On this page本页内容
MongoDB Enterprise supports proxying authentication requests to a Lightweight Directory Access Protocol (LDAP) service.支持将身份验证请求代理到轻型目录访问协议（LDAP）服务。
MongoDB supports simple and SASL binding to LDAP servers:MongoDB支持简单和SASL绑定到LDAP服务器：
| Via | |
|---|---|
| |
saslauthd |
|
A full description of LDAP is beyond the scope of this documentation. LDAP的完整描述超出了本文档的范围。This page assumes prior knowledge of LDAP.本页假设您事先了解LDAP。
This documentation only describes MongoDB LDAP authentication, and does not replace other resources on LDAP. 本文档仅描述MongoDB LDAP身份验证，并不替换LDAP上的其他资源。We encourage you to thoroughly familiarize yourself with LDAP and its related subject matter before configuring LDAP authentication.我们鼓励您在配置LDAP身份验证之前彻底熟悉LDAP及其相关主题。
MongoDB can provide professional services for optimal configuration of LDAP authentication for your MongoDB deployment.MongoDB可以为您的MongoDB部署提供优化LDAP身份验证配置的专业服务。
Starting in version 4.2.0, when connecting to the LDAP server for authentication/authorization, MongoDB, by default:从版本4.2.0开始，当连接到LDAP服务器进行身份验证/授权时，默认情况下，MongoDB：
Uses connection pooling if run:如果运行，则使用连接池：
Does not use connection pooling if run:如果运行，则不使用连接池：
To change the connection pooling behavior, update the 要更改连接池行为，请更新ldapUseConnectionPool parameter.ldapUseConnectionPool参数。
saslauthdThe parent directory of the 指定为 saslauthd Unix domain socket file specified to security.sasl.saslauthdSocketPath or --setParameter saslauthdPath must grant read and execute (r-x) permissions for either:security.sasl.saslauthdSocketPath或--setParameter saslauthdPath的saslauthd Unix域套接字文件的父目录必须为以下任一项授予读取和执行（r-x）权限：
mongod or mongos, ormongod或mongos的用户，或The 如果没有对mongod or mongos cannot successfully authenticate via saslauthd without the specified permission on the saslauthd directory and its contents.saslauthd目录及其内容的指定权限，mongod或mongos无法通过saslauthd成功进行身份验证。
libldaplibldap_rFor MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against 对于针对libldap (such as when running on RHEL), access to the libldap is synchronized, incurring some performance/latency costs.libldap链接的MongoDB 4.2（和4.0.9）企业二进制文件（例如在RHEL上运行时），对libldap的访问是同步的，这会带来一些性能/延迟成本。
For MongoDB 4.2 (and 4.0.9) Enterprise binaries linked against 对于针对libldap_r, there is no change in behavior from earlier MongoDB versions.libldap_r链接的MongoDB 4.2（和4.0.9）企业二进制文件，与早期MongoDB版本相比，行为没有变化。
User management requires managing users both on the LDAP server and the MongoDB server. 用户管理需要管理LDAP服务器和MongoDB服务器上的用户。For each user authenticating via LDAP, MongoDB requires a user on the 对于通过LDAP进行身份验证的每个用户，MongoDB要求$external database whose name exactly matches the authentication username. $external数据库上有一个名称与身份验证用户名完全匹配的用户。Changes to a user on the LDAP server may require changes to the corresponding MongoDB 更改LDAP服务器上的用户可能需要更改相应的MongoDB$外部用户。$external user.
