Configure MongoDB with Kerberos Authentication on Windows在Windows上使用Kerberos身份验证配置MongoDB

Start mongod.exe without Kerberos.在不使用Kerberos的情况下启动mongod.exe。

For the initial addition of Kerberos users, start exe without Kerberos support.对于Kerberos用户的初始添加，请在不支持Kerberos的情况下启动exe。

If a Kerberos user is already in MongoDB and has the privileges required to create a user, you can start exe with Kerberos support.如果Kerberos用户已经在MongoDB中，并且具有创建用户所需的权限，则可以使用Kerberos支持启动exe。

Include additional settings as appropriate to your deployment.

Connect to mongod.连接到mongod。

Connect mongosh to the exe instance. 将mongosh连接到exe实例。If exe has --auth enabled, ensure you connect with the privileges required to create a user.

Add Kerberos Principal(s) to MongoDB.将Kerberos主体添加到MongoDB。

Add a Kerberos principal, <username>@<KERBEROS REALM>, to MongoDB in the $external database. Specify the Kerberos realm in ALL UPPERCASE. The $external database allows exe to consult an external source (e.g. Kerberos) to authenticate. To specify the user's privileges, assign roles to the user.

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or x.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或x.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

The following example adds the Kerberos principal reportingapp@EXAMPLE.NET with read-only access to the records database:下面的示例添加了Kerberos主体reportingapp@EXAMPLE.NET以只读方式访问records数据库：

use $external
db.createUser(
   {
     user: "reportingapp@EXAMPLE.NET",
     roles: [ { role: "read", db: "records" } ]
   }
)

Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. 根据需要添加其他主体。对于要使用Kerberos进行身份验证的每个用户，必须在MongoDB中创建相应的用户。For more information about creating and managing users, see User Management Commands.有关创建和管理用户的详细信息，请参阅用户管理命令。

Start mongod.exe with Kerberos support.

You must start exe as the service principal account.

To start exe with Kerberos support, set the exe parameter authenticationMechanisms to GSSAPI:

mongod.exe --setParameter authenticationMechanisms=GSSAPI <additional mongod.exe options>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. For more information, see Localhost Binding Compatibility Changes.

For example, the following starts a standalone exe instance with Kerberos support:

mongod.exe --auth --setParameter authenticationMechanisms=GSSAPI --bind_ip localhost,<hostname(s)|ip address(es)>

Connect mongo.exe shell to mongod.exe and authenticate.

Connect the mongo.exe shell client as the Kerberos principal application@EXAMPLE.NET.

You can connect and authenticate from the command line.

Using cmd.exe:

mongo.exe --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase=$external --username reportingapp@EXAMPLE.NET

Using Windows PowerShell:

mongo.exe --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username reportingapp@EXAMPLE.NET

If you are connecting to a system whose hostname matches the Kerberos name, ensure that you specify the fully qualified domain name (FQDN) for the --host option, rather than an IP address or unqualified hostname.

If you are connecting to a system whose hostname does not match the Kerberos name, first connect mongo.exe to the exe, and then from the mongo.exe shell, use the db.auth() method to authenticate in the $external database.

use $external
db.auth( { mechanism: "GSSAPI", user: "reportingapp@EXAMPLE.NET" } )