Configure MongoDB with Kerberos Authentication on Linux在Linux上使用Kerberos身份验证配置MongoDB

Start mongod without Kerberos.在没有Kerberos的情况下启动mongod。

For the initial addition of Kerberos users, start mongod without Kerberos support.对于Kerberos用户的初始添加，请在不支持Kerberos的情况下启动mongod。

If a Kerberos user is already in MongoDB and has the privileges required to create a user, you can start mongod with Kerberos support.如果Kerberos用户已经在MongoDB中，并且具有创建用户所需的权限，则可以使用Kerberos支持启动mongod。

Include additional settings as appropriate to your deployment.包括适合您的部署的其他设置。

Connect to mongod.连接到mongod。

Connect mongosh to the mongod instance. 将mongosh连接到mongod实例。If mongod has --auth enabled, ensure you connect with the privileges required to create a user.如果mongod启用了--auth，请确保您以创建用户所需的权限进行连接。

Add Kerberos Principal(s) to MongoDB.将Kerberos主体添加到MongoDB。

Add a Kerberos principal, <username>@<KERBEROS REALM> or <username>/<instance>@<KERBEROS REALM>, to MongoDB in the $external database. 向$external数据库中的MongoDB添加Kerberos主体<username>@<KERBEROS REALM>或<username>/<instance>@<KERBEROS REALM>。Specify the Kerberos realm in all uppercase. 指定全部大写的Kerberos域。The $external database allows mongod to consult an external source (e.g. Kerberos) to authenticate. $external数据库允许mongod查询外部源（例如Kerberos）进行身份验证。To specify the user's privileges, assign roles to the user.要指定用户的权限，请为用户分配角色。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or x.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或x.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

The following example adds the Kerberos principal application/reporting@EXAMPLE.NET with read-only access to the records database:下面的示例添加了Kerberos主体application/reporting@EXAMPLE.NET以只读方式访问记录数据库：

use $external
db.createUser(
   {
     user: "application/reporting@EXAMPLE.NET",
     roles: [ { role: "read", db: "records" } ]
   }
)

Add additional principals as needed. 根据需要添加其他主体。For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. 对于要使用Kerberos进行身份验证的每个用户，必须在MongoDB中创建相应的用户。For more information about creating and managing users, see User Management Commands.有关创建和管理用户的详细信息，请参阅用户管理命令。

Start mongod with Kerberos support.使用Kerberos支持启动mongod。

To start mongod with Kerberos support, set the environmental variable KRB5_KTNAME to the path of the keytab file and the mongod parameter authenticationMechanisms to GSSAPI in the following form:要启动支持Kerberos的mongod，请将环境变量KRB5_KTNAME设置为keytab文件的路径，并将mongod参数authenticationMechanisms设置为GSSAPI，格式如下：

env KRB5_KTNAME=<path to keytab file> \
mongod \
--setParameter authenticationMechanisms=GSSAPI \
<additional mongod options>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

For example, the following starts a standalone mongod instance with Kerberos support:例如，以下内容启动了一个支持Kerberos的独立mongod实例：

env KRB5_KTNAME=/opt/mongodb/mongod.keytab \
/opt/mongodb/bin/mongod --auth \
--setParameter authenticationMechanisms=GSSAPI \
--dbpath /opt/mongodb/data --bind_ip localhost,<hostname(s)|ip address(es)>

The path to your mongod as well as your keytab file may differ. mongod和keytab文件的路径可能不同。The keytab file must be only accessible to the owner of the mongod process.keytab文件必须只能由mongod进程的所有者访问。

With the official .deb or .rpm packages, you can set the KRB5_KTNAME in a environment settings file. 使用正式的.deb或.rpm包，您可以在环境设置文件中设置KRB5_KTNAME。See KRB5_KTNAME for details.有关详细信息，请参阅KRB5_KTNAME。

Connect mongosh to mongod and authenticate.将mongosh连接到mongod并进行身份验证。

Connect mongosh client as the Kerberos principal application/reporting@EXAMPLE.NET. 将mongosh客户端连接为Kerberos主体应用程序/reporting@EXAMPLENET.Before connecting, you must have used Kerberos's kinit program to get credentials for application/reporting@EXAMPLE.NET.在连接之前，您必须使用Kerberos的kinit程序来获取application/reporting@EXAMPLE.NET的凭据。

You can connect and authenticate from the command line.您可以从命令行进行连接和身份验证。

mongosh --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username application/reporting@EXAMPLE.NET

If you are connecting to a system whose hostname matches the Kerberos name, ensure that you specify the fully qualified domain name (FQDN) for the --host option, rather than an IP address or unqualified hostname.如果要连接到主机名与Kerberos名称匹配的系统，请确保为--host选项指定完全限定域名（FQDN），而不是IP地址或非限定主机名。

If you are connecting to a system whose hostname does not match the Kerberos name, first connect mongosh to the mongod, and then from mongosh, use the db.auth() method to authenticate in the $external database.如果要连接到主机名与Kerberos名称不匹配的系统，请首先将mongosh连接到mongod，然后从mongosh使用db.auth()方法在$external数据库中进行身份验证。

use $external
db.auth( { mechanism: "GSSAPI", user: "application/reporting@EXAMPLE.NET" } )