To use Client Sessions and Causal Consistency Guarantees with 要对$external authentication users (Kerberos, LDAP, or x.509 users), usernames cannot be greater than 10k bytes.$external 身份验证用户（Kerberos、LDAP或x.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。
A user authenticates as 用户身份验证为sam@dba.example.com. sam@dba.example.com。The MongoDB server binds to the LDAP server and authenticates the user, respecting any username transformations. MongoDB服务器绑定到LDAP服务器并对用户进行身份验证，而不考虑任何用户名转换。On successful authentication, the MongoDB server then checks the 认证成功后，MongoDB服务器将检查$external database for a user sam@dba.example.com and grants the authenticated user the roles and privileges associated to that user.$external数据库中是否有用户sam@dba.example.com并授予认证用户与该用户相关联的角色和权限。
To manage users on the MongoDB server, you must authenticate as an LDAP user whose corresponding MongoDB 要管理MongoDB服务器上的用户，您必须作为LDAP用户进行身份验证，其对应的MongoDB$external user has user administrative privileges on the $external database, such as those provided by userAdmin.$external用户在$external数据库上具有用户管理权限，如userAdmin提供的权限。
If no 如果没有$external users have user administrative privileges on $external database, you cannot perform user management for LDAP authentication. $external用户对$external数据库具有用户管理权限，则无法对LDAP身份验证执行用户管理。This scenario may occur if you configure users prior to enabling LDAP authentication, but do not create the appropriate user administrators.如果您在启用LDAP身份验证之前配置了用户，但未创建相应的用户管理员，则可能会出现这种情况。
If there are existing users not on the 如果存在不在$external database, you must meet the following requirements for each user to ensure continued access:$external数据库上的现有用户，则必须满足每个用户的以下要求，以确保继续访问：
$external database with equivalent roles and privileges$external数据库中，具有同等的角色和权限If you want to continue allowing access by users not on the 如果要继续允许不在$external database, you must configure setParameterauthenticationMechanisms to include SCRAM-SHA-1 and/or SCRAM-SHA-256 as appropriate. $external数据库上的用户访问，则必须将setParameter authenticationMechanisms配置为包括SCRAM-SHA-1和/或SCRAM-SHA-256（视情况而定）。Users must then specify 然后，用户必须在认证时指定--authenticationMechanism SCRAM-SHA-1 or SCRAM-SHA-256 when authenticating.--authenticationMechanism SCRAM-SHA-1或SCRAM-CHA-256。
For replica sets, configure LDAP authentication on secondary and arbiter members first before configuring the primary. 对于副本集，在配置主成员之前，先在辅助成员和 仲裁器成员上配置LDAP身份验证。This also applies to shard replica sets, or config server replica sets. 这也适用于分片副本集或配置服务器副本集。Configure one replica set member at a time to maintain a majority of members for write availability.一次配置一个副本集成员，以保持大多数成员的写可用性。
In sharded clusters, you must configure LDAP authentication on the config servers and each 在分片集群中，必须为集群级用户在配置服务器和每个mongos for cluster-level users. mongos上配置LDAP身份验证。You can optionally configure LDAP authorization on each shard for shard-local users.您可以选择为分片本地用户在每个分片上配置LDAP授权。
The LDAP authentication via OS libraries process is summarized below:通过操作系统库进行LDAP身份验证的过程总结如下：
security.ldap.userToDNMapping setting.security.ldap.userToDNMapping设置应用转换。MongoDB binds to an LDAP server specified in MongoDB使用提供的用户名或转换后的用户名绑定到security.ldap.servers using the provided username or, if a transformation was applied, the transformed username.security.ldap.servers中指定的LDAP服务器。
MongoDB uses simple binding by default, but can also use MongoDB默认使用简单绑定，但如果在sasl binding if configured in security.ldap.bind.method and security.ldap.bind.saslMechanisms.security.ldap.bind.method和security.ldap.bind.saslMechanisms中配置，也可以使用sasl绑定。
If a transformation requires querying the LDAP server, or if the LDAP server disallows anonymous binds, MongoDB uses the username and password specified to 如果转换需要查询LDAP服务器，或者LDAP服务器不允许匿名绑定，MongoDB将使用指定给security.ldap.bind.queryUser and security.ldap.bind.queryPassword to bind to the LDAP server before attempting to authenticate the provided user credentials.security.ldap.bind.queryUser和security.ldap.bind.queryPassword密码的用户名和密码绑定到LDAP服务器，然后尝试验证提供的用户凭据。
