Configure Users Using Self-Managed Active Directory with Native LDAP使用具有本机LDAP的自管理活动目录配置用户

Configure TLS/SSL for the server running MongoDB为运行MongoDB的服务器配置TLS/SSL

To connect to the AD (AD) server via TLS/SSL, the mongod or mongos require access to the AD server's Certificate Authority (CA) certificate.要通过TLS/SSL连接到AD(AD)服务器，mongod或mongos需要访问AD服务器的证书颁发机构（CA）证书。

On Linux, specify the AD server's CA certificates via the TLS_CACERT or TLS_CACERTDIR option in the ldap.conf file.在Linux上，通过ldap.conf文件中的TLS_CAMERT或TLS_CAMERTDIR选项指定AD服务器的CA证书。

Your platform's package manager creates the ldap.conf file while installing MongoDB Enterprise's libldap dependency. For complete documentation on the configuration file or the referenced options, see ldap.conf.在安装MongoDB Enterprise的libldap依赖项时，平台的包管理器会创建ldap.conf文件。有关配置文件或引用选项的完整文档，请参阅ldap.conf。

On Microsoft Windows, load the AD server's Certificate Authority (CA) certificates with the platform's credential management tool. The exact credential management tool is Windows version dependent. To use the tool, refer to its documentation for your version of Windows.在Microsoft Windows上，使用平台的凭据管理工具加载AD服务器的证书颁发机构（CA）证书。确切的凭据管理工具取决于Windows版本。要使用该工具，请参阅适用于Windows版本的文档。

If mongod or mongos cannot access to the AD CA files, they cannot create TLS/SSL connections to the Active Directory server.如果mongod或mongos无法访问AD CA文件，则无法创建到活动目录服务器的TLS/SSL连接。

Optionally, set security.ldap.transportSecurity to none to disable TLS/SSL.（可选）将security.ldap.transportSecurity设置为none以禁用TLS/SSL。

Connect to the MongoDB server.连接到MongoDB服务器。

Connect to the MongoDB server using mongosh using the --host and --port options.使用--host和--port选项使用mongosh连接到MongoDB服务器。

mongosh --host <hostname> --port <port>

If your MongoDB server currently enforces authentication, you must authenticate to the admin database as a user with role management privileges, such as those provided by userAdmin or userAdminAnyDatabase. 如果MongoDB服务器当前强制执行身份验证，则必须以具有角色管理权限的用户身份向admin数据库进行身份验证，例如userAdmin或userAdminAnyDatabase提供的权限。Include the appropriate --authenticationMechanism for the MongoDB server's configured authentication mechanism.为MongoDB服务器配置的身份验证机制包括适当的--authenticationMechanism。

mongosh --host <hostname> --port <port> --username <user> --password <pass> --authenticationDatabase="admin" --authenticationMechanism="<mechanism>"

Create user administrative role.创建用户管理角色。

To manage MongoDB users using AD, you need to create at least one role on the admin database that can create and manage roles, such as those provided by userAdmin or userAdminAnyDatabase.要使用AD管理MongoDB用户，您需要在admin数据库上创建至少一个可以创建和管理角色的角色，例如userAdmin或userAdminAnyDatabase提供的角色。

The role's name must exactly match the Distinguished Name of an AD group. The group must have at least one AD user as a member.角色的名称必须与AD组的可分辨名称完全匹配。该组必须至少有一个AD用户作为成员。

Given the available Active Directory groups,the following operation:给定可用的活动目录组，执行以下操作：

• Creates a role named for the AD group CN=dba,CN=Users,DC=example,DC=com, and创建一个以AD组CN=dba,CN=Users,DC=example,DC=com命名的角色，以及
• Assigns it the userAdminAnyDatabase role on the admin database.在admin数据库上为其分配userAdminAnyDatabase角色。

var admin = db.getSiblingDB("admin")
admin.createRole(
   {
     role: "CN=dba,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [ "userAdminAnyDatabase" ]
   }
)

You could alternatively grant the userAdmin role for each database the user should have user administrative privileges on. These roles provide the necessary privileges for role creation and management.您也可以为每个用户应该具有用户管理权限的数据库授予userAdmin角色。这些角色为角色创建和管理提供了必要的权限。

