Database Manual / Self-Managed Deployments / Security / Authentication

Self-Managed LDAP Proxy Authentication自我管理LDAP代理身份验证

MongoDB Enterprise supports proxying authentication requests to a Lightweight Directory Access Protocol (LDAP) service.支持将身份验证请求代理到轻量级目录访问协议（LDAP）服务。

MongoDB supports simple and SASL binding to LDAP servers:MongoDB支持简单和SASL绑定到LDAP服务器：

ViaDescription描述
Operating system libraries操作系统库

MongoDB supports binding to an LDAP server via operating system libraries.MongoDB支持通过操作系统库绑定到LDAP服务器。

This allows MongoDB servers on Linux and Windows to use an LDAP server for authentication.这允许Linux和Windows上的MongoDB服务器使用LDAP服务器进行身份验证。

In earlier versions, MongoDB on Microsoft Windows cannot connect to LDAP servers.在早期版本中，Microsoft Windows上的MongoDB无法连接到LDAP服务器。

saslauthd

MongoDB servers on Linux supports binding to an LDAP server via the saslauthd daemon.Linux上的MongoDB服务器支持通过saslauthd守护进程绑定到LDAP服务器。

Not available for MongoDB on Windows.不适用于Windows上的MongoDB。

Considerations注意事项

A full description of LDAP is beyond the scope of this documentation. This page assumes prior knowledge of LDAP.LDAP的完整描述超出了本文档的范围。本页假定您对LDAP有先验知识。

This documentation only describes MongoDB LDAP authentication, and does not replace other resources on LDAP. We encourage you to thoroughly familiarize yourself with LDAP and its related subject matter before configuring LDAP authentication.本文档仅描述MongoDB LDAP身份验证，并不取代LDAP上的其他资源。我们建议您在配置LDAP身份验证之前彻底熟悉LDAP及其相关主题。

MongoDB can provide professional services for optimal configuration of LDAP authentication for your MongoDB deployment.MongoDB可以为MongoDB部署提供最佳配置LDAP身份验证的专业服务。

Connection Pool连接池

When connecting to the LDAP server for authentication/authorization, MongoDB, by default:当连接到LDAP服务器进行身份验证/授权时，默认情况下为MongoDB：

  • Uses connection pooling if run:如果运行，则使用连接池：

    • on Windows or在Windows或
    • on Linux where MongoDB Enterprise binaries are linked against libldap_r.在Linux上，MongoDB Enterprise二进制文件与libldap_r链接。

  • Does not use connection pooling if run:如果运行以下命令，则不使用连接池：

    • on Linux where MongoDB Enterprise binaries are linked against libldap.在Linux上，MongoDB Enterprise二进制文件与libldap链接。

To change the connection pooling behavior, update the ldapUseConnectionPool parameter.要更改连接池行为，请更新ldapUseConnectionPool参数。

saslauthd and Directory Permissions和目录权限

Important

The parent directory of the saslauthd Unix domain socket file specified to security.sasl.saslauthdSocketPath or --setParameter saslauthdPath must grant read and execute (r-x) permissions for either:指定给security.sasl.saslauthdSocketPath或--setParameter saslauthdPath的saslauthd Unix域套接字文件的父目录必须为以下任一项授予读取和执行（r-x）权限：

  • The user starting the mongod or mongos, or启动mongod或mongos的用户，或
  • A group to which that user belongs.该用户所属的组。

The mongod or mongos cannot successfully authenticate via saslauthd without the specified permission on the saslauthd directory and its contents.如果没有对saslauthd目录及其内容的指定权限，mongod或mongos无法通过saslauthd成功进行身份验证。

libldap and 和libldap_r

For MongoDB 4.2 Enterprise binaries linked against libldap (such as when running on RHEL), access to the libldap is synchronized, incurring some performance/latency costs.对于与libldap链接的MongoDB 4.2 Enterprise二进制文件（例如在RHEL上运行时），对libldap的访问是同步的，这会产生一些性能/延迟成本。

For MongoDB 4.2 Enterprise binaries linked against libldap_r, there is no change in behavior from earlier MongoDB versions.对于与libldap_r链接的MongoDB 4.2 Enterprise二进制文件，与早期MongoDB版本相比，行为没有变化。

