Skip to content

Commit 1f3c21b

Browse files
authored
1 parent d58e935 commit 1f3c21b

7 files changed

+38
-120
lines changed

source/includes/extracts-4.2-changes.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -744,12 +744,12 @@ content: |
744744
ref: 4.2-changes-libldap
745745
content: |
746746
747-
For MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against
747+
For MongoDB 4.2 Enterprise binaries linked against
748748
``libldap`` (such as when running on RHEL), access to the
749749
``libldap`` is synchronized, incurring some performance/latency
750750
costs.
751751
752-
For MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against
752+
For MongoDB 4.2 Enterprise binaries linked against
753753
``libldap_r``, there is no change in behavior from earlier MongoDB
754754
versions.
755755
---

source/includes/extracts-built-in-roles.yaml

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,8 @@ content: |
8787
---
8888
ref: built-in-roles-restore
8989
content: |
90-
.. versionchanged:: 3.6
9190
92-
Provides :authaction:`convertToCapped` on non-system collections.
91+
Provides :authaction:`convertToCapped` on non-system collections.
9392
9493
Provides the necessary privileges to restore data from backups *if* the data
9594
does not include :data:`system.profile <<database>.system.profile>` collection
@@ -99,7 +98,6 @@ content: |
9998
---
10099
ref: built-in-roles-all-database-roles
101100
content: |
102-
.. versionchanged:: 3.4
103101
104102
The following roles are available on the ``admin`` database and provide
105103
privileges which apply to all databases except ``local`` and
@@ -111,27 +109,13 @@ content: |
111109
except ``local`` and ``config``. The role also provides the
112110
:authaction:`listDatabases` action on the cluster as a whole.
113111
---
114-
ref: built-in-roles-readAnyDatabase-prior
115-
content: |
116-
Prior to 3.4, :authrole:`readAnyDatabase` includes ``local`` and
117-
``config`` databases. To provide ``read`` privileges on the
118-
``local`` database, create a user in the ``admin`` database with
119-
:authrole:`read` role in the ``local`` database.
120-
---
121112
ref: built-in-roles-readWriteAnyDatabase
122113
content: |
123114
Provides the same privileges as :authrole:`readWrite` on
124115
all databases except ``local`` and ``config``. The role also
125116
provides the :authaction:`listDatabases` action on the cluster as a
126117
whole.
127118
---
128-
ref: built-in-roles-readWriteAnyDatabase-prior
129-
content: |
130-
Prior to 3.4, :authrole:`readWriteAnyDatabase` includes ``local``
131-
and ``config`` databases. To provide ``readWrite`` privileges on
132-
the ``local`` database, create a user in the ``admin`` database
133-
with :authrole:`readWrite` role in the ``local`` database.
134-
---
135119
ref: built-in-roles-dbAdminAnyDatabase
136120
content: |
137121
Provides the same privileges as :authrole:`dbAdmin` on

source/includes/extracts-listDatabases-auth.yaml

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -97,32 +97,4 @@ content: |
9797
- If the user does not have :authaction:`listDatabases` action on
9898
the cluster, :dbcommand:`listDatabases` command errors with
9999
insufficient permissions.
100-
---
101-
ref: listDatabases-auth-4.0.0-4.0.4
102-
content: |
103-
For MongoDB 4.0.0-4.0.4:
104-
If the user does not have the :authaction:`listDatabases`
105-
privilege action, users can run the :dbcommand:`listDatabases`
106-
command to return a list of databases for which the user has the
107-
:authaction:`find` action privilege.
108-
---
109-
ref: listDatabases-auth-4.0.5
110-
content: |
111-
For MongoDB 4.0.5:
112-
If the user does not have the :authaction:`listDatabases`
113-
privilege action, users can run the :dbcommand:`listDatabases`
114-
command to return a list of databases for which the user has the
115-
:authaction:`find` action privilege if the command is run with
116-
``authorizedDatabases`` option unspecified or set to ``true``.
117-
---
118-
ref: listDatabases-auth-4.0.6
119-
content: |
120-
For MongoDB 4.0.6+:
121-
If the user does not have the :authaction:`listDatabases`
122-
privilege action, users can run the :dbcommand:`listDatabases`
123-
command to return a list of databases for which the user has
124-
privileges (including databases for which the user has privileges
125-
on specific collections) if the command is run with
126-
``authorizedDatabases`` option unspecified or set to ``true``.
127-
128100
...
Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
.. versionchanged:: 3.2.1
21

