Skip to content

Commit 261b37f

Browse files
authored
DOCSP-24990 version cleanup roles v4.2 (#1877)
* DOCSP-24990 merge * DOCSP-24990 Corrects build errors
1 parent cc88263 commit 261b37f

7 files changed

+35
-122
lines changed

source/includes/extracts-4.2-changes.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -723,12 +723,12 @@ content: |
723723
ref: 4.2-changes-libldap
724724
content: |
725725
726-
For MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against
726+
For MongoDB 4.2 Enterprise binaries linked against
727727
``libldap`` (such as when running on RHEL), access to the
728728
``libldap`` is synchronized, incurring some performance/latency
729729
costs.
730730
731-
For MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against
731+
For MongoDB 4.2 Enterprise binaries linked against
732732
``libldap_r``, there is no change in behavior from earlier MongoDB
733733
versions.
734734
---

source/includes/extracts-built-in-roles.yaml

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,8 @@ content: |
8787
---
8888
ref: built-in-roles-restore
8989
content: |
90-
.. versionchanged:: 3.6
9190
92-
Provides :authaction:`convertToCapped` on non-system collections.
91+
Provides :authaction:`convertToCapped` on non-system collections.
9392
9493
Provides the necessary privileges to restore data from backups *if* the data
9594
does not include :data:`system.profile <<database>.system.profile>` collection
@@ -99,7 +98,6 @@ content: |
9998
---
10099
ref: built-in-roles-all-database-roles
101100
content: |
102-
.. versionchanged:: 3.4
103101
104102
The following roles are available on the ``admin`` database and provide
105103
privileges which apply to all databases except ``local`` and
@@ -111,27 +109,13 @@ content: |
111109
except ``local`` and ``config``. The role also provides the
112110
:authaction:`listDatabases` action on the cluster as a whole.
113111
---
114-
ref: built-in-roles-readAnyDatabase-prior
115-
content: |
116-
Prior to 3.4, :authrole:`readAnyDatabase` includes ``local`` and
117-
``config`` databases. To provide ``read`` privileges on the
118-
``local`` database, create a user in the ``admin`` database with
119-
:authrole:`read` role in the ``local`` database.
120-
---
121112
ref: built-in-roles-readWriteAnyDatabase
122113
content: |
123114
Provides the same privileges as :authrole:`readWrite` on
124115
all databases except ``local`` and ``config``. The role also
125116
provides the :authaction:`listDatabases` action on the cluster as a
126117
whole.
127118
---
128-
ref: built-in-roles-readWriteAnyDatabase-prior
129-
content: |
130-
Prior to 3.4, :authrole:`readWriteAnyDatabase` includes ``local``
131-
and ``config`` databases. To provide ``readWrite`` privileges on
132-
the ``local`` database, create a user in the ``admin`` database
133-
with :authrole:`readWrite` role in the ``local`` database.
134-
---
135119
ref: built-in-roles-dbAdminAnyDatabase
136120
content: |
137121
Provides the same privileges as :authrole:`dbAdmin` on

source/includes/extracts-listDatabases-auth.yaml

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -97,32 +97,4 @@ content: |
9797
- If the user does not have :authaction:`listDatabases` action on
9898
the cluster, :dbcommand:`listDatabases` command errors with
9999
insufficient permissions.
100-
---
101-
ref: listDatabases-auth-4.0.0-4.0.4
102-
content: |
103-
For MongoDB 4.0.0-4.0.4:
104-
If the user does not have the :authaction:`listDatabases`
105-
privilege action, users can run the :dbcommand:`listDatabases`
106-
command to return a list of databases for which the user has the
107-
:authaction:`find` action privilege.
108-
---
109-
ref: listDatabases-auth-4.0.5
110-
content: |
111-
For MongoDB 4.0.5:
112-
If the user does not have the :authaction:`listDatabases`
113-
privilege action, users can run the :dbcommand:`listDatabases`
114-
command to return a list of databases for which the user has the
115-
:authaction:`find` action privilege if the command is run with
116-
``authorizedDatabases`` option unspecified or set to ``true``.
117-
---
118-
ref: listDatabases-auth-4.0.6
119-
content: |
120-
For MongoDB 4.0.6+:
121-
If the user does not have the :authaction:`listDatabases`
122-
privilege action, users can run the :dbcommand:`listDatabases`
123-
command to return a list of databases for which the user has
124-
privileges (including databases for which the user has privileges
125-
on specific collections) if the command is run with
126-
``authorizedDatabases`` option unspecified or set to ``true``.
127-
128100
...
Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
.. versionchanged:: 3.2.1
21