Managing LDAP Users on the MongoDB server管理MongoDB服务器上的LDAP用户

When using LDAP authentication without LDAP authorization, user management requires managing users both on the LDAP server and the MongoDB server. 当在没有LDAP授权的情况下使用LDAP身份验证时，用户管理需要管理LDAP服务器和MongoDB服务器上的用户。For each user authenticating via LDAP, MongoDB requires a user on the $external database whose name exactly matches the authentication username. 对于通过LDAP进行身份验证的每个用户，MongoDB需要$external数据库上的一个用户，其名称与身份验证用户名完全匹配。Changes to a user on the LDAP server may require changes to the corresponding MongoDB $external user.更改LDAP服务器上的用户可能需要更改相应的MongoDB$external用户。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

Example示例

A user authenticates as sam@dba.example.com. The MongoDB server binds to the LDAP server and authenticates the user, respecting any username transformations. 用户身份验证为sam@dba.example.com。MongoDB服务器绑定到LDAP服务器并对用户进行身份验证，尊重任何用户名转换。On successful authentication, the MongoDB server then checks the $external database for a user sam@dba.example.com and grants the authenticated user the roles and privileges associated to that user.成功通过身份验证后，MongoDB服务器会检查$external数据库中的用户sam@dba.example.com并向经过身份验证的用户授予与该用户相关联的角色和权限。

To manage users on the MongoDB server, you must authenticate as an LDAP user whose corresponding MongoDB $external user has user administrative privileges on the $external database, such as those provided by userAdmin.要管理MongoDB服务器上的用户，您必须作为LDAP用户进行身份验证，其对应的MongoDB$$external用户在$external数据库上具有用户管理权限，例如userAdmin提供的权限。

Important

If no $external users have user administrative privileges on $external database, you cannot perform user management for LDAP authentication. This scenario may occur if you configure users prior to enabling LDAP authentication, but do not create the appropriate user administrators.如果没有$external用户对$external数据库具有用户管理权限，则无法对LDAP身份验证执行用户管理。如果在启用LDAP身份验证之前配置用户，但没有创建适当的用户管理员，则可能会出现这种情况。

Managing existing non-LDAP users管理现有的非LDAP用户

If there are existing users not on the $external database, you must meet the following requirements for each user to ensure continued access:如果$external数据库上没有现有用户，则必须满足每个用户的以下要求，以确保持续访问：

  • User has a corresponding user object on the LDAP server用户在LDAP服务器上有一个相应的用户对象
  • User exists on the $external database with equivalent roles and privileges用户在$external数据库上具有相同的角色和权限

If you want to continue allowing access by users not on the $external database, you must configure setParameter authenticationMechanisms to include SCRAM-SHA-1 and/or SCRAM-SHA-256 as appropriate. Users must then specify --authenticationMechanism SCRAM-SHA-1 or SCRAM-SHA-256 when authenticating.

Deploying LDAP authentication on a replica set在副本集上部署LDAP身份验证

For replica sets, configure LDAP authentication on secondary and arbiter members first before configuring the primary. This also applies to shard replica sets, or config server replica sets. Configure one replica set member at a time to maintain a majority of members for write availability.

Deploying LDAP authentication on a sharded cluster在分片集群上部署LDAP身份验证

In sharded clusters, you must configure LDAP authentication on the config servers and each mongos for cluster-level users. 在分片集群中，您必须在配置服务器和集群级用户的每个mongos上配置LDAP身份验证。You can optionally configure LDAP authorization on each shard for shard-local users.您可以选择在每个分片上为分片本地用户配置LDAP授权。

LDAP Authentication via the Operating System LDAP libraries通过操作系统LDAP库进行LDAP身份验证

The LDAP authentication via OS libraries process is summarized below:通过操作系统库进行LDAP身份验证的过程总结如下：

  1. A client authenticates to MongoDB, providing a user's credentials.客户端向MongoDB进行身份验证，提供用户的凭据。
  2. If the username requires mapping to an LDAP DN prior to binding against the LDAP server, MongoDB can apply transformations based on the configured security.ldap.userToDNMapping setting.如果用户名在绑定到LDAP服务器之前需要映射到LDAP DN，MongoDB可以根据配置的security.ldap.userToDNMapping设置应用转换。

  3. MongoDB binds to an LDAP server specified in security.ldap.servers using the provided username or, if a transformation was applied, the transformed username.MongoDB使用提供的用户名绑定到security.ldap.servers中指定的LDAP服务器，或者如果应用了转换，则使用转换后的用户名。