3-
The :authrole:`backup` role provides additional privileges to back
4-
up the :data:`system.profile <<database>.system.profile>`
5-
collection that exists when running with :ref:`database profiling
6-
<database-profiling>`. Previously, users required
7-
``read`` access on this collection.
2+
The :authrole:`backup` role provides additional privileges to back
3+
up the :data:`system.profile <<database>.system.profile>`
4+
collection that exists when running with :ref:`database profiling
5+
<database-profiling>`.
6+
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
If the user does not have the :authaction:`listDatabases`
3+
privilege action, users can run the :dbcommand:`listDatabases`
4+
command to return a list of databases for which the user has
5+
privileges (including databases for which the user has privileges
6+
on specific collections) if the command is run with
7+
``authorizedDatabases`` option unspecified or set to ``true``.
8+

source/reference/built-in-roles.txt

Lines changed: 20 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,8 @@ Every database includes the following client roles:
5858
- :authaction:`killCursors`
5959
- :authaction:`listIndexes`
6060
- :authaction:`listCollections`
61-
62-
63-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
64-
65-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
66-
67-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
61+
62+
.. include:: /includes/listDatabases-auth
6863

6964
.. authrole:: readWrite
7065

@@ -224,8 +219,6 @@ Cluster Administration Roles
224219

225220
.. authrole:: clusterManager
226221

227-
.. versionchanged:: 3.4
228-
229222
.. include:: /includes/extracts/built-in-roles-clusterManager.rst
230223

231224
.. list-table::
@@ -246,7 +239,7 @@ Cluster Administration Roles
246239
- :authaction:`cleanupOrphaned`
247240
- :authaction:`flushRouterConfig`
248241
- :authaction:`getDefaultRWConcern` (New in version 4.4)
249-
- :authaction:`listSessions` (New in version 3.6)
242+
- :authaction:`listSessions`
250243
- :authaction:`listShards`
251244
- :authaction:`removeShard`
252245
- :authaction:`replSetConfigure`
@@ -263,7 +256,7 @@ Cluster Administration Roles
263256
- .. hlist::
264257
:columns: 1
265258

266-
- :authaction:`clearJumboFlag` (New in 4.2.3 and 4.0.15)
259+
- :authaction:`clearJumboFlag` (New in 4.2.3)
267260
- :authaction:`enableSharding`
268261
- :authaction:`refineCollectionShardKey` (New in 4.4)
269262
- :authaction:`moveChunk`
@@ -372,16 +365,14 @@ Cluster Administration Roles
372365

373366
.. authrole:: clusterMonitor
374367

375-
.. versionchanged:: 3.4
376-
377368
.. include:: /includes/extracts/built-in-roles-clusterMonitor.rst
378369

379370
Permits the following actions on the cluster as a whole:
380371

381372
.. hlist::
382373
:columns: 2
383374

384-
- :authaction:`checkFreeMonitoringStatus` (New in version 4.0)
375+
- :authaction:`checkFreeMonitoringStatus`
385376
- :authaction:`connPoolStats`
386377
- :authaction:`getCmdLineOpts`
387378
- :authaction:`getDefaultRWConcern` (New in version 4.4)
@@ -391,13 +382,13 @@ Cluster Administration Roles
391382
- :authaction:`hostInfo`
392383
- :authaction:`inprog`
393384
- :authaction:`listDatabases`
394-
- :authaction:`listSessions` (New in version 3.6)
385+
- :authaction:`listSessions`
395386
- :authaction:`listShards`
396387
- :authaction:`netstat`
397388
- :authaction:`replSetGetConfig`
398389
- :authaction:`replSetGetStatus`
399390
- :authaction:`serverStatus`
400-
- :authaction:`setFreeMonitoring` (New in version 4.0)
391+
- :authaction:`setFreeMonitoring`
401392
- :authaction:`shardingState`
402393
- :authaction:`top`
403394

@@ -407,7 +398,7 @@ Cluster Administration Roles
407398
- :authaction:`dbStats`
408399
- :authaction:`getShardVersion`
409400
- :authaction:`indexStats`
410-
- :authaction:`useUUID` (New in version 3.6)
401+
- :authaction:`useUUID`
411402

412403
Permits the :authaction:`find` action on all :data:`system.profile
413404
<<database>.system.profile>` collections in the cluster.
@@ -535,8 +526,8 @@ Cluster Administration Roles
535526
- :authaction:`flushRouterConfig`
536527
- :authaction:`fsync`
537528
- :authaction:`invalidateUserCache`
538-
- :authaction:`killAnyCursor` (New in version 4.0)
539-
- :authaction:`killAnySession` (New in version 3.6)
529+
- :authaction:`killAnyCursor`
530+
- :authaction:`killAnySession`
540531
- :authaction:`killop`
541532
- :authaction:`logRotate`
542533
- :authaction:`oidReset`
@@ -598,11 +589,11 @@ Backup and Restoration Roles
598589
:data:`system.js <<database>.system.js>`, and
599590
:data:`system.profile <<database>.system.profile>`
600591

601-
- the :data:`admin.system.users` and :data:`admin.system.roles` collections
592+
- The :data:`admin.system.users` and :data:`admin.system.roles` collections
602593

603-
- the :data:`config.settings` collection
594+
- The :data:`config.settings` collection
604595

