
vix.provider = local-mongodb
disabled = 0

search log:

{"type":"literal","value":"splunk_server","raw":"\"splunk_server\""}]}]}}}
07-22-2015 00:06:32.131 INFO  ERP.local-mongodb -  MongoDBERP - Initiated connection to mongodb at ma1.site.com:27017
07-22-2015 00:06:32.132 INFO  ERP.local-mongodb -  MongoDBERP - About to execute query null using keys=null on ns Northwind/products
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -  MongoDBERP - Exception while executing search process.
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -  com.mongodb.MongoException: not authorized for query on Northwind.products
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.QueryResultIterator.throwOnQueryFailure(QueryResultIterator.java:214)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.QueryResultIterator.init(QueryResultIterator.java:198)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.QueryResultIterator.initFromQueryResponse(QueryResultIterator.java:176)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.QueryResultIterator.<init>(QueryResultIterator.java:64)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:86)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.DBCursor._check(DBCursor.java:458)
07-22-2015 00:06:32.152 ERROR ERP.local-mongodb -   at com.mongodb.DBCursor._hasNext(DBCursor.java:546)
0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Have you tried to remove these 3 flags (not authentication flags)?
vix.mongodb.auth.mechanism = CR
vix.mongodb.auth.password = north123$
vix.mongodb.auth.username = northuser

0 Karma

ashish_ray
New Member

Any help please?

0 Karma

ashish_ray
New Member

Thanks very much for the response.
Without the auth flags it work perfectly ok. I need to integrate with auth enabled MongoDB - v3 backend and need to use the CR or SCRAM-SHA-1 type authentication .

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...