database authentication_error ai_generated true

pymongo.errors.OperationFailure: Authentication failed., full error: {'ok': 0, 'errmsg': 'Authentication failed.', 'code': 18}

ID: database/mongodb-authentication-failed

Also available as: JSON · Markdown
90%Fix Rate
92%Confidence
55Evidence
2023-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
7 active — — —

Root Cause

MongoDB rejected the authentication attempt. Commonly caused by wrong password, wrong authentication database (authSource), user not existing in the specified database, or SCRAM mechanism mismatch between client and server.

generic

Workarounds

  1. 92% success Specify the correct authSource in the connection string 
    Include authSource in the URI: mongodb://user:pass@host:27017/mydb?authSource=admin. The authSource must match the database where the user was created (usually 'admin'). Check with: use admin; db.getUsers(); in mongosh.
  2. 88% success Recreate the user with the correct credentials and roles 
    Connect without auth (if possible) or use another admin account. Run: use admin; db.dropUser('myuser'); db.createUser({ user: 'myuser', pwd: 'newpassword', roles: [{ role: 'readWrite', db: 'mydb' }] }); Then update the application connection string.

Dead Ends

Common approaches that don't work:

  1. Creating the user in the application database instead of the authSource database 85% fail

    MongoDB authenticates users against a specific database (authSource, typically 'admin'). Creating a user in 'myappdb' does not help if the client authenticates against 'admin'. The user must exist in the authentication database.

  2. Disabling authentication by removing the security.authorization setting 70% fail

    Disabling authentication in production exposes the database to unauthorized access. MongoDB has been a frequent target of ransomware attacks on open instances. This is a security anti-pattern, not a fix.

Error Chain

Leads to:
Preceded by:
Frequently confused with: