MongoDB 用户角色授权与AUTH启用

MongoDB中几种常用用户角色：

dbDao 百度贴吧：http://tieba.baidu.com/dbdao

MongoDB技术学习QQ群： 421431253

dbAdmin 在db范围内包括下面的权限：

collStatsdbHashdbStatsfindkillCursorslistIndexeslistCollectionsdropCollection 和 createCollection on system.profile only

userAdmin在db范围内包括如下权限：

changeCustomDatachangePasswordcreateRolecreateUserdropRoledropUsergrantRolerevokeRoleviewRoleviewUser

readAnyDatabase  对所有数据库中的collection可读，同时包含listDatabases权限

readWriteAnyDatabase  对所有数据库中的collection可读且可写，同时包含listDatabases权限

userAdminAnyDatabase 对所有数据库拥有userAdmin角色，同时包含listDatabases权限

dbAdminAnyDatabase 对所有数据库拥有dbAdmin角色，同时包含listDatabases权限

cluster相关的权限  clusterMonitor、hostManager、clusterManager、clusterAdmin

root权限， 包含 readWriteAnyDatabase, dbAdminAnyDatabase, userAdminAnyDatabase 和 clusterAdmin 等角色。 但不能访问system. 开头的collection(root does not include any access to collections that begin with the system. prefix.)

__system 超级角色

相关官方文档：http://docs.mongodb.org/manual/reference/built-in-roles/#__system

__system包含下面这些权限：

> use admin switched to db admin > db.createUser( ... { ... user: "maclean_dbdao2", ... pwd: "maclean_dbdao2", ... roles: [ { role: "__system", db: "admin" } ] ... } ... ) Successfully added user: { "user" : "maclean_dbdao2", "roles" : [ { "role" : "__system", "db" : "admin" } ] } > > > bye 10:~ maclean$ mongo localhost:35002/admin -u maclean_dbdao2 -p MongoDB shell version: 3.0.2 Enter password: connecting to: localhost:35002/admin > show roles { "role" : "__system", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "backup", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "clusterAdmin", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "clusterManager", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "clusterMonitor", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "dbAdmin", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "dbAdminAnyDatabase", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "dbOwner", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "hostManager", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "read", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "readAnyDatabase", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "readWrite", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "readWriteAnyDatabase", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "restore", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "root", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "userAdmin", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } { "role" : "userAdminAnyDatabase", "db" : "admin", "isBuiltin" : true, "roles" : [ ], "inheritedRoles" : [ ] } mongodb 3.0中db.getUsers() 获得db中的用户信息 > db.getUsers(); [ { "_id" : "admin.maclean", "user" : "maclean", "db" : "admin", "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }, { "_id" : "admin.maclean1", "user" : "maclean1", "db" : "admin", "roles" : [ { "role" : "__system", "db" : "admin" } ] }, { "_id" : "admin.maclean_dbdao2", "user" : "maclean_dbdao2", "db" : "admin", "roles" : [ { "role" : "__system", "db" : "admin" } ] } ]

启用mongodb授权认证的方法：

1、以–auth 启动mongod

2、在配置文件mongod.conf 中加入 auth = true

第一次启用–auth时会出现：

2015-05-13T11:20:22.296+0800 I ACCESS [conn1] note: no users configured in admin.system.users, allowing localhost access

2015-05-13T11:20:22.297+0800 I ACCESS [conn1] Unauthorized not authorized on admin to execute command { getLog: “startupWarnings” }

2015-05-13T12:07:08.680+0800 I INDEX [conn1] build index on: admin.system.users properties: { v: 1, unique: true, key: { user: 1, db: 1 }, name: “user_1_db_1″, ns: “admin.system.users” }

即之前未定义过用户，所以mongod将允许本地直接访问

mongo 登陆后 创建一个合适的超级用户

use admin db.createUser( { user: "maclean", pwd: "maclean", roles: [ { role: "__system", db: "admin" } ] } ) http://docs.mongodb.org/manual/reference/method/db.createUser/

给一个用户授权 ：

use admin db.grantRolesToUser( "macleanz", [ { role: "readAnyDatabase", db:"admin" } ] ) http://docs.mongodb.org/manual/tutorial/assign-role-to-user/

启用replica set 时需要做的授权：

use admin db.createUser( { user: "siteUserAdmin", pwd: "", roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] }); db.createUser( { user: "siteRootAdmin", pwd: "", roles: [ { role: "root", db: "admin" } ] }); http://docs.mongodb.org/manual/tutorial/deploy-replica-set-with-auth/

相关文章 | Related posts:

MongoDB Aggregation聚集测试 dbDao 百度贴吧：http://tieba.baidu.com/dbdao MongoDB技术学习QQ群： […]...MongoDB 配置Sharding Cluster 基于Ubuntu 本教程基于Ubuntu 14.04.2 LTS \n \l和mongoDB 3.0， 配置了3个 Config […]...12c Pluggable Database Container Database权限与角色管理     oracle@localhost:~$ oerr ora 65050 65050, […]...MongoDB BSONObj size is invalid错误一例 dbDao 百度贴吧：http://tieba.baidu.com/dbdao MongoDB技术学习QQ群： […]...MongoDB db.collection.remove()方法 mongodb中删除document采用remove方法， http://docs.mongodb.org/m […]...MongoDB $unset重置某个field 对于已经有值的field，在mongodb中可以使用$unset操作符来重置该field。 http://do […]...MongoDB获取命令行启动参数getCmdLineOpts MongoDB获取命令行启动参数的方法; 有时候希望知道启动mongd的启动参数，可以使用如下命令获得： db […]...MongoDB _id Key的一些信息 关于 mongodb _id key: _id key可以用户分配，也可以由mongodb自动分配，一般采用自 […]...MongoDB中的unique constraint/index Mongodb中可以使用ensureIndex/createIndex+unique:true来创建uniqu […]...MongoDB db.collection. ensureIndex 和 db.collection.createIndex 注意从mongoDB 3.0开始ensureIndex被废弃，今后都仅仅是db.collection.crea […]...

原文地址：http://www.tuicool.com/articles/fMZbUzu