I encountered an issue with passing the subject name from a shell script to my mongo instance in order to create an x509 user. The SUBJECT environment variable seems to have stripped spaces and lost the CN= portion upon authentication.
Here is the shell script I used to extract the subject from the certificate:
SUBJECT=$(openssl x509 -in server-cert.pem -inform PEM -subject -nameopt RFC2253 | grep subject | sed 's/subject=//')And here is the command line used to execute JavaScript code with the saved SUBJECT environment variable:
/usr/bin/mongo --ssl --sslPEMKeyFile server-combined.pem admin --eval "var SUBJECT = '$SUBJECT'" createUser.jsBelow is the content of my createUser.js file:
addUser(SUBJECT);
function addUser(SUBJECT) {
print(SUBJECT);
db.getSiblingDB("\$external").runCommand({ createUser:SUBJECT,roles: [{role: "readWrite", db: "test"},{ role: "userAdminAnyDatabase", db: "admin" }], writeConcern: { w: "majority" , wtimeout: 5000 }});
db.getSiblingDB("\$external").auth({mechanism: "MONGODB-X509", user: SUBJECT})}
Expected value:
CN=\ 10.1.1.1,OU=A,O=PP,ST=PA,C=US
Actual value:
CN= 10.1.1.1,OU=A,O=PP,ST=PA,C=US
Error message from MongoDB logs:
Error: 18 Username " CN= 10.1.1.1,OU=A,O=PP,ST=PA,C=US" does not match the provided client certificate user "CN=\ 10.1.1.1,OU=A,O=PP,ST=PA,C=US"
Build environment details:
Operating System: Linux Ubuntu
MongoDB version: v2.6
docker pull mongo:2.6
docker build .
Dockerfile contents:
FROM mongo:2.6
ADD createUser.js /opt/
ADD scriptuser.sh /opt/