Internal/Membership Authentication内部/成员身份验证

Key Requirements密钥要求

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. 密钥的长度必须介于6到1024个字符之间，并且只能包含base64集合中的字符。MongoDB strips whitespace characters (e.g. x0d, x09, and x20) for cross-platform convenience. MongoDB去除空白字符（例如x0d、x09和x20），以便于跨平台使用。As a result, the following operations produce identical keys:因此，以下操作将生成相同的密钥：

echo -e "mysecretkey" > key1
echo -e "my secret key" > key1
echo -e "my secret key\n" > key2
echo -e "my
    secret
    key" > key3
echo -e "my\r\nsecret\r\nkey\r\n" > key4

Keyfile Format

Starting in MongoDB 4.2, keyfiles for internal membership authentication use YAML format to allow for multiple keys in a keyfile. The YAML format accepts content of:从MongoDB 4.2开始，用于内部成员身份验证的密钥文件使用YAML格式，以允许在密钥文件中使用多个密钥。YAML格式接受以下内容：

• a single key string (same as in earlier versions),单个密钥串（与早期版本相同），
• multiple key strings (each string must be enclosed in quotes), or多个键字符串（每个字符串必须括在引号中），或
• sequence of key strings.键字符串的序列。

The YAML format is compatible with the existing single-key keyfiles that use the text file format.YAML格式与使用文本文件格式的现有单键密钥文件兼容。

For example,例如

my old secret key1

'my old secret key1'
'my new secret key2'

- my old secret key1
- my new secret key2

The ability to specify multiple keys in a file allows for the rolling upgrade of the keys without downtime. 在一个文件中指定多个密钥的能力允许在不停机的情况下滚动升级密钥。See Rotate Keys for Replica Sets and Rotate Keys for Sharded Clusters.请参见复制集的旋转关键点和分片群集的旋转关键帧。

All mongod and mongos instances of a deployment must share at least one common key.部署的所有mongod和mongos实例必须至少共享一个公共密钥。

On UNIX systems, the keyfile must not have group or world permissions. 在UNIX系统上，密钥文件不得具有组或世界权限。On Windows systems, keyfile permissions are not checked.在Windows系统上，不检查密钥文件权限。

You must store the keyfile on each server hosting the member of the replica set or sharded clusters.您必须将密钥文件存储在承载副本集或分片集群成员的每个服务器上。

MongoDB Configuration for Keyfile密钥文件的MongoDB配置

To specify the keyfile, use the security.keyFile setting or --keyFile command line option.要指定密钥文件，请使用security.keyFile设置或--keyFile命令行选项。

For an example of keyfile internal authentication, see Update Replica Set to Keyfile Authentication.有关密钥文件内部身份验证的示例，请参阅将副本集更新为密钥文件身份验证。

Member Certificate Requirements会员证书要求

Use member certificates to verify membership to a sharded cluster or a replica set. 使用成员证书验证分片群集或副本集的成员身份。Member certificates are stored in net.tls.clusterFile and net.tls.certificateKeyFile. Member certificate requirements:会员证书要求：

• A single Certificate Authority (CA) must issue all x.509 certificates for the members of a sharded cluster or a replica set.单个证书颁发机构（CA）必须为分片集群或副本集的成员颁发所有x.509证书。

• The x.509 certificate must not be expired.x.509证书不得过期。

  Note注意

  Changed in version 4.4.在版本4.4中更改。

  mongod / mongos logs a warning on connection if the presented x.509 certificate expires within 30 days of the mongod/mongos host system time. See x.509 Certificates Nearing Expiry Trigger Warnings for more information.有关详细信息，请参阅x.509证书接近到期触发警告。

• The Distinguished Name (DN), found in the member certificate's subject, must specify a non-empty value for at least one of the following attributes:

  • the Organization (O)
  • the Organizational Unit (OU)
  • the Domain Component (DC)

• Each cluster member certificate must have identical O s, OU s, and DC s in their net.tls.clusterFile and net.tls.certificateKeyFile certificates. This also applies to the tlsX509ClusterAuthDNOverride value, if set. Attribute order doesn't matter.

  Here's an example. The two DN s below have matching specifications for O and OU, and DC is not specified.

  CN=host1,OU=Dept1,O=MongoDB,ST=NY,C=US
  C=US, ST=CA, O=MongoDB, OU=Dept1, CN=host2

  The following example is incorrect, because the DN s don't match. One DN has two OU specifications and the other has only one OU specification.

  CN=host1,OU=Dept1,OU=Sales,O=MongoDB
  CN=host2,OU=Dept1,O=MongoDB

• Either the Common Name (CN) or one of the Subject Alternative Name (SAN) entries must match the server hostname for other cluster members. Starting in MongoDB 4.2, when comparing SAN s, MongoDB can compare either DNS names or IP addresses. In previous versions, MongoDB only compares DNS names.

  For example, the certificates for a cluster could have the following subject s:

  subject= CN=<myhostname1>,OU=Dept1,O=MongoDB,ST=NY,C=US
  subject= CN=<myhostname2>,OU=Dept1,O=MongoDB,ST=NY,C=US
  subject= CN=<myhostname3>,OU=Dept1,O=MongoDB,ST=NY,C=US

• If the certificate includes the Extended Key Usage (extendedKeyUsage) setting, the value must include clientAuth ("TLS Web Client Authentication").如果证书包含扩展密钥使用（extendedKeyUsage）设置，则该值必须包括clientAuth（“TLS Web客户端身份验证”）。

  extendedKeyUsage = clientAuth

MongoDB ConfigurationMongoDB配置

You can use TLS for internal authentication between each member of your replica set (each mongod instance) or sharded cluster (each mongod and mongos instance).

To use TLS for internal authentication, use the following settings:

• security.clusterAuthMode or --clusterAuthMode set to x509
• net.tls.clusterFile or --tlsClusterFile (available starting in MongoDB 4.2)

mongod and mongos instances use their certificate key files to prove their identity to clients, but certificate key files can also be used for membership authentication. If you do not specify a cluster file, members use their certificate key files for membership authentication. Specify the certificate key file with net.tls.certificateKeyFile or --tlsCertificateKeyFile(available starting in MongoDB 4.2).

To use the certificate key file for both client authentication and membership authentication, the certificate must either:要将证书密钥文件用于客户端身份验证和成员身份验证，证书必须：

• Omit extendedKeyUsage or
• Specify extendedKeyUsage = serverAuth, clientAuth