Kerberos (GSSAPI) Authentication MechanismKerberos(GSSAPI)身份验证机制

Overview概述

The Generic Security Services API (GSSAPI) authentication mechanism allows you to use your principal name to authenticate to a Kerberos service. You can use this mechanism only when authenticating to MongoDB Enterprise Advanced.通用安全服务API(GSSAPI)身份验证机制允许您使用主体名称对Kerberos服务进行身份验证。您只能在向MongoDB Enterprise Advanced进行身份验证时使用此机制。

Specify Kerberos (GSSAPI) Authentication指定Kerberos(GSSAPI)身份验证

The GSSAPI authentication mechanism uses your user principal to authenticate to a Kerberos service.GSSAPI身份验证机制使用您的用户主体对Kerberos服务进行身份验证。

You can specify this authentication mechanism by performing the following actions while specifying options on your connection string:您可以通过在连接字符串上指定选项时执行以下操作来指定此身份验证机制：

• Set the authMechanism parameter to GSSAPI.将authMechanism参数设置为GSSAPI。
• Set the SERVICE_NAME value in the authMechanismProperties parameter if using a value other than mongodb.如果使用mongodb以外的值，请在authMechanismProperties参数中设置SERVICE_NAME值。
• Specify a SERVICE_REALM value in the authMechanismProperties parameter if a custom service realm is required.如果需要自定义服务领域，请在authMechanismProperties参数中指定SERVICE_REALM值。

• Specify a CANONICALIZE_HOST_NAME value in the authMechanismProperties parameter if canonicalization of the hostname is required. This property accepts the following values:如果需要规范化主机名，请在authMechanismProperties参数中指定CANONICALIZE_HOST_NAME值。此属性接受以下值：

  • none: (Default) Does not perform hostname canonicalization：（默认）不执行主机名规范化
  • forward: Performs a forward DNS lookup to canonicalize the hostname：执行正向DNS查找以规范主机名
  • forwardAndReverse: Performs a forward DNS lookup and then a reverse lookup on that value to canonicalize the hostname：对该值执行正向DNS查找，然后进行反向查找，以规范主机名

The following code example authenticates to Kerberos for UNIX using GSSAPI.以下代码示例使用GSSAPI对UNIX的Kerberos进行身份验证。

const { MongoClient } = require("mongodb");

// Replace the placeholder values with the values for your environment in the following lines用以下行中的环境值替换占位符值
const clusterUrl = "<cluster_url>";
const principal = encodeURIComponent("<Kerberos principal and realm>");
const serviceRealm = "<Kerberos service realm>";
const canonicalizationSetting = "<canonicalization setting>";
const authMechanismProperties = `SERVICE_REALM:${serviceRealm},CANONICALIZE_HOST_NAME:${canonicalizationSetting}`;

const authMechanism = "GSSAPI";

// Connection URI连接URI
const uri = `mongodb+srv://${principal}@${clusterUrl}/?authMechanism=${authMechanism}&authMechanismProperties=${authMechanismProperties}`;

const client = new MongoClient(uri);

// Function to connect to the server连接到服务器的功能
async function run() {
  try {
    // Establish and verify connection
    await client.db("admin").command({ ping: 1 });
    console.log("Connected successfully to server");
  } finally {
    // Ensures that the client will close when you finish/error确保客户端在您完成/出错时关闭
    await client.close();
  }
}
run().catch(console.dir);

API Documentation文档

To learn more about any of the methods or types discussed on this page, see the following API documentation:要了解有关本页中讨论的任何方法或类型的更多信息，请参阅以下API文档：

• MongoClient