SERVER-44320 Allow users with enableSharding cluster AT to manipulate sharding zones

(cherry picked from commit b08f7a6989c3e6b3af944201f618c8c928cc4077)

4 files changed, 68 insertions, 20 deletions

diff --git a/jstests/auth/lib/commands_lib.js b/jstests/auth/lib/commands_lib.js
index 9a850b78fd2..910c9ea6837 100644
--- a/jstests/auth/lib/commands_lib.js
+++ b/jstests/auth/lib/commands_lib.js
@@ -5792,9 +5792,16 @@ var authCommandsLib = {
           testcases: [
               {
                 runOnDb: adminDbName,
-                roles: roles_clusterManager,
                 privileges: [{resource: {db: 'config', collection: 'shards'}, actions: ['update']}],
               },
+              {
+                runOnDb: adminDbName,
+                roles: roles_clusterManager,
+              },
+              {
+                runOnDb: adminDbName,
+                privileges: [{resource: {cluster: true}, actions: ["enableSharding"]}],
+              },
           ]
         },
         {
@@ -5812,12 +5819,19 @@ var authCommandsLib = {
           testcases: [
               {
                 runOnDb: adminDbName,
-                roles: roles_clusterManager,
                 privileges: [
                     {resource: {db: 'config', collection: 'shards'}, actions: ['update']},
                     {resource: {db: 'config', collection: 'tags'}, actions: ['find']}
                 ],
               },
+              {
+                runOnDb: adminDbName,
+                roles: roles_clusterManager,
+              },
+              {
+                runOnDb: adminDbName,
+                privileges: [{resource: {cluster: true}, actions: ["enableSharding"]}],
+              },
           ]
         },
         {
@@ -5835,7 +5849,6 @@ var authCommandsLib = {
           testcases: [
               {
                 runOnDb: adminDbName,
-                roles: roles_clusterManager,
                 privileges: [
                     {resource: {db: 'config', collection: 'shards'}, actions: ['find']},
                     {
@@ -5845,6 +5858,16 @@ var authCommandsLib = {
                 ],
                 expectFail: true
               },
+              {
+                runOnDb: adminDbName,
+                roles: roles_clusterManager,
+                expectFail: true,
+              },
+              {
+                runOnDb: adminDbName,
+                privileges: [{resource: {cluster: true}, actions: ["enableSharding"]}],
+                expectFail: true,
+              },
           ]
         },
         {
diff --git a/src/mongo/s/commands/cluster_add_shard_to_zone_cmd.cpp b/src/mongo/s/commands/cluster_add_shard_to_zone_cmd.cpp
index a345a516ea9..d3349e66694 100644
--- a/src/mongo/s/commands/cluster_add_shard_to_zone_cmd.cpp
+++ b/src/mongo/s/commands/cluster_add_shard_to_zone_cmd.cpp
@@ -82,11 +82,20 @@ public:
 
     Status checkAuthForCommand(Client* client,
                                const std::string& dbname,
-                               const BSONObj& cmdObj) const override {
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+                               const BSONObj& cmdObj) const final {
+        auto* as = AuthorizationSession::get(client);
+
+        if (as->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
+                                                 ActionType::enableSharding)) {
+            return Status::OK();
+        }
+
+        // Fallback on permissions to directly modify the shard config.
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(ShardType::ConfigNS), ActionType::update)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
+
         return Status::OK();
     }
 
diff --git a/src/mongo/s/commands/cluster_remove_shard_from_zone_cmd.cpp b/src/mongo/s/commands/cluster_remove_shard_from_zone_cmd.cpp
index 2cdf88df280..0d82807b1ab 100644
--- a/src/mongo/s/commands/cluster_remove_shard_from_zone_cmd.cpp
+++ b/src/mongo/s/commands/cluster_remove_shard_from_zone_cmd.cpp
@@ -89,15 +89,23 @@ public:
 
     Status checkAuthForCommand(Client* client,
                                const std::string& dbname,
-                               const BSONObj& cmdObj) const override {
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+                               const BSONObj& cmdObj) const final {
+        auto* as = AuthorizationSession::get(client);
+
+        if (as->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
+                                                 ActionType::enableSharding)) {
+            return Status::OK();
+        }
+
+        // Fallback on permissions to directly modify the shard config.
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(ShardType::ConfigNS), ActionType::update)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(TagsType::ConfigNS), ActionType::find)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
         return Status::OK();
diff --git a/src/mongo/s/commands/cluster_update_zone_key_range_cmd.cpp b/src/mongo/s/commands/cluster_update_zone_key_range_cmd.cpp
index 7a1feae9b7b..ba2bd52bf98 100644
--- a/src/mongo/s/commands/cluster_update_zone_key_range_cmd.cpp
+++ b/src/mongo/s/commands/cluster_update_zone_key_range_cmd.cpp
@@ -92,25 +92,33 @@ public:
 
     Status checkAuthForCommand(Client* client,
                                const std::string& dbname,
-                               const BSONObj& cmdObj) const override {
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+                               const BSONObj& cmdObj) const final {
+        auto* as = AuthorizationSession::get(client);
+
+        if (as->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
+                                                 ActionType::enableSharding)) {
+            return Status::OK();
+        }
+
+        // Fallback on permissions to directly modify the shard config.
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(ShardType::ConfigNS), ActionType::find)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(TagsType::ConfigNS), ActionType::find)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(TagsType::ConfigNS), ActionType::update)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
-        if (!AuthorizationSession::get(client)->isAuthorizedForActionsOnResource(
+        if (!as->isAuthorizedForActionsOnResource(
                 ResourcePattern::forExactNamespace(TagsType::ConfigNS), ActionType::remove)) {
-            return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            return {ErrorCodes::Unauthorized, "Unauthorized"};
         }
 
         return Status::OK();