Create a MongoDB configuration file.创建MongoDB配置文件。

A MongoDB configuration file is a plain-text YAML file with the .conf file extension.MongoDB配置文件是一个扩展名为.conf的纯文本YAML文件。

• If you are upgrading an existing MongoDB deployment, copy the current configuration file and work from that copy.如果要升级现有的MongoDB部署，请复制当前配置文件并从该副本开始工作。
• (Linux Only) If this is a new deployment and you used your platform's package manager to install MongoDB Enterprise, the installation includes the /etc/mongod.conf default configuration file. Use that default configuration file, or make a copy of that file to work from.（仅限Linux）如果这是一个新的部署，并且您使用平台的包管理器安装了MongoDB Enterprise，则安装包括/etc/mongod.conf默认配置文件。使用默认配置文件，或复制该文件以从中工作。
• If no such file exists, create an empty file with the .conf extension and work from that new configuration file.如果不存在这样的文件，请创建一个扩展名为.conf的空文件，并从新的配置文件开始工作。

Configure MongoDB to connect to Active Directory.配置MongoDB以连接到活动目录。

In the MongoDB configuration file, set security.ldap.servers to the host and port of the AD server. 在MongoDB配置文件中，将security.ldap.servers设置为AD服务器的主机和端口。If your AD infrastructure includes multiple AD servers for the purpose of replication, specify the host and port of the servers as a comma-delimited list to security.ldap.servers.如果AD基础架构包含多个用于复制的AD服务器，请将服务器的主机和端口指定为逗号分隔的列表，以供security.ldap.servers使用。

You must also enable LDAP authentication by setting security.authorization to enabled and setParameter authenticationMechanisms to PLAIN您还必须通过将security.authorization设置为enabled并通过setParameter将authenticationMechanisms设置为PLAIN来启用LDAP身份验证

security:
  authorization: "enabled"
  ldap:
    servers: "activedirectory.example.net"
setParameter:
  authenticationMechanisms: 'PLAIN'

MongoDB must bind to the AD server to perform queries. By default, MongoDB uses the simple authentication mechanism to bind itself to the AD server.MongoDB必须绑定到AD服务器才能执行查询。默认情况下，MongoDB使用简单的身份验证机制将自己绑定到AD服务器。

Alternatively, you can configure the following settings in the configuration file to bind to the AD server using SASL:或者，您可以在配置文件中配置以下设置，以使用SASL绑定到AD服务器：

• Set security.ldap.bind.method to sasl将security.ldap.bind.method设置为sasl
• security.ldap.bind.saslMechanisms, specifying a string of comma-separated SASL mechanisms the AD server supports.，指定AD服务器支持的逗号分隔的SASL机制字符串。

This tutorial uses the default simple LDAP authentication mechanism.本教程使用默认的simpleLDAP身份验证机制。

Configure LDAP Query Template for authorization.配置LDAP查询模板以进行授权。

In the MongoDB configuration file, set security.ldap.authz.queryTemplate to an RFC4516 formatted LDAP query URL template.在MongoDB配置文件中，将security.ldap.authz.queryTemplate设置为RFC4516格式的LDAP查询URL模板。

In the template, you can use either:在模板中，您可以使用：

• {USER} placeholder to substitute the authenticated username into the LDAP query URL.占位符，用于将经过身份验证的用户名替换为LDAP查询URL。
• {PROVIDED_USER} placeholder to substitute the supplied username, i.e. before either authentication or LDAP transformation, into the LDAP query.占位符，用于将提供的用户名替换为LDAP查询，即在身份验证或LDAP转换之前。

security:
  ldap:
    authz:
      queryTemplate:
        "DC=example,DC=com??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER}))"

MongoDB maps each returned group DN to a role on the admin database. MongoDB将每个返回的组DN映射到admin数据库上的一个角色。For each mapped group DN, if there is an existing role on the admin database whose name exactly matches the DN, MongoDB grants the user the roles and privileges assigned to that role.对于每个映射的组DN，如果admin数据库上存在一个名称与DN完全匹配的现有角色，MongoDB会授予用户分配给该角色的角色和权限。

