SERVER-18140: Allow getParameter to be executed locally against an arbiter in an authenticated replica set

1 files changed, 8 insertions, 0 deletions

diff --git a/src/mongo/db/auth/authz_session_external_state_d.cpp b/src/mongo/db/auth/authz_session_external_state_d.cpp
index dc78555b707..65f30b5ce75 100644
--- a/src/mongo/db/auth/authz_session_external_state_d.cpp
+++ b/src/mongo/db/auth/authz_session_external_state_d.cpp
@@ -36,6 +36,7 @@
 #include "mongo/db/instance.h"
 #include "mongo/db/jsobj.h"
 #include "mongo/db/operation_context.h"
+#include "mongo/db/repl/replication_coordinator_global.h"
 #include "mongo/scripting/engine.h"
 #include "mongo/util/assert_util.h"
 
@@ -60,4 +61,11 @@ namespace mongo {
                AuthzSessionExternalStateServerCommon::shouldIgnoreAuthChecks();
     }
 
+    bool AuthzSessionExternalStateMongod::serverIsArbiter() const {
+        // Arbiters have access to extra privileges under localhost. See SERVER-5479.
+        return (repl::getGlobalReplicationCoordinator()->getReplicationMode() ==
+                repl::ReplicationCoordinator::modeReplSet &&
+                repl::getGlobalReplicationCoordinator()->getMemberState().arbiter());
+    }
+
 } // namespace mongo