3-
The :authrole:`backup` role provides additional privileges to back
4-
up the :data:`system.profile <<database>.system.profile>`
5-
collection that exists when running with :ref:`database profiling
6-
<database-profiling>`. Previously, users required
7-
``read`` access on this collection.
2+
The :authrole:`backup` role provides additional privileges to back
3+
up the :data:`system.profile <<database>.system.profile>`
4+
collection that exists when running with :ref:`database profiling
5+
<database-profiling>`.
6+
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
If the user does not have the :authaction:`listDatabases`
3+
privilege action, users can run the :dbcommand:`listDatabases`
4+
command to return a list of databases for which the user has
5+
privileges (including databases for which the user has privileges
6+
on specific collections) if the command is run with
7+
``authorizedDatabases`` option unspecified or set to ``true``.
8+

source/reference/built-in-roles.txt

Lines changed: 17 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,8 @@ Every database includes the following client roles:
5858
- :authaction:`killCursors`
5959
- :authaction:`listIndexes`
6060
- :authaction:`listCollections`
61-
62-
63-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
64-
65-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
66-
67-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
61+
62+
.. include:: /includes/listDatabases-auth.rst
6863

6964
.. authrole:: readWrite
7065

@@ -224,8 +219,6 @@ Cluster Administration Roles
224219

225220
.. authrole:: clusterManager
226221

227-
.. versionchanged:: 3.4
228-
229222
.. include:: /includes/extracts/built-in-roles-clusterManager.rst
230223

231224
On the cluster as a whole, permits the following actions:
@@ -238,9 +231,7 @@ Cluster Administration Roles
238231
- :authaction:`applicationMessage`
239232
- :authaction:`cleanupOrphaned`
240233
- :authaction:`flushRouterConfig`
241-
242-
- :authaction:`listSessions` (New in version 3.6)
243-
234+
- :authaction:`listSessions`
244235
- :authaction:`listShards`
245236
- :authaction:`removeShard`
246237
- :authaction:`replSetConfigure`
@@ -254,7 +245,7 @@ Cluster Administration Roles
254245

255246
On *all* databases in the cluster, permits the following actions:
256247

257-
- :authaction:`clearJumboFlag` (New in 4.2.3 and 4.0.15)
248+
- :authaction:`clearJumboFlag` (New in 4.2.3)
258249
- :authaction:`enableSharding`
259250
- :authaction:`moveChunk`
260251
- :authaction:`splitVector`
@@ -359,16 +350,14 @@ Cluster Administration Roles
359350

360351
.. authrole:: clusterMonitor
361352

362-
.. versionchanged:: 3.4
363-
364353
.. include:: /includes/extracts/built-in-roles-clusterMonitor.rst
365354

366355
Permits the following actions on the cluster as a whole:
367356

368357
.. hlist::
369358
:columns: 2
370359

371-
- :authaction:`checkFreeMonitoringStatus` (New in version 4.0)
360+
- :authaction:`checkFreeMonitoringStatus`
372361
- :authaction:`connPoolStats`
373362
- :authaction:`getCmdLineOpts`
374363
- :authaction:`getLog`
@@ -377,16 +366,13 @@ Cluster Administration Roles
377366
- :authaction:`hostInfo`
378367
- :authaction:`inprog`
379368
- :authaction:`listDatabases`
380-
381-
- :authaction:`listSessions` (New in version 3.6)
382-
369+
- :authaction:`listSessions`
383370
- :authaction:`listShards`
384371
- :authaction:`netstat`
385372
- :authaction:`replSetGetConfig`
386373
- :authaction:`replSetGetStatus`
387374
- :authaction:`serverStatus`
388-
- :authaction:`setFreeMonitoring` (New in version 4.0)
389-
375+
- :authaction:`setFreeMonitoring`
390376
- :authaction:`shardingState`
391377
- :authaction:`top`
392378

@@ -396,7 +382,7 @@ Cluster Administration Roles
396382
- :authaction:`dbStats`
397383
- :authaction:`getShardVersion`
398384
- :authaction:`indexStats`
399-
- :authaction:`useUUID` (New in version 3.6)
385+
- :authaction:`useUUID`
400386

401387
Permits the :authaction:`find` action on all :data:`system.profile
402388
<<database>.system.profile>` collections in the cluster.
@@ -579,11 +565,11 @@ Backup and Restoration Roles
579565
:data:`system.js <<database>.system.js>`, and
580566
:data:`system.profile <<database>.system.profile>`
581567