    MongoDB uses simple binding by default, but can also use sasl binding if configured in security.ldap.bind.method and security.ldap.bind.saslMechanisms.默认情况下，MongoDB使用简单绑定，但如果在security.ldap.bind.method和security.ldap.bind.saslMechanisms中配置，也可以使用sasl绑定。

    If a transformation requires querying the LDAP server, or if the LDAP server disallows anonymous binds, MongoDB uses the username and password specified to security.ldap.bind.queryUser and security.ldap.bind.queryPassword to bind to the LDAP server before attempting to authenticate the provided user credentials.如果转换需要查询LDAP服务器，或者如果LDAP服务器不允许匿名绑定，MongoDB将使用为security.ldap.bind.queryUser和security.ldap.bind.queryPassword指定的用户名和密码绑定到LDAP服务器，然后再尝试验证提供的用户凭据。

  4. The LDAP server returns the result of the bind attempt to MongoDB. On success, MongoDB attempts to authorize the user.LDAP服务器将绑定尝试的结果返回给MongoDB。成功后，MongoDB会尝试授权用户。
  5. The MongoDB server attempts to map the username to a user on the $external database, assigning the user any roles or privileges associated to a matching user. If MongoDB cannot find a matching user, authentication fails.MongoDB服务器尝试将用户名映射到$external数据库上的用户，为该用户分配与匹配用户相关的任何角色或权限。如果MongoDB找不到匹配的用户，则身份验证失败。
  6. The client can perform those actions for which MongoDB granted the authenticated user roles or privileges.客户端可以执行MongoDB授予经过身份验证的用户角色或权限的操作。

To use LDAP for authentication via operating system libraries, specify the following settings as a part of your mongod or mongos configuration file:要通过操作系统库使用LDAP进行身份验证，请在mongod或mongos配置文件中指定以下设置：

Option选项Description描述Required
security.ldap.servers

Quote-enclosed comma-separated list of LDAP servers in host[:port] format.引用以逗号分隔的LDAP服务器列表，格式为host[:port]。

You can prefix LDAP servers with srv: and srv_raw:.您可以在LDAP服务器前添加srv:和srv_raw:。

If your connection string specifies "srv:<DNS_NAME>", mongod verifies that "_ldap._tcp.gc._msdcs.<DNS_NAME>" exists for SRV to support Active Directory. If not found, mongod verifies that "_ldap._tcp.<DNS_NAME>" exists for SRV. If an SRV record cannot be found, mongod warns you to use "srv_raw:<DNS_NAME>" instead.

If your connection string specifies "srv_raw:<DNS_NAME>", mongod performs an SRV record lookup for "<DNS NAME>".

YES
security.ldap.bind.method

Used to specify the method the mongod or mongos uses to authenticate, or bind, to the LDAP server. Specify sasl to use one of the SASL protocols defined in security.ldap.bind.saslMechanisms.

Defaults to simple.

NO, unless using sasl for binding to the LDAP server.
security.ldap.bind.saslMechanisms

Used to specify the SASL mechanisms mongod or mongos can use when authenticating or binding to the LDAP server. MongoDB and the LDAP server must agree on at least one SASL mechanism.

Defaults to DIGEST-MD5.

NO, unless setting method to sasl and you need different or additional SASL mechanisms.
security.ldap.bind.queryUser

The LDAP entity, identified by its distinguished name (DN) or SASL name, with which the MongoDB server authenticates, or binds, when connecting to an LDAP server.

Use with queryPassword.

The user specified must have the appropriate privileges to execute queries on the LDAP server.

NO, unless specifying a query as part of a userToDNMapping transformation, or if the LDAP server's security settings disallow anonymous binds.
security.ldap.bind.queryPasswordThe password used to authenticate to an LDAP server when using queryUser.NO, unless specifying queryUser.
security.ldap.bind.useOSDefaultsWindows MongoDB deployments can use the operating system credentials in place of queryUser and queryPassword for authenticating or binding as when connecting to the LDAP server.NO, unless replacing queryUser and queryPassword.
security.ldap.userToDNMapping

Clients may authenticate using a username whose format is incompatible with the format expected by the configured bind method. For example, simple binding may require a full LDAP DN while the username used to authenticate to MongoDB might be an e-mail address.

userToDNMapping allows MongoDB to transform incoming usernames into a format compatible with your LDAP schema. MongoDB supports transformations using either a substitution template or an LDAP query template.

If you specify a userToDNMapping transformation that uses LDAP queries as part of the transformation, you must also specify a queryUser with the appropriate level of permissions for the LDAP server

NO, unless client authenticate using usernames that require transformation.

LDAP Authentication via saslauthd

Warning

MongoDB Enterprise for Windows does not support binding via saslauthd.MongoDB Enterprise for Windows不支持通过saslauthd进行绑定。

Considerations注意事项

  • Linux MongoDB servers support binding to an LDAP server via the saslauthd daemon.Linux MongoDB服务器支持通过saslauthd守护进程绑定到LDAP服务器。
  • Use secure encrypted or trusted connections between clients and the server, as well as between saslauthd and the LDAP server. 在客户端和服务器之间以及saslauthd和LDAP服务器之间使用安全的加密或可信连接。The LDAP server uses the SASL PLAIN mechanism, sending and receiving data in plain text. You should use only a trusted channel such as a VPN, a connection encrypted with TLS/SSL, or a trusted wired network.LDAP服务器使用SASL PLAIN机制，以纯文本形式发送和接收数据。您应该只使用受信任的通道，如VPN、用TLS/SSL加密的连接或受信任的有线网络。

Configuration配置

To configure the MongoDB server to bind to the LDAP server using via saslauthd, start the mongod using either the following command line options or the following configuration file settings:要使用saslauthd将MongoDB服务器配置为绑定到LDAP服务器，请使用以下命令行选项或以下配置文件设置启动mongod：

Command Line Options命令行选项

Include any other command line options required for your deployment. 包括部署所需的任何其他命令行选项。For complete documentation on mongod command line options, see mongod.有关mongod命令行选项的完整文档，请参阅mongod。

Configuration File Settings配置文件设置
  • security.authorization set to enabled,设置为enabled，
  • setParameter with the authenticationMechanisms parameter set to PLAIN, and
  • setParameter with the saslauthdPath set to the path to the Unix-domain Socket of the saslauthd instance. Specify an empty string "" to use the default Unix-domain socket path.

Include any other configuration file settings required for your deployment. 包括部署所需的任何其他配置文件设置。For complete documentation on configuration files, see YAML configuration file.有关配置文件的完整文档，请参阅YAML配置文件。

You need to create or update the saslauthd.conf file with the parameters appropriate for your LDAP server. Documenting saslauthd.conf is out of scope for this documentation.您需要使用适用于LDAP服务器的参数创建或更新saslauthd.conf文件。记录saslauthd.conf超出了本文档的范围。

Important

The parent directory of the saslauthd Unix domain socket file specified to security.sasl.saslauthdSocketPath or --setParameter saslauthdPath must grant read and execute (r-x) permissions for either:指定给security.sasl.saslauthdSocketPath或--setParameter saslauthdPath的saslauthd Unix域套接字文件的父目录必须为以下任一项授予读取和执行（r-x）权限：

  • The user starting the mongod or mongos, or
  • A group to which that user belongs.该用户所属的组。

The mongod or mongos cannot successfully authenticate via saslauthd without the specified permission on the saslauthd directory and its contents.如果没有对saslaund目录及其内容的指定权限，mongod或mongos无法通过saslauthd成功进行身份验证。

The following tutorials provide basic information on configuring saslauthd.conf to work with two popular LDAP services:以下教程提供了有关配置saslauthd.conf以使用两种流行LDAP服务的基本信息：

Please see the documentation for saslauthd as well as your specific LDAP service for guidance.请参阅saslauthd的文档以及特定LDAP服务以获取指导。

Connect to a MongoDB server via LDAP authentication通过LDAP身份验证连接到MongoDB服务器

To authenticate to a MongoDB server via LDAP authentication, use db.auth() on the $external database with the following parameters:要通过LDAP身份验证向MongoDB服务器进行身份验证，请在$external数据库上使用db.auth()，并使用以下参数：

Option选项Description描述
usernameThe username to authenticate as.要进行身份验证的用户名。
passwordThe password to authenticate with.用于进行身份验证的密码。
mechanismSet to PLAIN.设置为PLAIN。