Enterprise Authentication Mechanisms企业身份验证机制

Kerberos (GSSAPI/SSPI)

The GSSAPI authentication mechanism uses your user principal to authenticate to a Kerberos service.GSSAPI身份验证机制使用用户主体对Kerberos服务进行身份验证。

You can specify this authentication mechanism by performing the following actions while specifying options on your connection string:您可以通过在连接字符串上指定选项的同时执行以下操作来指定此身份验证机制：

• Set the authMechanism parameter to GSSAPI.将authMechanism参数设置为GSSAPI。
• Set the SERVICE_NAME value in the authMechanismProperties parameter if using a value other than mongodb.如果使用mongodb以外的值，请在authMechanismProperties参数中设置SERVICE_NAME值。
• Specify a SERVICE_REALM value in the authMechanismProperties parameter if a custom service realm is required.如果需要自定义服务领域，请在authMechanismProperties参数中指定SERVICE_REALM值。
• Specify a CANONICALIZE_HOST_NAME value in the authMechanismProperties parameter if canonicalization of the hostname is required. 如果需要对主机名进行规范化，请在authMechanismProperties参数中指定CANONICALIZE_HOST_NAME值。This property can take the following values:此属性可以采用以下值：
  • none: (Default) Does not perform hostname canonicalization：（默认值）不执行主机名规范化
  • forward: Performs a forward DNS lookup to canonicalize the hostname：执行正向DNS查找以规范化主机名
  • forwardAndReverse: Performs a forward DNS lookup and then a reverse lookup on that value to canonicalize the hostname：对该值执行正向DNS查找，然后执行反向查找以规范化主机名

The following code sample authenticates to Kerberos for UNIX using GSSAPI.以下代码示例使用GSSAPI对Kerberos for UNIX进行身份验证。

const { MongoClient } = require("mongodb");

// specify the placeholder values for your environment in the following lines在以下行中指定环境的占位符值
const clusterUrl = "<MongoDB cluster URL>";
const principal = encodeURIComponent("<Kerberos principal and realm>");
const serviceRealm = "<Kerberos service realm>";
const canonicalizationSetting = "<canonicalization setting>";
const authMechanismProperties = `SERVICE_REALM:${serviceRealm},CANONICALIZE_HOST_NAME:${canonicalizationSetting}`;

const authMechanism = "GSSAPI";

// Connection URI连接URI
const uri = `mongodb+srv://${principal}@${clusterUrl}/?authMechanism=${authMechanism}&authMechanismProperties=${authMechanismProperties}`;

const client = new MongoClient(uri);

// Function to connect to the server用于连接到服务器的函数
async function run() {
  try {
    // Establish and verify connection建立并验证连接
    await client.db("admin").command({ ping: 1 });
    console.log("Connected successfully to server");
  } finally {
    // Ensures that the client will close when you finish/error确保客户端在您完成/出错时关闭
    await client.close();
  }
}
run().catch(console.dir);

LDAP (PLAIN)

The PLAIN authentication mechanism uses your username and password to authenticate to a Lightweight Directory Access Protocol (LDAP) server.PLAIN身份验证机制使用您的用户名和密码对轻型目录访问协议（LDAP）服务器进行身份验证。

You can specify this authentication mechanism by setting the authMechanism parameter to PLAIN and including your LDAP username and password in the connection string as shown in the following sample code.您可以通过将authMechanism参数设置为PLAIN并在连接字符串中包含LDAP用户名和密码来指定此身份验证机制，如以下示例代码所示

const { MongoClient } = require("mongodb");

// specify the placeholder values for your environment in the following lines在以下行中指定环境的占位符值
const clusterUrl = "<MongoDB cluster URL>";
const ldapUsername = "<LDAP username>";
const ldapPassword = "<LDAP password>";
const authMechanism = "PLAIN";

// Connection URI
const uri = `mongodb+srv://${ldapUsername}:${ldapPassword}@${clusterUrl}/?authMechanism=${authMechanism}`;

const client = new MongoClient(uri);

// Function to connect to the server用于连接到服务器的函数
async function run() {
  try {
    // Establish and verify connection建立并验证连接
    await client.db("admin").command({ ping: 1 });
    console.log("Connected successfully to server");
  } finally {
    // Ensures that the client will close when you finish/error确保客户端在您完成/出错时关闭
    await client.close();
  }
}
run().catch(console.dir);