Use SCRAM to Authenticate Clients使用SCRAM对客户端进行身份验证

Start MongoDB without access control在没有访问控制的情况下启动MongoDB

Start a standalone mongod instance without access control.启动一个没有访问控制的独立mongod实例。

Open a terminal and run the following command as the mongod user:打开终端，以mongod用户身份运行以下命令：

mongod --port 27017 --dbpath /var/lib/mongodb

The mongod instance in this tutorial uses port 27017 and the /var/lib/mongodb data directory.本教程中的mongod实例使用端口port 27017和/var/lib/mongodb数据目录。

The tutorial assumes that the /var/lib/mongodb directory exists and is the default dbPath. 本教程假设/var/lib/mongodb目录存在，并且是默认的dbPath。You may specify a different data directory or port as needed.您可以根据需要指定不同的数据目录或端口。

Connect to the instance连接到实例

Open a new terminal and connect to the database deployment with mongosh:打开一个新终端并使用mongosh连接到数据库部署：

mongosh --port 27017

If you are connecting to a different deployment, specify additional command line options, such as --host, as needed to connect.如果要连接到其他部署，请根据需要指定其他命令行选项，如--host。

Create the user administrator创建用户管理员

Using mongosh:使用mongosh：

1. switch to the admin database切换到admin数据库
2. add the myUserAdmin user with the userAdminAnyDatabase and readWriteAnyDatabase roles":添加具有userAdminAnyDatabase和readWriteAnyDatabase角色的myUserAdmin用户：

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [
      { role: "userAdminAnyDatabase", db: "admin" },
      { role: "readWriteAnyDatabase", db: "admin" }
    ]
  }
)

The userAdminAnyDatabase role allows this user to:userAdminAnyDatabase角色允许此用户：

• create users创建用户
• grant or revoke roles from users从用户授予或撤销角色
• create or modify customs roles创建或修改自定义角色

You can assign your user additional built-in roles or user-defined roles as needed.您可以根据需要为用户分配其他内置角色或用户定义的角色。

The database where you create the user, in this example admin, is the user's authentication database. 创建用户的数据库（在本例中为admin）是用户的身份验证数据库。Although the user needs to authenticate to this database, the user can have roles in other databases. 虽然用户需要对此数据库进行身份验证，但用户可以在其他数据库中拥有角色。The user's authentication database doesn't limit the user's privileges.用户的身份验证数据库不限制用户的权限。

Re-start the MongoDB instance with access control使用访问控制重新启动MongoDB实例

Shut down the mongod instance. 关闭mongod实例。Using mongosh, issue the following command:使用mongosh，发出以下命令：

db.adminCommand( { shutdown: 1 } )

Exit mongosh.退出mongosh。

Start the mongod with access control enabled.在启用访问控制的情况下启动mongod。

• If you start the mongod from the command line, add the --auth command line option:如果从命令行启动mongod，请添加--auth命令行选项：

  mongod --auth --port 27017 --dbpath /var/lib/mongodb

• If you start the mongod using a configuration file, add the security.authorization configuration file setting:如果使用配置文件启动mongod，请添加security.authorization配置文件设置：

  security:
      authorization: enabled

Clients that connect to this instance must now authenticate themselves and can only perform actions as determined by their assigned roles.连接到此实例的客户端现在必须对自己进行身份验证，并且只能执行由其分配的角色确定的操作。

Connect and authenticate as the user administrator作为用户管理员进行连接和身份验证

Using mongosh, you can:使用mongosh，您可以：

mongosh --port 27017  --authenticationDatabase \
    "admin" -u "myUserAdmin" -p

mongosh --port 27017

use admin
db.auth("myUserAdmin", passwordPrompt()) // or cleartext password