582-
- the :data:`admin.system.users` and :data:`admin.system.roles` collections
568+
- The :data:`admin.system.users` and :data:`admin.system.roles` collections
583569

584-
- the :data:`config.settings` collection
570+
- The :data:`config.settings` collection
585571

586-
- legacy ``system.users`` collections from versions of MongoDB prior to 2.6
572+
- Legacy ``system.users`` collections from versions of MongoDB prior to 2.6
587573

588574
.. todo: Also provides the :authaction:`find` action on:
589575
- system.new_users
@@ -708,21 +694,13 @@ All-Database Roles
708694

709695
.. include:: /includes/extracts/built-in-roles-readAnyDatabase.rst
710696

711-
.. versionchanged:: 3.4
712-
713-
.. include:: /includes/extracts/built-in-roles-readAnyDatabase-prior.rst
714-
715-
.. include:: /includes/seealso-cluster-manager.rst
697+
.. include:: /includes/seealso-cluster-manager.rst
716698

717699
.. authrole:: readWriteAnyDatabase
718700

719701
.. include:: /includes/extracts/built-in-roles-readWriteAnyDatabase.rst
720702

721-
.. versionchanged:: 3.4
722-
723-
.. include:: /includes/extracts/built-in-roles-readWriteAnyDatabase-prior.rst
724-
725-
.. include:: /includes/seealso-cluster-manager.rst
703+
.. include:: /includes/seealso-cluster-manager.rst
726704

727705
.. authrole:: userAdminAnyDatabase
728706

@@ -746,14 +724,8 @@ All-Database Roles
746724
- :authaction:`find`
747725
- :authaction:`killCursors`
748726
- :authaction:`planCacheRead`
749-
750-
.. versionchanged:: 2.6.4
751-
:authrole:`userAdminAnyDatabase` added the following privilege
752-
actions on the :data:`admin.system.users` and
753-
:data:`admin.system.roles` collections:
754-
755-
- :authaction:`createIndex`
756-
- :authaction:`dropIndex`
727+
- :authaction:`createIndex`
728+
- :authaction:`dropIndex`
757729

758730
The :authrole:`userAdminAnyDatabase` role does not restrict the privileges
759731
that a user can grant. As a result, :authrole:`userAdminAnyDatabase` users
@@ -762,22 +734,13 @@ All-Database Roles
762734
role does not explicitly authorize privileges beyond user administration.
763735
This role is effectively a MongoDB system :ref:`superuser <superuser>`.
764736

765-
.. versionchanged:: 3.4
766-
767-
:authrole:`userAdminAnyDatabase` no longer
768-
applies to the ``local`` and ``config`` databases.
769-
770-
.. include:: /includes/seealso-cluster-manager.rst
737+
.. include:: /includes/seealso-cluster-manager.rst
771738

772739
.. authrole:: dbAdminAnyDatabase
773740

774741
.. include:: /includes/extracts/built-in-roles-dbAdminAnyDatabase.rst
775742

776-
.. versionchanged:: 3.4
777-
778-
.. include:: /includes/extracts/built-in-roles-dbAdminAnyDatabase-prior.rst
779-
780-
.. include:: /includes/seealso-cluster-manager.rst
743+
.. include:: /includes/seealso-cluster-manager.rst
781744

782745
.. _superuser:
783746

@@ -802,11 +765,6 @@ The following role provides full privileges on all resources:
802765

803766
.. include:: /includes/extracts/built-in-roles-root.rst
804767

805-
.. versionchanged:: 3.4
806-
807-
The :authrole:`root` role includes privileges from the
808-
:authrole:`backup` and :authrole:`restore` roles.
809-
810768
Internal Role
811769
-------------
812770

source/reference/privilege-actions.txt

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,7 @@ Query and Write Actions
6060
and :dbcommand:`renameCollection` commands and the
6161
:method:`db.collection.renameCollection()` helper method.
6262

63-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
64-
65-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
66-
67-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
63+
.. include:: /includes/listDatabases-auth.rst
6864

6965
Apply this action to database or collection resources.
7066

@@ -773,11 +769,7 @@ Diagnostic Actions
773769
User can perform the :dbcommand:`listDatabases` command. Apply this
774770
action to the ``cluster`` resource.
775771

776-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
777-
778-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
779-
780-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
772+
.. include:: /includes/listDatabases-auth.rst
781773

782774
.. authaction:: listCollections
783775

0 commit comments

Comments
 (0)