mongodb用户管理1

对于db，为保证数据的安全性，隔离用户权限，阻止非法用户对数据的访问，用户账户的管理十分重要。

1.db.auth()用户认证

db.auth( <username>, <password> )

例如：

db.auth( "test","test" )

认证成功返回1，失败返回0
2.用户创建db.createUser()

可参考https://docs.mongodb.com/manual/reference/method/db.createUser/

添加用户的字段,一般有：
1.user 用户名，唯一
2.roles 用户角色，数组类型
3.pwd 密码

用户的角色：

read： 读权限当前数据库
readWrite：读写指定数据库
dbAdmin： 读写指定数据库以及清理修改，压缩，获取统计信息执行检测
userAdmin：指定数据库里创建、删除和管理用户
clusterAdmin： 赋予用户所有分片和集群，连接相关函数的管理权限，创建，删除数据库。
readAnyDatabase： 所有数据库的读权限
readWriteAnyDatabase：所有数据库的读写权限
userAdminAnyDatabase：所有数据库的userAdmin权限
dbAdminAnyDatabase： 所有数据库的dbAdmin权限。

先创建两个测试数据库

[root@mongodb ~]# mongo
> use mogotest
switched to db mogotest
> db.movie.insert({"name":"abc"})
WriteResult({ "nInserted" : 1 })
> 
> use mogotest2
switched to db mogotest2
> db.er.insert({"des":"abc"})
WriteResult({ "nInserted" : 1 })
> show dbs
local      0.000GB
mogotest   0.000GB
mogotest2  0.000GB
> 

创建一个test1-1 只有读权限的用户：

> use mogotest
switched to db mogotest
> db.createUser(
     { user: "test1-1",
       pwd: "test",
       roles: [ "read"]
     }
   )  

Successfully added user: { "user" : "test1-1", "roles" : [ "read" ] }

db.auth验证

> db.auth("test1-1","test")
1

创建跨db的用户

db.createUser( { user: "Admin01",
                 pwd: "admin",
                 customData: { employeeId: 12345 },
                 roles: [ { role: "read", db: "mogotest" },
                          { role: "readWrite", db: "mogotest2" },
                          "readWrite"] },
               { w: "majority" , wtimeout: 5000 } )

3.显示用户
当前数据库用户

show user
> show users;
{
        "_id" : "mogotest.test1-1",
        "user" : "test1-1",
        "db" : "mogotest",
        "roles" : [
                {
                        "role" : "read",
                        "db" : "mogotest"
                }
        ]
}

整个mongodb中的用户
需要切换到admin下，否则没有输出
use admin
db.system.users.find();
db.system.users.find().count();可以统计有多少个用户

4.更新用户db.updateUser()
用户创建完成后，需要修改用户则使用updateUser
注：updateuser能够完全替换掉原来的字段值，包括用户roles的数组
当需要更新roles数组的时候，它是完全替换之前的值，如果要新增或添加roles而不是代替它
则使用方法： db.grantRolesToUser() 或 db.revokeRolesFromUser()

> db.system.users.find();
{ "_id" : "mogotest2.test", "user" : "test", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "UT0k2j3AFO1PjgBd4Q0wtg==", "storedKey" : "gkkQCtIEp8d2rKSo5iw/qwwW448=", "serverKey" : "XG73AnDsUSW58U74Mn/xoCus9Sg=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
{ "_id" : "mogotest2.test2", "user" : "test2", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "fHsq3B25hzVKgqRc8GRCjg==", "storedKey" : "1tLoA2UDYJSH3TNcbS7oULUXX7I=", "serverKey" : "Gl0sjokLF2roh/OtrA7Ca8NsTao=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
{ "_id" : "mogotest2.test3", "user" : "test3", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "mpqOPx3Xsi+5ObYGHsz9QQ==", "storedKey" : "JTr+5UTW9AQFYra7SBgavIpo7N4=", "serverKey" : "ENyDXBhm+soYtXl3Kv8+ouq+qpQ=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
>  
> db.system.users.find().count();
9

例如：

更新前：
{
        "_id" : "mogotest.test1-1",
        "user" : "test1-1",
        "db" : "mogotest",
        "roles" : [
                {
                        "role" : "read",
                        "db" : "mogotest"
                }
        ]
}

更新：
db.updateUser( "test1-1",
               {
                 roles : [
                           { role : "readWrite", db : "mogotest"  }
                         ]
                }
             )

更新后：

{
        "_id" : "mogotest.test1-1",
        "user" : "test1-1",
        "db" : "mogotest",
        "roles" : [
                {
                        "role" : "readWrite",
                        "db" : "mogotest"
                }
        ]
}

演示update替换原来roles的属性：

更新前：
{
        "_id" : "mogotest.Admin01",
        "user" : "Admin01",
        "db" : "mogotest",
        "customData" : {
                "employeeId" : 12345
        },
        "roles" : [
                {
                        "role" : "read",
                        "db" : "mogotest"
                },
                {
                        "role" : "readWrite",
                        "db" : "mogotest2"
                },
                {
                        "role" : "readWrite",
                        "db" : "mogotest"
                }
        ]
}

更新
db.updateUser( "Admin01",
               {
               "roles" : [
                {
                        "role" : "readWrite",
                        "db" : "mogotest2"
                },
                {
                        "role" : "readWrite",
                        "db" : "mogotest"
                }
               ]
              }
            )

更新后：
{
        "_id" : "mogotest.Admin01",
        "user" : "Admin01",
        "db" : "mogotest",
        "customData" : {
                "employeeId" : 12345
        },
        "roles" : [
                {
                        "role" : "readWrite",
                        "db" : "mogotest2"
                },
                {
                        "role" : "readWrite",
                        "db" : "mogotest"
                }
        ]
}

原来的
{
“role” : “read”,
“db” : “mogotest”
},
…
已经被替换掉