605-
- legacy ``system.users`` collections from versions of MongoDB prior to 2.6
596+
- Legacy ``system.users`` collections from versions of MongoDB prior to 2.6
606597

607598
.. todo: Also provides the :authaction:`find` action on:
608599
- system.new_users
@@ -727,21 +718,13 @@ All-Database Roles
727718

728719
.. include:: /includes/extracts/built-in-roles-readAnyDatabase.rst
729720

730-
.. versionchanged:: 3.4
731-
732-
.. include:: /includes/extracts/built-in-roles-readAnyDatabase-prior.rst
733-
734-
.. include:: /includes/seealso-cluster-manager.rst
721+
.. include:: /includes/seealso-cluster-manager.rst
735722

736723
.. authrole:: readWriteAnyDatabase
737724

738725
.. include:: /includes/extracts/built-in-roles-readWriteAnyDatabase.rst
739726

740-
.. versionchanged:: 3.4
741-
742-
.. include:: /includes/extracts/built-in-roles-readWriteAnyDatabase-prior.rst
743-
744-
.. include:: /includes/seealso-cluster-manager.rst
727+
.. include:: /includes/seealso-cluster-manager.rst
745728

746729
.. authrole:: userAdminAnyDatabase
747730

@@ -754,7 +737,7 @@ All-Database Roles
754737
- :authaction:`invalidateUserCache`
755738
- :authaction:`listDatabases`
756739

757-
The role also provides the following privilege actions on the
740+
The role provides the following privilege actions on the
758741
:data:`system.users <admin.system.users>` and
759742
:data:`system.roles <admin.system.roles>` collections on the
760743
``admin`` database, and on legacy ``system.users`` collections from
@@ -766,14 +749,8 @@ All-Database Roles
766749
- :authaction:`find`
767750
- :authaction:`killCursors`
768751
- :authaction:`planCacheRead`
769-
770-
.. versionchanged:: 2.6.4
771-
:authrole:`userAdminAnyDatabase` added the following privilege
772-
actions on the :data:`admin.system.users` and
773-
:data:`admin.system.roles` collections:
774-
775-
- :authaction:`createIndex`
776-
- :authaction:`dropIndex`
752+
- :authaction:`createIndex`
753+
- :authaction:`dropIndex`
777754

778755
The :authrole:`userAdminAnyDatabase` role does not restrict the privileges
779756
that a user can grant. As a result, :authrole:`userAdminAnyDatabase` users
@@ -782,22 +759,13 @@ All-Database Roles
782759
role does not explicitly authorize privileges beyond user administration.
783760
This role is effectively a MongoDB system :ref:`superuser <superuser>`.
784761

785-
.. versionchanged:: 3.4
786-
787-
:authrole:`userAdminAnyDatabase` no longer
788-
applies to the ``local`` and ``config`` databases.
789-
790-
.. include:: /includes/seealso-cluster-manager.rst
762+
.. include:: /includes/seealso-cluster-manager.rst
791763

792764
.. authrole:: dbAdminAnyDatabase
793765

794766
.. include:: /includes/extracts/built-in-roles-dbAdminAnyDatabase.rst
795767

796-
.. versionchanged:: 3.4
797-
798-
.. include:: /includes/extracts/built-in-roles-dbAdminAnyDatabase-prior.rst
799-
800-
.. include:: /includes/seealso-cluster-manager.rst
768+
.. include:: /includes/seealso-cluster-manager.rst
801769

802770
.. _superuser:
803771

@@ -822,11 +790,6 @@ The following role provides full privileges on all resources:
822790

823791
.. include:: /includes/extracts/built-in-roles-root.rst
824792

825-
.. versionchanged:: 3.4
826-
827-
The :authrole:`root` role includes privileges from the
828-
:authrole:`backup` and :authrole:`restore` roles.
829-
830793
Internal Role
831794
-------------
832795

source/reference/privilege-actions.txt

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,7 @@ Query and Write Actions
6060
and :dbcommand:`renameCollection` commands and the
6161
:method:`db.collection.renameCollection()` helper method.
6262

63-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
64-
65-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
66-
67-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
63+
.. include:: /includes/listDatabases-auth
6864

6965
Apply this action to database or collection resources.
7066

@@ -802,11 +798,7 @@ Diagnostic Actions
802798
User can perform the :dbcommand:`listDatabases` command. Apply this
803799
action to the ``cluster`` resource.
804800

805-
.. include:: /includes/extracts/listDatabases-auth-4.0.6.rst
806-
807-
.. include:: /includes/extracts/listDatabases-auth-4.0.5.rst
808-
809-
.. include:: /includes/extracts/listDatabases-auth-4.0.0-4.0.4.rst
801+
.. include:: /includes/listDatabases-auth
810802

811803
.. authaction:: listCollections
812804

0 commit comments

Comments
 (0)