MongoDB 用户角色授权与AUTH启用

MongoDB中几种常用用户角色：

dbDao 百度贴吧：http://tieba.baidu.com/dbdao

MongoDB技术学习QQ群： 421431253

dbAdmin 在db范围内包括下面的权限：

• collStats
• dbHash
• dbStats
• find
• killCursors
• listIndexes
• listCollections
• dropCollection 和 createCollection on system.profile only

userAdmin在db范围内包括如下权限：

• changeCustomData
• changePassword
• createRole
• createUser
• dropRole
• dropUser
• grantRole
• revokeRole
• viewRole
• viewUser

readAnyDatabase  对所有数据库中的collection可读，同时包含listDatabases权限

readWriteAnyDatabase  对所有数据库中的collection可读且可写，同时包含listDatabases权限

userAdminAnyDatabase 对所有数据库拥有userAdmin角色，同时包含listDatabases权限

dbAdminAnyDatabase 对所有数据库拥有dbAdmin角色，同时包含listDatabases权限

cluster相关的权限  clusterMonitor、hostManager、clusterManager、clusterAdmin

root权限， 包含 readWriteAnyDatabase, dbAdminAnyDatabase, userAdminAnyDatabase 和 clusterAdmin 等角色。 但不能访问system. 开头的collection(root does not include any access to collections that begin with the system. prefix.)

__system 超级角色

相关官方文档：http://docs.mongodb.org/manual/reference/built-in-roles/#__system

__system包含下面这些权限：

> use admin
switched to db admin
> db.createUser(
...   {
...     user: "maclean_dbdao2",
...     pwd: "maclean_dbdao2",
...     roles: [ { role: "__system", db: "admin" } ]
...   }
... )
Successfully added user: {
	"user" : "maclean_dbdao2",
	"roles" : [
		{
			"role" : "__system",
			"db" : "admin"
		}
	]
}
> 
> 
> 
bye
10:~ maclean$ mongo localhost:35002/admin -u maclean_dbdao2  -p
MongoDB shell version: 3.0.2
Enter password: 
connecting to: localhost:35002/admin
> show roles
{
	"role" : "__system",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "backup",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "clusterAdmin",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "clusterManager",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "clusterMonitor",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "dbAdmin",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "dbAdminAnyDatabase",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "dbOwner",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "hostManager",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "read",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "readAnyDatabase",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "readWrite",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "readWriteAnyDatabase",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "restore",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "root",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "userAdmin",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}
{
	"role" : "userAdminAnyDatabase",
	"db" : "admin",
	"isBuiltin" : true,
	"roles" : [ ],
	"inheritedRoles" : [ ]
}


mongodb 3.0中db.getUsers() 获得db中的用户信息


> db.getUsers();
[
	{
		"_id" : "admin.maclean",
		"user" : "maclean",
		"db" : "admin",
		"roles" : [
			{
				"role" : "userAdminAnyDatabase",
				"db" : "admin"
			}
		]
	},
	{
		"_id" : "admin.maclean1",
		"user" : "maclean1",
		"db" : "admin",
		"roles" : [
			{
				"role" : "__system",
				"db" : "admin"
			}
		]
	},
	{
		"_id" : "admin.maclean_dbdao2",
		"user" : "maclean_dbdao2",
		"db" : "admin",
		"roles" : [
			{
				"role" : "__system",
				"db" : "admin"
			}
		]
	}
]

启用mongodb授权认证的方法：

1、以–auth 启动mongod

2、在配置文件mongod.conf 中加入 auth = true

第一次启用–auth时会出现：

2015-05-13T11:20:22.296+0800 I ACCESS [conn1] note: no users configured in admin.system.users, allowing localhost access

2015-05-13T11:20:22.297+0800 I ACCESS [conn1] Unauthorized not authorized on admin to execute command { getLog: “startupWarnings” }

2015-05-13T12:07:08.680+0800 I INDEX [conn1] build index on: admin.system.users properties: { v: 1, unique: true, key: { user: 1, db: 1 }, name: “user_1_db_1″, ns: “admin.system.users” }

即之前未定义过用户，所以mongod将允许本地直接访问

mongo 登陆后 创建一个合适的超级用户

use admin
db.createUser(
  {
    user: "maclean",
    pwd: "maclean",
    roles: [ { role: "__system", db: "admin" } ]
  }
)

http://docs.mongodb.org/manual/reference/method/db.createUser/

给一个用户授权 ：

use admin
db.grantRolesToUser(
  "macleanz",
  [
    { role: "readAnyDatabase", db:"admin" }
  ]
)


http://docs.mongodb.org/manual/tutorial/assign-role-to-user/

启用replica set 时需要做的授权：

use admin
db.createUser( {
	user: "siteUserAdmin",
	pwd: "",
	roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  });
db.createUser( {
	user: "siteRootAdmin",
	pwd: "",
	roles: [ { role: "root", db: "admin" } ]
  });
http://docs.mongodb.org/manual/tutorial/deploy-replica-set-with-auth/

相关文章 | Related posts:

1. MongoDB Aggregation聚集测试 dbDao 百度贴吧：http://tieba.baidu.com/dbdao MongoDB技术学习QQ群： […]...
2. MongoDB 配置Sharding Cluster 基于Ubuntu 本教程基于Ubuntu 14.04.2 LTS \n \l和mongoDB 3.0， 配置了3个 Config […]...
3. 12c Pluggable Database Container Database权限与角色管理     oracle@localhost:~$ oerr ora 65050 65050, […]...
4. MongoDB BSONObj size is invalid错误一例 dbDao 百度贴吧：http://tieba.baidu.com/dbdao MongoDB技术学习QQ群： […]...
5. MongoDB db.collection.remove()方法 mongodb中删除document采用remove方法， http://docs.mongodb.org/m […]...
6. MongoDB $unset重置某个field 对于已经有值的field，在mongodb中可以使用$unset操作符来重置该field。 http://do […]...
7. MongoDB获取命令行启动参数getCmdLineOpts MongoDB获取命令行启动参数的方法; 有时候希望知道启动mongd的启动参数，可以使用如下命令获得： db […]...
8. MongoDB _id Key的一些信息 关于 mongodb _id key: _id key可以用户分配，也可以由mongodb自动分配，一般采用自 […]...
9. MongoDB中的unique constraint/index Mongodb中可以使用ensureIndex/createIndex+unique:true来创建uniqu […]...
10. MongoDB db.collection. ensureIndex 和 db.collection.createIndex 注意从mongoDB 3.0开始ensureIndex被废弃，今后都仅仅是db.collection.crea […]...

原文地址：http://www.tuicool.com/articles/fMZbUzu