21.29 mongodb用户管理-CSDN博客

2019独角兽企业重金招聘Python工程师标准>>>

21.29 mongodb用户管理

use admin//需要切换到admin库
db.createUser( { user: "admin", customData: {description: "superuser"}, pwd: "admin122", roles: [ { role: "root", db: "admin" } ] } )
user指定用户，customData为说明字段，可以省略，pwd为密码，roles指定用户的角色，db指定库名
use admin //切换到admin库
db.system.users.find() //列出所有用户，需要切换到admin库
show users //查看当前库下所有的用户
db.dropUser('admin') //删除用户
若要用户生效，还需要编辑启动脚本vim /usr/lib/systemd/system/mongod.service,在OPTIONS=后面增--auth
重启服务systemctl restart mongod
mongo -u "admin" -p "admin122" --authenticationDatabase "admin"

[root@Dasoncheng src]# mongo
MongoDB shell version v3.4.9
connecting to: mongodb://127.0.0.1:27017
MongoDB server version: 3.4.9
> use admin    ##需要切换到admin库里面才能创建用户；切换到库才能创建用户（用户针对库）
switched to db admin
> db.createUser( { user: "admin", customData: {description: "superuser"}, pwd: "admin122", roles: [ { role: "root", db: "admin" } ] } )  
##user: "admin"  //用户名
##customData: {description: "superuser"}  //描述，可不要
##pwd: "admin122" //密码
##roles:  //角色，里面又包含了两个键值对；role: "root"角色是root、db: "admin"针对的是admin库；
Successfully added user: {
	"user" : "admin",
	"customData" : {
		"description" : "superuser"
	},
	"roles" : [
		{
			"role" : "root",
			"db" : "admin"
		}
	]
}
> db.system.users.find()  
{ "_id" : "admin.admin", "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "Z69r/apOkJK2zq56nktG3w==", "storedKey" : "vpka49IDqjDTb7tFeRK+YqyCmvA=", "serverKey" : "NNcnjtMeXqmn6SOVspyHtKz/mqU=" } }, "customData" : { "description" : "superuser" }, "roles" : [ { "role" : "root", "db" : "admin" } ] }
> db.createUser({user:"aming",pwd:"p@ssw0rd",roles:[{role:"read",db:"testdb"}]})
##创建用户aming 并设为只读；
Successfully added user: {
	"user" : "aming",
	"roles" : [
		{
			"role" : "read",
			"db" : "testdb"
		}
	]
}
> show users   ##查看用户，已经包含了aming
{
	"_id" : "admin.admin",
	"user" : "admin",
	"db" : "admin",
	"customData" : {
		"description" : "superuser"
	},
	"roles" : [
		{
			"role" : "root",
			"db" : "admin"
		}
	]
}
{
	"_id" : "admin.aming",
	"user" : "aming",
	"db" : "admin",
	"roles" : [
		{
			"role" : "read",
			"db" : "testdb"
		}
}
> db.dropUser('aming')    ##删除用户aming
true
> use testdb   ##切换库，若库不存在 则创建！
switched to db testdb
> show users   ##无法查看用户，在哪个库里面创建的用户 就去哪个库查看；
> use admin
switched to db admin
> show users
{
	"_id" : "admin.admin",
	"user" : "admin",
	"db" : "admin",
	"customData" : {
		"description" : "superuser"
	},
	"roles" : [
		{
			"role" : "root",
			"db" : "admin"
		}
	]
}

如果要使创建的用户生效，则需要编辑启动脚本：
vim /usr/lib/systemd/system/mongod.service 在OPTIONS=后面增--auth

[root@Dasoncheng src]# vim /usr/lib/systemd/system/mongod.service
Environment="OPTIONS=--auth -f /etc/mongod.conf"
……
[root@Dasoncheng src]# systemctl restart mongod
Warning: mongod.service changed on disk. Run 'systemctl daemon-reload' to reload units.
##看清楚提示！
[root@Dasoncheng src]# systemctl daemon-reload
[root@Dasoncheng src]# systemctl restart mongod
[root@Dasoncheng src]# ps aux |grep mongo
mongod    39100  7.4  3.5 972180 35668 ?        Sl   18:53   0:01 /usr/bin/mongod --auth -f /etc/mongod.conf
##进程这里多了一个--auth验证，用户才会生效
root      39125  0.0  0.0 112664   968 pts/1    S+   18:53   0:00 grep --color=auto mongo
[root@Dasoncheng src]# mongo --host 192.168.60.11 --port 27017 -u admin -p 'admin122' --authenticationDatabase "admin"  
##登录；
MongoDB shell version v3.4.9
connecting to: mongodb://192.168.60.11:27017/
MongoDB server version: 3.4.9
> use admin
switched to db admin
> show users
{
	"_id" : "admin.admin",
	"user" : "admin",
	"db" : "admin",
	"customData" : {
		"description" : "superuser"
	},
	"roles" : [
		{
			"role" : "root",
			"db" : "admin"
		}
	]
}

权限说明：

use db1
db.createUser( { user: "test1", pwd: "123aaa", roles: [ { role: "readWrite", db: "db1" }, {role: "read", db: "db2" } ] } )
test1用户对db1库读写，对db2库只读。
之所以先use db1,表示用户在 db1 库中创建，就一定要db1库验证身份，即用户的信息跟随随数据库。比如上述 test1虽然有 db2 库的读取权限，但是一定要先在db1库进行身份验证，直接访问会提示验证失败。
use db2
db.auth("test1", "123aaa")

> use db1
switched to db db1
> db.createUser( { user: "test1", pwd: "123aaa", roles: [ { role: "readWrite", db: "db1" }, {role: "read", db: "db2" } ] } )
Successfully added user: {
	"user" : "test1",
	"roles" : [
		{
			"role" : "readWrite",
			"db" : "db1"
		},
		{
			"role" : "read",
			"db" : "db2"
		}
	]
}
> use db2
switched to db db2
> db.auth('test1','123aaa')
Error: Authentication failed.
0
> use db1    ##只有先在db1里面验证身份之后，才能对db2有该有的权限；
switched to db db1
> db.auth('test1','123aaa')
1