$external database, assigning the user any roles or privileges associated to a matching user. $external数据库上的用户，并为该用户分配与匹配用户关联的任何角色或权限。To use LDAP for authentication via operating system libraries, specify the following settings as a part of your 要通过操作系统库使用LDAP进行身份验证，请在mongod or mongos configuration file:mongod或mongos配置文件中指定以下设置：
security.ldap.servers | host[:port] format.host[:port]格式。 | |
security.ldap.bind.method |
| sasl for binding to the LDAP server.sasl绑定到LDAP服务器。 |
security.ldap.bind.saslMechanisms |
| method to sasl and you need different or additional SASL mechanisms.method设置为sasl，并且您需要不同或附加的sasl机制。 |
security.ldap.bind.queryUser |
| userToDNMapping transformation, or if the LDAP server's security settings disallow anonymous binds.userToDNMapping转换的一部分，或者LDAP服务器的安全设置不允许匿名绑定。 |
security.ldap.bind.queryPassword | queryUser.queryUser时用于验证LDAP服务器的密码。 | queryUser.queryUser。 |
security.ldap.bind.useOSDefaults | queryUser and queryPassword for authenticating or binding as when connecting to the LDAP server.queryUser和queryPassword进行身份验证或绑定，就像连接到LDAP服务器一样。 | queryUser and queryPassword.queryUser和queryPassword。 |
security.ldap.userToDNMapping |
|
saslauthdsaslauthd进行LDAP身份验证MongoDB Enterprise for Windows does not support binding via MongoDB Enterprise for Windows不支持通过saslauthd.saslauthd绑定。
saslauthd daemon.saslauthd守护进程绑定到LDAP服务器。saslauthd and the LDAP server. saslauthd和LDAP服务器之间使用安全加密或可信连接。SASL PLAIN mechanism, sending and receiving data in plain text. To configure the MongoDB server to bind to the LDAP server using via 要将MongoDB服务器配置为使用via saslauthd, start the mongod using either the following command line options or the following configuration file settings:saslauthd绑定到LDAP服务器，请使用以下命令行选项或以下配置文件设置启动mongod：
--auth to enable access control,
--setParameter with the authenticationMechanisms set to PLAIN, and
--setParameter with the saslauthdPath parameter set to the path to the Unix-domain Socket of the saslauthd instance. Specify an empty string "" to use the default Unix-domain socket path.
Include any other command line options required for your deployment. For complete documentation on mongod command line options, see mongod.
security.authorization set to enabled,
setParameter with the authenticationMechanisms parameter set to PLAIN, and
setParameter with the saslauthdPath set to the path to the Unix-domain Socket of the saslauthd instance. Specify an empty string "" to use the default Unix-domain socket path.
Include any other configuration file settings required for your deployment. For complete documentation on configuration files, see YAML configuration file.
You need to create or update the 您需要使用适合LDAP服务器的参数创建或更新saslauthd.conf file with the parameters appropriate for your LDAP server. saslauthd.conf文件。Documenting 记录saslauthd.conf is out of scope for this documentation.saslauthd.conf超出了本文档的范围。
The parent directory of the 指定为saslauthd Unix domain socket file specified to security.sasl.saslauthdSocketPath or --setParameter saslauthdPath must grant read and execute (r-x) permissions for either:security.sasl.saslauthdSocketPath或--setParameter saslauthdPath的saslauthd Unix域套接字文件的父目录必须为以下任一项授予读取和执行（r-x）权限：
mongod or mongos, ormongod或mongos，或者The 如果没有对mongod or mongos cannot successfully authenticate via saslauthd without the specified permission on the saslauthd directory and its contents.saslauthd目录及其内容的指定权限，mongod或mongos无法通过saslauth成功进行身份验证。
The following tutorials provide basic information on configuring 以下教程提供了有关配置saslauthd.conf to work with two popular LDAP services:saslauthd.conf以使用两种流行的LDAP服务的基本信息：
Please see the documentation for 请参阅saslauthd as well as your specific LDAP service for guidance.saslauthd的文档以及您的特定LDAP服务以获取指导。
To authenticate to a MongoDB server via LDAP authentication, use 要通过LDAP身份验证对MongoDB服务器进行身份验证，请在db.auth() on the $external database with the following parameters:$external数据库上使用db.auth()，参数如下：
username | |
password | |
mechanism | PLAIN.PLAIN。 |