Unable to use mongoDB for Auth and ACL

[nishuthan]

I have a VernMQ cluster with HA proxy as load balancer in docker compose. I am trying to use mongoDB to authenticate my devices. but as soon as i run the command docker compose up -d I see the logs in one of the vernMQ cluster node I see the following error

2025-12-03T06:10:11.881184+00:00 [error] <0.710.0> gen_server:error_info/8:1391: Generic server <0.710.0> terminating. Reason: {{badmatch,{false,#{<<"code">> => 13,<<"codeName">> => <<"Unauthorized">>,<<"errmsg">> => <<"Command buildInfo requires authentication">>}}},[{mc_worker_api,get_version,1,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/api/mc_worker_api.erl"},{line,85}]},{mc_worker_api,connect,1,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/api/mc_worker_api.erl"},{line,67}]},{vmq_diversity_worker_wrapper,handle_info,2,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_worker_wrapper.erl"},{line,176}]},{gen_server,try_handle_info,3,[{file,"gen_server.erl"},{line,1095}]},{gen_server,handle_msg,6,[{file,"gen_server.erl"},{line,1183}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,241}]}]}. Last message: connect. State: {state,mongodb,#Fun<vmq_diversity_sup.4.29008357>,#Fun<vmq_diversity_sup.5.29008357>,undefined,false,1000,undefined}.

Here is my docker-compose.yml

services:
  vernemq1:
    image: vernemq/vernemq:latest
    container_name: vernemq1
    environment:
      - DOCKER_VERNEMQ_ACCEPT_EULA=yes
      - DOCKER_VERNEMQ_PLUGINS__VMQ_DIVERSITY=on
      - DOCKER_VERNEMQ_PLUGINS__VMQ_PASSWD=off
      - DOCKER_VERNEMQ_PLUGINS__VMQ_ACL=off
      - DOCKER_VERNEMQ_ALLOW_ANONYMOUS=off
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__AUTH_MONGODB__ENABLED=on
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__HOST=172.28.0.10
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PORT=27017
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__LOGIN=admin
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PASSWORD=SecureAdminPass2025!
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__DATABASE=MyDevices
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__AUTH_SOURCE=admin
    networks:
      vernemq-net:
        ipv4_address: 172.28.0.2

  vernemq2:
    image: vernemq/vernemq:latest
    container_name: vernemq2
    environment:
      - DOCKER_VERNEMQ_ACCEPT_EULA=yes
      - DOCKER_VERNEMQ_DISCOVERY_NODE=172.28.0.2
      - DOCKER_VERNEMQ_PLUGINS__VMQ_DIVERSITY=on
      - DOCKER_VERNEMQ_PLUGINS__VMQ_PASSWD=off
      - DOCKER_VERNEMQ_PLUGINS__VMQ_ACL=off
      - DOCKER_VERNEMQ_ALLOW_ANONYMOUS=off
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__AUTH_MONGODB__ENABLED=on
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__HOST=172.28.0.10
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PORT=27017
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__LOGIN=admin
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PASSWORD=SecureAdminPass2025!
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__DATABASE=MyDevices
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__AUTH_SOURCE=admin
    networks:
      vernemq-net:
        ipv4_address: 172.28.0.3

  vernemq3:
    image: vernemq/vernemq:latest
    container_name: vernemq3
    environment:
      - DOCKER_VERNEMQ_ACCEPT_EULA=yes
      - DOCKER_VERNEMQ_DISCOVERY_NODE=172.28.0.2
      - DOCKER_VERNEMQ_PLUGINS__VMQ_DIVERSITY=on
      - DOCKER_VERNEMQ_PLUGINS__VMQ_PASSWD=off
      - DOCKER_VERNEMQ_PLUGINS__VMQ_ACL=off
      - DOCKER_VERNEMQ_ALLOW_ANONYMOUS=off
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__AUTH_MONGODB__ENABLED=on
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__HOST=172.28.0.10
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PORT=27017
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__LOGIN=admin
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__PASSWORD=SecureAdminPass2025!
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__DATABASE=MyDevices
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__AUTH_SOURCE=admin
    networks:
      vernemq-net:
        ipv4_address: 172.28.0.4

  haproxy:
    image: haproxy:latest
    container_name: haproxy-lb
    ports:
      - "1883:1883"
      - "8888:8888"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
    networks:
      vernemq-net:
        ipv4_address: 172.28.0.5
    depends_on:
      - vernemq1
      - vernemq2
      - vernemq3
  mongodb:
    image: mongo:latest
    container_name: vmqacl
    ports:
      - "27017:27017"
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: SecureAdminPass2025!
    networks:
      vernemq-net:
        ipv4_address: 172.28.0.10

networks:
  vernemq-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

[ioolkos]

