Restrict user to read only from SECONDARY mongoDB replicaSet-CodePudding

Is there such possibility from database backend to force user to read only from SECONDARY members ? I would like to restrict some users to not be able to impact performance in PRIMARY replicaset members in my on-premise deployment ( not atlas )

Issue is easy to solve if customer agree adding to the URI

readPreference=secondary

But I am checking if there is option to force from the database side without asking the customer ...

the only option I have found is to restrict by server IP address:

use admin
db.createUser(
 {
 user: "dbuser",
 pwd: "password"
 roles: [ { role: "readWrite", db: "reporting" } ],
 authenticationRestrictions: [ {
    clientSource: ["192.0.2.0"],
    serverAddress: ["198.51.100.1","192.51.100.2"]
 } ]
}
)

CodePudding user response：

There are currently no supported ways to enforce this from within MongoDB itself apart from the authenticationRestrictions configurations for defining users which is noted in the question itself.

Regarding the comments - ANALYTICS tag in Atlas are a (automatic) Replica Set Tag. Replica set tags themselves can be used in on-premise deployments. But tags are used in conjunction with read preference which is set by the client application (at least in the connection string). So that approach/solution really doesn't provide any additional enforcement from read preference alone for the purposes of this question. Additional information about tags can be found here and here.

In an 'unsupported'/hacky fashion, you could create the user(s) directly and only on the SECONDARY members that you want the client to read from. This would be accomplished by taking the member out of the replica set, starting it up as a standalone, creating the user, and then joining it back to the replica set. While it would probably work, there are a number of implications that don't make this a particularly good approach. For example, elections (for high availability purposes) would change the PRIMARY (therefore where the client can read from) among other things.

Other approaches to this would be in redirecting/restricting traffic at the network layer. Again not a great approach.

CodePudding user response：

Steps to restrict someone from seeing available database in SQL Server:

1). Login to SQL Management studio & connect to your SQL instance. 2). Expand Servers & select your SQL instance. 3). Then tick the box Deny for "View any database".

Please note that there are other ways of doing this, or by just setting a deny view permission on specific databases.