MongoDB 3.x开启授权相关问题

  

一、安装

如果是在CentOS下，可以使用yum安装：

# vi /etc/yum.repos.d/mongodb-org-3.2.repo 
[mongodb-org-3.2]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.2/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.2.asc

# yum -y install mongodb-org  

如果是其他情况，可以参考其他教程，此处略去。

二、使用

通过 service mongod start|stop|restart|status 命令可以启停MongoDB服务、查看服务状态。

直接输入  mongo命令，可以进入本地MongoDB客户端shell环境进行操作。

三、开启授权

MongoDB安装后默认没有开启授权。

1、MongoDB的角色

1.数据库用户角色：read、readWrite; 
2.数据库管理角色：dbAdmin、dbOwner、userAdmin； 
3.集群管理角色：clusterAdmin、clusterManager、clusterMonitor、hostManager； 
4.备份恢复角色：backup、restore； 
5.所有数据库角色：readAnyDatabase、readWriteAnyDatabase、userAdminAnyDatabase、dbAdminAnyDatabase 
6.超级用户角色：root 
//这里还有几个角色间接或直接提供了系统超级用户的访问（dbOwner 、userAdmin、userAdminAnyDatabase） 
其中MongoDB默认是没有开启用户认证的，也就是说游客也拥有超级管理员的权限。userAdminAnyDatabase：有分配角色和用户的权限，但没有查写的权限

2、操作步骤

2.1 连接到MongoDB服务器

# mongo

2.2 创建root/admin用户

需要先进入admin数据库：

> use admin
switched to db admin
> db.createUser({user:"root",pwd:"123456",roles:["root"]})
Successfully added user: { "user" : "root", "roles" : [ "root" ] }
> db.createUser({user: "admin", pwd: "admin123", roles: [{role: "userAdminAnyDatabase", db: "admin"}]})
Successfully added user: {
	"user" : "admin",
	"roles" : [
		{
			"role" : "userAdminAnyDatabase",
			"db" : "admin"
		}
	]
}
> 

2.3 修改mongod.conf文件

# vim /etc/mongod.conf

在配置文件中增加如下配置：

security:
  authorization: enabled #启用授权

2.4 重启MongoDB服务器

# service mongod restart
Stopping mongod:                                           [  OK  ]
Starting mongod:                                           [  OK  ]

2.5 重新连接MongoDB并认证

# mongo
> use admin
switched to db admin
> db.auth("root","123456")
1
> 

2.6 创建其他用户并授权

需要注意的是：

• 首先必须用具有权限的账号认证后才能创建其他用户
• 其次，虽然所有用户信息都存在db.system.users表中，但在哪个数据库下创建的用户，连接时，授权数据库就要填该数据库名，不然连不上

下面是分别在admin数据库和test数据库下创建账号并授权：

> use admin
switched to db admin
> db.createUser({user: "abc", pwd: "abc123", roles: [{ role: "readWrite", db: "test" }]})
Successfully added user: {
	"user" : "abc",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
> use test
switched to db test
> db.createUser({user: "zhangsan", pwd: "zs123", roles: [{ role: "readWrite", db: "test" }]})
Successfully added user: {
	"user" : "zhangsan",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "test"
		}
	]
}
>

查看创建的用户信息：

> use admin
switched to db admin
> show tables
system.users
system.version
> db.system.users.find()
{ "_id" : "admin.root", "user" : "root", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "1lN4+lSCsAiqrHyDeF0dDw==", "storedKey" : "lXnNQlYbrwIGzTWU2He8LeMQYUc=", "serverKey" : "qaqpDLrVJiYRIC07WgGmRVrNa3E=" } }, "roles" : [ { "role" : "root", "db" : "admin" } ] }
{ "_id" : "admin.admin", "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "05RUNbdABztBRB9LGwMwaw==", "storedKey" : "p0pQMiSnRZYO5uz27hWGlQcT+lc=", "serverKey" : "M3GPCiWiikAA5I3GZ4n+HXr9AhM=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
{ "_id" : "admin.abc", "user" : "abc", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "QNmh+KkaKmWoMS54eQd7AA==", "storedKey" : "AojS4bCad70kSnszEVcM5uTABV4=", "serverKey" : "cs9vVjzmDSkb1w7j4fNciO8Bbco=" } }, "roles" : [ { "role" : "readWrite", "db" : "test" } ] }
{ "_id" : "test.zhangsan", "user" : "zhangsan", "db" : "test", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "c9MPKA96iQg/L1emr2ogIg==", "storedKey" : "MawJ3vNnfvRfdZiRcuru7Ab2m7o=", "serverKey" : "tv/m7PNVZPt0PXX2uQTdwJl/pAc=" } }, "roles" : [ { "role" : "readWrite", "db" : "test" } ] }
> 

可以看到，abc用户和zhangsan用户的_id分别带了数据库名的，只有在相应的数据库下进行认证才可以。比如：

> use test
switched to db test
> show tables
> db.auth("abc","abc123")
Error: Authentication failed.
0
> use admin
switched to db admin
> db.auth("abc","abc123")
1
> db.auth("zhangsan","zs123")
Error: Authentication failed.
0
> use test
switched to db test
> db.auth("zhangsan","zs123")
1
> 

2.7 客户端连接MongoDB

Java程序连接

//方式一
MongoCredential credential = MongoCredential.createCredential("username", "dbName", "password".toCharArray());
ServerAddress serverAddress = new ServerAddress("192.168.10.242", 27017);
MongoClient mongoClient = new MongoClient(serverAddress, Arrays.asList(credential));
DB db = mongoClient.getDB("dbName");
return db;

//方式二
String sURI = String.format("mongodb://%s:%s@%s:%d/%s", "username", "password", "192.168.10.242", 27017, "dbName"); 
MongoClientURI uri = new MongoClientURI(sURI); 
MongoClient mongoClient = new MongoClient(uri); 
DB db = mongoClient.getDB("dbName");

桌面程序

有些工具不支持3.x版本，使用时需要注意。另外，上面创建的账号加密机制是SCRAM-SHA-1，工具要支持才行，不然需要修改MongoDB的authschema 级别并重新创建账号。[参考]

经验证，Studio 3T for MongoDB 和 NoSQL Manager for MongoDB Professional 都支持SCRAM-SHA-1连接方式，下图是NoSQL Manager for MongoDB Professional的连接设置：