@nishuthan Thanks, most likely we do not support MongoDB 8.2 yet in the used driver lib. That's what the error seems to indicate (<<"Command buildInfo requires authentication">>)

---

👉 Thank you for supporting VerneMQ: https://github.com/sponsors/vernemq
👉 Using the binary VerneMQ packages commercially (.deb/.rpm/Docker) requires a paid subscription.

[nishuthan]

Thanks @ioolkos. I changed the mongoDB version to 7.0.2 and I am getting the following error

2025-12-03 13:23:27.031 | 2025-12-03T07:53:27.030316+00:00 [error] <0.4923.0> gen_server:error_info/8:1391: Generic server <0.4923.0> terminating. Reason: {{bad_query,#{<<"$err">> => <<"OP_QUERY is no longer supported. The client driver may require an upgrade. For more details see https://dochub.mongodb.org/core/legacy-opcode-removal">>,<<"code">> => 5739101,<<"ok">> => 0.0}},[{mc_connection_man,process_error,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,123}]},{mc_connection_man,read_one,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,37}]},{vmq_diversity_worker_wrapper,handle_call,3,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_worker_wrapper.erl"},{line,138}]},{gen_server,try_handle_call,4,[{file,"gen_server.erl"},{line,1131}]},{gen_server,handle_msg,6,[{file,"gen_server.erl"},{line,1160}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,241}]}]}. Last message: {apply,mc_worker_api,find_one,[<<"vmq_acl_auth">>,#{<<"client_id">> => <<"test">>,<<"mountpoint">> => <<>>,<<"username">> => <<"test-user-name">>},#{readopts => #{<<"mode">> => <<"primaryPreferred">>}}]}. State: {state,mongodb,#Fun<vmq_diversity_sup.4.29008357>,#Fun<vmq_diversity_sup.5.29008357>,{#Ref<0.3406208621.2189426689.93208>,<0.4924.0>},true,1000,undefined}. Client <0.654.0> stacktrace: [{gen,do_call,4,[{file,"gen.erl"},{line,240}]},{gen_server,call,3,[{file,"gen_server.erl"},{line,415}]},{poolboy,transaction,3,[{file,"/opt/vernemq/_build/default/lib/poolboy/src/poolboy.erl"},{line,84}]},{vmq_diversity_mongo,find_one,2,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_mongo.erl"},{line,378}]}].
2025-12-03 13:23:27.033 | 2025-12-03T07:53:27.031545+00:00 [error] <0.4923.0> proc_lib:crash_report/4:584: crasher: initial call: vmq_diversity_worker_wrapper:init/1, pid: <0.4923.0>, registered_name: [], error: {{bad_query,#{<<"$err">> => <<"OP_QUERY is no longer supported. The client driver may require an upgrade. For more details see https://dochub.mongodb.org/core/legacy-opcode-removal">>,<<"code">> => 5739101,<<"ok">> => 0.0}},[{mc_connection_man,process_error,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,123}]},{mc_connection_man,read_one,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,37}]},{vmq_diversity_worker_wrapper,handle_call,3,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_worker_wrapper.erl"},{line,138}]},{gen_server,try_handle_call,4,[{file,"gen_server.erl"},{line,1131}]},{gen_server,handle_msg,6,[{file,"gen_server.erl"},{line,1160}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,241}]}]}, ancestors: [<0.626.0>,auth_mongodb,vmq_diversity_sup,<0.609.0>], message_queue_len: 2, messages: [{'EXIT',<0.4924.0>,normal},{'DOWN',#Ref<0.3406208621.2189426689.93208>,process,<0.4924.0>,normal}], links: [<0.626.0>,<0.625.0>], dictionary: [], trap_exit: true, status: running, heap_size: 10958, stack_size: 28, reductions: 365558; neighbours:
