对于db,为保证数据的安全性,隔离用户权限,阻止非法用户对数据的访问,用户账户的管理十分重要。
1.db.auth()用户认证
db.auth( <username>, <password> )
例如:
db.auth( "test","test" )
认证成功返回1,失败返回0
2.用户创建db.createUser()
可参考https://docs.mongodb.com/manual/reference/method/db.createUser/
添加用户的字段,一般有:
1.user 用户名,唯一
2.roles 用户角色,数组类型
3.pwd 密码
用户的角色:
read: 读权限当前数据库
readWrite:读写指定数据库
dbAdmin: 读写指定数据库以及清理修改,压缩,获取统计信息执行检测
userAdmin:指定数据库里创建、删除和管理用户
clusterAdmin: 赋予用户所有分片和集群,连接相关函数的管理权限,创建,删除数据库。
readAnyDatabase: 所有数据库的读权限
readWriteAnyDatabase:所有数据库的读写权限
userAdminAnyDatabase:所有数据库的userAdmin权限
dbAdminAnyDatabase: 所有数据库的dbAdmin权限。
先创建两个测试数据库
[root@mongodb ~]# mongo
> use mogotest
switched to db mogotest
> db.movie.insert({"name":"abc"})
WriteResult({ "nInserted" : 1 })
>
> use mogotest2
switched to db mogotest2
> db.er.insert({"des":"abc"})
WriteResult({ "nInserted" : 1 })
> show dbs
local 0.000GB
mogotest 0.000GB
mogotest2 0.000GB
>
创建一个test1-1 只有读权限的用户:
> use mogotest
switched to db mogotest
> db.createUser(
{ user: "test1-1",
pwd: "test",
roles: [ "read"]
}
)
Successfully added user: { "user" : "test1-1", "roles" : [ "read" ] }
db.auth验证
> db.auth("test1-1","test")
1
创建跨db的用户
db.createUser( { user: "Admin01",
pwd: "admin",
customData: { employeeId: 12345 },
roles: [ { role: "read", db: "mogotest" },
{ role: "readWrite", db: "mogotest2" },
"readWrite"] },
{ w: "majority" , wtimeout: 5000 } )
3.显示用户
当前数据库用户
show user
> show users;
{
"_id" : "mogotest.test1-1",
"user" : "test1-1",
"db" : "mogotest",
"roles" : [
{
"role" : "read",
"db" : "mogotest"
}
]
}
整个mongodb中的用户
需要切换到admin下,否则没有输出
use admin
db.system.users.find();
db.system.users.find().count();可以统计有多少个用户
4.更新用户db.updateUser()
用户创建完成后,需要修改用户则使用updateUser
注:updateuser能够完全替换掉原来的字段值,包括用户roles的数组
当需要更新roles数组的时候,它是完全替换之前的值,如果要新增或添加roles而不是代替它
则使用方法: db.grantRolesToUser() 或 db.revokeRolesFromUser()
> db.system.users.find();
{ "_id" : "mogotest2.test", "user" : "test", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "UT0k2j3AFO1PjgBd4Q0wtg==", "storedKey" : "gkkQCtIEp8d2rKSo5iw/qwwW448=", "serverKey" : "XG73AnDsUSW58U74Mn/xoCus9Sg=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
{ "_id" : "mogotest2.test2", "user" : "test2", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "fHsq3B25hzVKgqRc8GRCjg==", "storedKey" : "1tLoA2UDYJSH3TNcbS7oULUXX7I=", "serverKey" : "Gl0sjokLF2roh/OtrA7Ca8NsTao=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
{ "_id" : "mogotest2.test3", "user" : "test3", "db" : "mogotest2", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "mpqOPx3Xsi+5ObYGHsz9QQ==", "storedKey" : "JTr+5UTW9AQFYra7SBgavIpo7N4=", "serverKey" : "ENyDXBhm+soYtXl3Kv8+ouq+qpQ=" } }, "roles" : [ { "role" : "readWrite", "db" : "mogotest2" } ] }
>
> db.system.users.find().count();
9
例如:
更新前:
{
"_id" : "mogotest.test1-1",
"user" : "test1-1",
"db" : "mogotest",
"roles" : [
{
"role" : "read",
"db" : "mogotest"
}
]
}
更新:
db.updateUser( "test1-1",
{
roles : [
{ role : "readWrite", db : "mogotest" }
]
}
)
更新后:
{
"_id" : "mogotest.test1-1",
"user" : "test1-1",
"db" : "mogotest",
"roles" : [
{
"role" : "readWrite",
"db" : "mogotest"
}
]
}
演示update替换原来roles的属性:
更新前:
{
"_id" : "mogotest.Admin01",
"user" : "Admin01",
"db" : "mogotest",
"customData" : {
"employeeId" : 12345
},
"roles" : [
{
"role" : "read",
"db" : "mogotest"
},
{
"role" : "readWrite",
"db" : "mogotest2"
},
{
"role" : "readWrite",
"db" : "mogotest"
}
]
}
更新
db.updateUser( "Admin01",
{
"roles" : [
{
"role" : "readWrite",
"db" : "mogotest2"
},
{
"role" : "readWrite",
"db" : "mogotest"
}
]
}
)
更新后:
{
"_id" : "mogotest.Admin01",
"user" : "Admin01",
"db" : "mogotest",
"customData" : {
"employeeId" : 12345
},
"roles" : [
{
"role" : "readWrite",
"db" : "mogotest2"
},
{
"role" : "readWrite",
"db" : "mogotest"
}
]
}
原来的
{
“role” : “read”,
“db” : “mogotest”
},
…
已经被替换掉