MongoDB 3.x开启授权相关问题
MongoDB 3.x开启授权相关问题
空山苦水禅人 发表于1个月前
MongoDB 3.x开启授权相关问题
  • 发表于 1个月前
  • 阅读 9
  • 收藏 0
  • 点赞 0
  • 评论 0

腾讯云 十分钟定制你的第一个小程序>>>   

一、安装

如果是在CentOS下,可以使用yum安装:

# vi /etc/yum.repos.d/mongodb-org-3.2.repo 
[mongodb-org-3.2]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.2/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.2.asc

# yum -y install mongodb-org  

如果是其他情况,可以参考其他教程,此处略去。

二、使用

通过 service mongod start|stop|restart|status 命令可以启停MongoDB服务、查看服务状态。

直接输入  mongo命令,可以进入本地MongoDB客户端shell环境进行操作。

三、开启授权

MongoDB安装后默认没有开启授权。

1、MongoDB的角色

1.数据库用户角色:read、readWrite; 
2.数据库管理角色:dbAdmin、dbOwner、userAdmin; 
3.集群管理角色:clusterAdmin、clusterManager、clusterMonitor、hostManager; 
4.备份恢复角色:backup、restore; 
5.所有数据库角色:readAnyDatabase、readWriteAnyDatabase、userAdminAnyDatabase、dbAdminAnyDatabase 
6.超级用户角色:root 
//这里还有几个角色间接或直接提供了系统超级用户的访问(dbOwner 、userAdmin、userAdminAnyDatabase) 
其中MongoDB默认是没有开启用户认证的,也就是说游客也拥有超级管理员的权限。userAdminAnyDatabase:有分配角色和用户的权限,但没有查写的权限

2、操作步骤

2.1 连接到MongoDB服务器

# mongo

2.2 创建root/admin用户

需要先进入admin数据库:

> use admin
switched to db admin
> db.createUser({user:"root",pwd:"123456",roles:["root"]})
Successfully added user: { "user" : "root", "roles" : [ "root" ] }
> db.createUser({user: "admin", pwd: "admin123", roles: [{role: "userAdminAnyDatabase", db: "admin"}]})
Successfully added user: {
	"user" : "admin",
	"roles" : [
		{
			"role" : "userAdminAnyDatabase",
			"db" : "admin"
		}
	]
}
> 

2.3 修改mongod.conf文件

# vim /etc/mongod.conf

在配置文件中增加如下配置:

security:
  authorization: enabled #启用授权

2.4 重启MongoDB服务器

# service mongod restart
Stopping mongod:                                           [  OK  ]
Starting mongod:                                           [  OK  ]

2.5 重新连接MongoDB并认证

# mongo
> use admin
switched to db admin
> db.auth("root","123456")
1
> 

2.6 创建其他用户并授权

需要注意的是:

  • 首先必须用具有权限的账号认证后才能创建其他用户
  • 其次,虽然所有用户信息都存在db.system.users表中,但在哪个数据库下创建的用户,连接时,授权数据库就要填该数据库名,不然连不上

下面是分别在admin数据库和test数据库下创建账号并授权:

> use admin
switched to db admin
> db.createUser({user: "abc", pwd: "abc123", roles: [{ role: "readWrite", db: "test" }]})
Successfully added user: {
	"user" : "abc",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
> use test
switched to db test
> db.createUser({user: "zhangsan", pwd: "zs123", roles: [{ role: "readWrite", db: "test" }]})
Successfully added user: {
	"user" : "zhangsan",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
>

查看创建的用户信息:

> use admin
switched to db admin
> show tables
system.users
system.version
> db.system.users.find()
{ "_id" : "admin.root", "user" : "root", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "1lN4+lSCsAiqrHyDeF0dDw==", "storedKey" : "lXnNQlYbrwIGzTWU2He8LeMQYUc=", "serverKey" : "qaqpDLrVJiYRIC07WgGmRVrNa3E=" } }, "roles" : [ { "role" : "root", "db" : "admin" } ] }
{ "_id" : "admin.admin", "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "05RUNbdABztBRB9LGwMwaw==", "storedKey" : "p0pQMiSnRZYO5uz27hWGlQcT+lc=", "serverKey" : "M3GPCiWiikAA5I3GZ4n+HXr9AhM=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
{ "_id" : "admin.abc", "user" : "abc", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "QNmh+KkaKmWoMS54eQd7AA==", "storedKey" : "AojS4bCad70kSnszEVcM5uTABV4=", "serverKey" : "cs9vVjzmDSkb1w7j4fNciO8Bbco=" } }, "roles" : [ { "role" : "readWrite", "db" : "test" } ] }
{ "_id" : "test.zhangsan", "user" : "zhangsan", "db" : "test", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "c9MPKA96iQg/L1emr2ogIg==", "storedKey" : "MawJ3vNnfvRfdZiRcuru7Ab2m7o=", "serverKey" : "tv/m7PNVZPt0PXX2uQTdwJl/pAc=" } }, "roles" : [ { "role" : "readWrite", "db" : "test" } ] }
> 

可以看到,abc用户和zhangsan用户的_id分别带了数据库名的,只有在相应的数据库下进行认证才可以。比如:

> use test
switched to db test
> show tables
> db.auth("abc","abc123")
Error: Authentication failed.
0
> use admin
switched to db admin
> db.auth("abc","abc123")
1
> db.auth("zhangsan","zs123")
Error: Authentication failed.
0
> use test
switched to db test
> db.auth("zhangsan","zs123")
1
> 

2.7 客户端连接MongoDB

Java程序连接

//方式一
MongoCredential credential = MongoCredential.createCredential("username", "dbName", "password".toCharArray());
ServerAddress serverAddress = new ServerAddress("192.168.10.242", 27017);
MongoClient mongoClient = new MongoClient(serverAddress, Arrays.asList(credential));
DB db = mongoClient.getDB("dbName");
return db;

//方式二
String sURI = String.format("mongodb://%s:%s@%s:%d/%s", "username", "password", "192.168.10.242", 27017, "dbName"); 
MongoClientURI uri = new MongoClientURI(sURI); 
MongoClient mongoClient = new MongoClient(uri); 
DB db = mongoClient.getDB("dbName");

桌面程序

有些工具不支持3.x版本,使用时需要注意。另外,上面创建的账号加密机制是SCRAM-SHA-1,工具要支持才行,不然需要修改MongoDB的authschema 级别并重新创建账号。[参考]

经验证,Studio 3T for MongoDB 和 NoSQL Manager for MongoDB Professional 都支持SCRAM-SHA-1连接方式,下图是NoSQL Manager for MongoDB Professional的连接设置:

 

共有 人打赏支持
粉丝 7
博文 12
码字总数 6372
×
空山苦水禅人
如果觉得我的文章对您有用,请随意打赏。您的支持将鼓励我继续创作!
* 金额(元)
¥1 ¥5 ¥10 ¥20 其他金额
打赏人
留言
* 支付类型
微信扫码支付
打赏金额:
已支付成功
打赏金额: