Database Manual / Self-Managed Deployments / Security / Authentication

Self-Managed Internal/Membership Authentication自我管理的内部/成员身份验证

You can require that members of replica sets and sharded clusters authenticate to each other. 您可以要求副本集和分片集群的成员相互进行身份验证。For the internal authentication of the members, MongoDB can use either keyfiles or X.509 certificates.对于成员的内部身份验证，MongoDB可以使用键文件或X.509证书。

The selected method is used for all internal communication. 所选方法用于所有内部沟通。For example, when a client authenticates to a mongos using one of the supported authentication mechanisms, the mongos then uses the configured internal authentication method to connect to the required mongod processes.例如，当客户端使用支持的身份验证机制之一对mongos进行身份验证时，mongos然后使用配置的内部身份验证方法连接到所需的mongod进程。

Note

Enabling internal authentication also enables client authorization.启用内部身份验证还可以启用客户端授权。

Keyfiles键文件

Keyfiles use SCRAM challenge and response authentication mechanism where the keyfiles contain the shared password for the members.键文件使用SCRAM质询和响应身份验证机制，其中键文件包含成员的共享密码。

Key Requirements关键要求

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. 键的长度必须在6到1024个字符之间，并且只能包含base64集合中的字符。MongoDB strips whitespace characters (e.g. x0d, x09, and x20) for cross-platform convenience. MongoDB删除空白字符（例如x0d、x09和x20）以方便跨平台使用。As a result, the following operations produce identical keys:因此，以下操作会生成相同的键：

echo -e "mysecretkey" > key1
echo -e "my secret key" > key1
echo -e "my secret key\n" > key2
echo -e "my    secret    key" > key3
echo -e "my\r\nsecret\r\nkey\r\n" > key4

Keyfile Format键文件格式

Keyfiles for internal membership authentication use YAML format to allow for multiple keys in a keyfile. The YAML format accepts either:用于内部成员身份验证的键文件使用YAML格式，允许在一个键文件中使用多个键。YAML格式接受以下任一格式：

  • A single key string (same as in earlier versions)单个键字符串（与早期版本相同）
  • A sequence of key strings一串键串

The YAML format is compatible with the existing single-key keyfiles that use the text file format.YAML格式与使用文本文件格式的现有单键键文件兼容。

For example,例如，

Single key单一键

If the keyfile contains a single key, you can specify the key string with or without quotes:如果键文件包含单个键，则可以指定带引号或不带引号的键字符串：

my old secret key1
Multiple Key Sequence多键序列

You can specify multiple key strings [1] as a sequence of key strings (optionally enclosed in quotes):您可以将多个键字符串[1]指定为键字符串序列（可选地括在引号中）：

- my old secret key1
- my new secret key2

The ability to specify multiple keys in a file allows for the rolling upgrade of the keys without downtime. 在文件中指定多个键的能力允许在不停机的情况下滚动升级键。See Rotate Keys for Self-Managed Replica Sets and Rotate Keys for Self-Managed Sharded Clusters.请参见自管理副本集的旋转关键帧和自管理分片群集的旋转关键点。

All mongod and mongos instances of a deployment must share at least one common key.部署的所有mongod和mongos实例必须至少共享一个公共键。

On UNIX systems, the keyfile must not have group or world permissions. On Windows systems, keyfile permissions are not checked.在UNIX系统上，键文件不得具有组或世界权限。在Windows系统上，不检查键文件权限。

You must store the keyfile on each server hosting the member of the replica set or sharded clusters.您必须将键文件存储在承载副本集或分片群集成员的每台服务器上。

[1] For MongoDB's encrypted storage engine, the keyfile used for local key management can only contain a single key .对于MongoDB的加密存储引擎，用于本地键管理的键文件只能包含一个键。

MongoDB Configuration for KeyfileMongoDB键文件配置

To specify the keyfile, use the security.keyFile setting or --keyFile command line option.要指定键文件，请使用security.keyFile设置或--keyfile命令行选项。

For an example of keyfile internal authentication, see Update Self-Managed Replica Set to Keyfile Authentication.有关键文件内部身份验证的示例，请参阅将自我管理副本集更新为键文件身份验证。

X.509

Members of a replica set or sharded cluster can use X.509 certificates for internal authentication instead of using keyfiles. This is also known as Mutual TLS or mTLS. MongoDB supports X.509 certificate authentication for use with a secure TLS/SSL connection.副本集或分片集群的成员可以使用X.509证书进行内部身份验证，而不是使用键文件。这也被称为双向TLS或mTLS。MongoDB支持X.509证书身份验证，用于安全的TLS/SSL连接。

Note

MongoDB disables support for TLS 1.0 encryption on systems where TLS 1.1+ is available.MongoDB在TLS 1.1+可用的系统上禁用对TLS 1.0加密的支持。

Member Certificate Requirements会员证书要求

When TLS is enabled, use member certificates to verify membership to internal connections in a sharded cluster or a replica set. 启用TLS后，使用成员证书验证分片集群或副本集中内部连接的成员资格。You can configure member certificate file paths with the net.tls.clusterFile and net.tls.certificateKeyFile options. Members have the following configuration requirements:您可以使用net.tls.clusterFile和net.tls.certificateKeyFile选项配置成员证书文件路径。成员具有以下配置要求：

  • Cluster member configuration must specify a non-empty value for at least one of the attributes used for authentication. By default, MongoDB accepts:群集成员配置必须为用于身份验证的至少一个属性指定非null值。默认情况下，MongoDB接受：

    • the Organization (O)
    • the Organizational Unit (OU)组织单位（OU）
    • the Domain Component (DC)域组件（DC）

    MongoDB verifies that entries match exactly across all member certificates. MongoDB验证所有成员证书中的条目是否完全匹配。If you list multiple OU values, all certificates must use an identical list.如果列出多个OU值，则所有证书必须使用相同的列表。

    You can specify alternative attributes to use for authentication by setting net.tls.clusterAuthX509.extensionValue.您可以通过设置net.tls.clusterAuthX509.extensionValue来指定用于身份验证的替代属性。

  • Cluster member configuration must include the same net.tls.clusterAuthX509.attributes and use matching values. 群集成员配置必须包含相同的net.tls.clusterAuthX509.attributes，并使用匹配的值。Attribute order doesn't matter. The following example sets O and OU, but not DC:属性顺序并不重要。以下示例设置了O和OU，但没有设置DC：

    net:
      tls:
        clusterAuthX509:
          attributes: O=MongoDB, OU=MongoDB Server

Note

If you set the enforceUserClusterSeparation parameter to false, the following behaviors apply:如果将enforceUserClusterSeparation参数设置为false，则将应用以下行为：

  • You cannot set clusterAuthMode to an option that allows X.509 or the server will not start. The server will only start if clusterAuthMode is keyFile.您不能将clusterAuthMode设置为允许X.509的选项，否则服务器将无法启动。只有当clusterAuthMode为keyFile时，服务器才会启动。
  • A client can create a user in the $external database whose O/OU/DC attributes match the server's configured attributes for cluster membership.客户端可以在$external数据库中创建一个用户，该用户的O/OU/DC属性与服务器为集群成员资格配置的属性相匹配。
  • A client presenting a member certificate can now attempt MONGODB-X509 authentication as a user in the $external database.出示成员证书的客户端现在可以作为$external数据库中的用户尝试MONGODB-X509身份验证。

To set the enforceUserClusterSeparation parameter to false, run the following command during startup:要将enforceUserClusterSeparation参数设置为false，请在启动过程中运行以下命令：

mongod --setParameter enforceUserClusterSeparation=false

The certificates have the following requirements:证书有以下要求：

  • A single Certificate Authority (CA) must issue all X.509 certificates for the members of a sharded cluster or a replica set.单个证书颁发机构（CA）必须为分片集群或副本集的成员颁发所有X.509证书。

  • At least one of the Subject Alternative Name (SAN) entries must match the server hostname used by other cluster members. When comparing SANs, MongoDB can compare either DNS names or IP addresses.至少有一个主题备选名称（SAN）条目必须与其他群集成员使用的服务器主机名匹配。在比较SAN时，MongoDB可以比较DNS名称或IP地址。

    If you don't specify subjectAltName, MongoDB compares the Common Name (CN) instead. However, this usage of CN is deprecated per RFC2818如果不指定subjectAltName，MongoDB会比较通用名（CN）。然而，根据RFC2818，CN的这种用法已被弃用

  • If the certificate used as the certificateKeyFile includes extendedKeyUsage, the value must include both clientAuth ("TLS Web Client Authentication") and serverAuth ("TLS Web Server Authentication").如果用作certificateKeyFile的证书包括extendedKeyUsage，则该值必须同时包括clientAuth（“TLS Web客户端身份验证”）和serverAuth（“TLS Web服务器身份验证”）。

    extendedKeyUsage = clientAuth, serverAuth

  • If the certificate used as the clusterFile includes extendedKeyUsage, the value must include clientAuth.如果用作clusterFile的证书包括extendedKeyUsage，则该值必须包括clientAuth。

    extendedKeyUsage = clientAuth

MongoDB Configuration配置

You can use TLS for internal authentication between each member of your replica set (each mongod instance) or sharded cluster (each mongod and mongos instance).您可以使用TLS在副本集的每个成员（每个mongod实例）或分片集群（每个mongd和mongos实例）之间进行内部身份验证。

To use TLS for internal authentication, use the following settings:要使用TLS进行内部身份验证，请使用以下设置：

Important

If you set --tlsMode to any value other than disabled, MongoDB uses the certificate specified in net.tls.certificateKeyFile for both server and client authentication in internal replica set connections. This certificate setting applies regardless of whether you set security.clusterAuthMode to X.509.如果将--tlsMode设置为disabled以外的任何值，MongoDB将在内部副本集连接中使用net.tls.certificateKeyFile中指定的证书进行服务器和客户端身份验证。无论您是否将security.clusterAuthMode设置为X.509，此证书设置都适用。

mongod and mongos instances use their certificate key files to prove their identity to clients, but certificate key files can also be used for membership authentication. If you do not specify a cluster file, members use their certificate key files for membership authentication. mongod和mongos实例使用其证书键文件向客户端证明其身份，但证书键文件也可用于成员身份验证。如果不指定群集文件，成员将使用其证书键文件进行成员身份验证。Specify the certificate key file with net.tls.certificateKeyFile or --tlsCertificateKeyFile.使用net.tls.certificateKeyFile或--tlsCertificateKeyFile指定证书键文件。

To use the certificate key file for both client authentication and membership authentication, the certificate must either:要将证书键文件用于客户端身份验证和成员身份验证，证书必须：

  • Omit extendedKeyUsage or省略extendedKeyUsage或
  • Specify 指定extendedKeyUsage = serverAuth, clientAuth

Next Steps后续步骤

For an example of X.509 internal authentication, see Use X.509 Certificates for Membership Authentication with Self-Managed MongoDB.有关X.509内部身份验证的示例，请参阅使用X.509证书进行自我管理MongoDB的成员身份验证。

To upgrade from keyfile internal authentication to X.509 internal authentication, see Upgrade Self-Managed MongoDB from Keyfile Authentication to X.509 Authentication.要从键文件内部身份验证升级到X.509内部身份验证，请参阅将自管理MongoDB从键文件身份验证升级为X.509身份验证。