2025-12-03 13:23:27.037 | 2025-12-03T07:53:27.033591+00:00 [error] <0.626.0> supervisor:do_restart/3:759: Supervisor: {<0.626.0>,poolboy_sup}. Context: child_terminated. Reason: {{bad_query,#{<<"$err">> => <<"OP_QUERY is no longer supported. The client driver may require an upgrade. For more details see https://dochub.mongodb.org/core/legacy-opcode-removal">>,<<"code">> => 5739101,<<"ok">> => 0.0}},[{mc_connection_man,process_error,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,123}]},{mc_connection_man,read_one,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,37}]},{vmq_diversity_worker_wrapper,handle_call,3,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_worker_wrapper.erl"},{line,138}]},{gen_server,try_handle_call,4,[{file,"gen_server.erl"},{line,1131}]},{gen_server,handle_msg,6,[{file,"gen_server.erl"},{line,1160}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,241}]}]}. Offender: id=vmq_diversity_worker_wrapper,pid=<0.4923.0>.
2025-12-03 13:23:27.039 | 2025-12-03T07:53:27.033623+00:00 [error] <0.654.0> vmq_diversity_mongo:find_one/2:394: can't execute find_one [{<<"client_id">>,<<"test">>},{<<"mountpoint">>,<<>>},{<<"username">>,<<"test-user-name">>}] due to exit:{{{bad_query,#{<<"$err">> => <<"OP_QUERY is no longer supported. The client driver may require an upgrade. For more details see https://dochub.mongodb.org/core/legacy-opcode-removal">>,<<"code">> => 5739101,<<"ok">> => 0.0}},[{mc_connection_man,process_error,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,123}]},{mc_connection_man,read_one,2,[{file,"/opt/vernemq/_build/default/lib/mongodb/src/connection/mc_connection_man.erl"},{line,37}]},{vmq_diversity_worker_wrapper,handle_call,3,[{file,"/opt/vernemq/apps/vmq_diversity/src/vmq_diversity_worker_wrapper.erl"},{line,138}]},{gen_server,try_handle_call,4,[{file,"gen_server.erl"},{line,1131}]},{gen_server,handle_msg,6,[{file,"gen_server.erl"},{line,1160}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,241}]}]},{gen_server,call,[<0.4923.0>,{apply,mc_worker_api,find_one,[<<"vmq_acl_auth">>,#{<<"client_id">> => <<"test">>,<<"mountpoint">> => <<>>,<<"username">> => <<"test-user-name">>},#{readopts => #{<<"mode">> => <<"primaryPreferred">>}}]},infinity]}}
2025-12-03 13:23:27.039 | 2025-12-03T07:53:27.037718+00:00 [error] <0.654.0> vmq_diversity_script_state:handle_info/2:185: can't call function auth_on_register with args [{addr,<<"172.28.0.5">>},{port,48896},{mountpoint,<<>>},{client_id,<<"test">>},{username,<<"test-user-name">>},{clean_session,true}] in "./share/lua/auth/mongodb.lua" due to {badarg,execute_find_one,[<<"auth_mongodb">>,<<"vmq_acl_auth">>,{tref,33}]}
2025-12-03 13:23:27.042 | 2025-12-03T07:53:27.038642+00:00 [warning] <0.5153.0> vmq_mqtt_fsm:check_user/2:732: can't authenticate client {[],<<"test">>} from 172.28.0.5:48896 due to lua_script_error

When i downgraded to mongoDB version 5.0.31 authentication is working.

[nishuthan]

I also tried with mongoDB version 7.0.26 and vernemq:2.1.2 authentication works without any issues.

[ioolkos]

@nishuthan Thanks for your updates! I think the MongoDB 8.0 series should work as well. But let us know if not, of course.

---

👉 Thank you for supporting VerneMQ: https://github.com/sponsors/vernemq
👉 Using the binary VerneMQ packages commercially (.deb/.rpm/Docker) requires a paid subscription.

[nishuthan]

I switched to mongoDB 8.0.16 and it works.

If I make a mongoDB replica set with TLS enabled it should still work as expected by adding the below configs right ?

      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__SSL=on
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__CAFILE=/etc/ssl/certs/ca.pem
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__CERTFILE=/etc/ssl/certs/client.pem
      - DOCKER_VERNEMQ_VMQ_DIVERSITY__MONGODB__KEYFILE=/etc/ssl/certs/client.key

and does using a self signed CA cause any issue with VernMQ ?