The matching rule LDAP_MATCHING_RULE_IN_CHAIN requires providing the full DN of the authenticating user. 匹配规则LDAP_MATCHING_RULE_IN_CHAIN要求提供身份验证用户的完整DN。If users authenticate using a different username format, such as their user principal name, you must transform the incoming usernames into DNs using security.ldap.userToDNMapping.如果用户使用不同的用户名格式进行身份验证，例如他们的用户主体名称，则必须使用security.ldap.userToDNMapping将传入的用户名转换为DN。

Optional: Transform incoming usernames for authentication via Active Directory,可选：转换传入用户名以通过活动目录进行身份验证，

If your users authenticate with a username that is not a full LDAP DN, you may need to transform the username to support LDAP authentication or authorization. MongoDB uses the transformed username for both authentication and authorization.如果用户使用的用户名不是完整的LDAP DN进行身份验证，您可能需要转换用户名以支持LDAP身份验证或授权。MongoDB使用转换后的用户名进行身份验证和授权。

In the MongoDB configuration file, set userToDNMapping to transform the authenticating user's provided username into an AD DN to support the queryTemplate.在MongoDB配置文件中，设置userToDNMapping，将认证用户提供的用户名转换为AD DN，以支持queryTemplate。

security:
  ldap:
    userToDNMapping:
      '[
         {
            match : "(.+)",
            ldapQuery: "DC=example,DC=com??sub?(userPrincipalName={0})"
         }
    ]'

You must modify the given sample configuration to match your deployment. For example, the ldapQuery base DN must match the base DN which contains your user entities. Other modifications may be necessary to support your AD deployment.您必须修改给定的示例配置以匹配部署。例如，ldapQuery基DN必须与包含用户实体的基DN匹配。可能需要进行其他修改以支持AD部署。

DC=example,DC=com??sub?(userPrincipalName=alice@ENGINEERING.EXAMPLE.COM)

Configure query credentials.配置查询凭据。

MongoDB requires credentials for performing queries on the AD server.MongoDB需要凭据才能在AD服务器上执行查询。

Configure the following settings in the configuration file:在配置文件中配置以下设置：

• security.ldap.bind.queryUser, specifying the Active Directory user the mongod or mongos binds as for performing queries on the AD server.security.ldap.bind.queryUser，指定mongod或mongos绑定的活动目录用户，用于在AD服务器上执行查询。
• security.ldap.bind.queryPassword, specifying the password for the specified queryUser.，为指定的queryUser指定密码。

security:
  ldap:
    bind:
      queryUser: "mongodbadmin@dba.example.com"
      queryPassword: "secret123"

On Windows MongoDB servers, you can set security.ldap.bind.useOSDefaults to true to use the credentials of the OS user instead of queryUser and queryPassword.在Windows MongoDB服务器上，您可以将security.ldap.bind.useOSDefaults设置为true，以使用操作系统用户的凭据，而不是queryUser和queryPassword。

The queryUser must have permission to perform all LDAP queries on behalf of MongoDB.queryUser必须具有代表MongoDB执行所有LDAP查询的权限。

Optional: Add additional configuration settings.可选：添加其他配置设置。

Add any additional configuration options required for your deployment. For example, you can specify your desired storage.dbPath or change the default net.port number.添加部署所需的任何其他配置选项。例如，您可以指定所需的storage.dbPath或更改默认net.port号。

mongod and mongos bind to localhost by default. mongod和mongos默认绑定到本地主机。If the members of your deployment are run on different hosts or if you wish remote clients to connect to your deployment, you must specify the net.bindIp setting.如果部署的成员在不同的主机上运行，或者希望远程客户端连接到部署，则必须指定net.bindIp设置。

Start the MongoDB server with Active Directory authentication and authorization.使用活动目录身份验证和授权启动MongoDB服务器。

Start the MongoDB server with the --config option, specifying the path to the configuration file created during this procedure. If the MongoDB server is currently running, make the appropriate preparations to stop the server.使用--config选项启动MongoDB服务器，指定在此过程中创建的配置文件的路径。如果MongoDB服务器当前正在运行，请做好停止服务器的适当准备。

mongod --config <path-to-config-file>

Windows MongoDB deployments must use mongod.exe instead of mongod.Windows MongoDB部署必须使用mongod.exe而不是mongod。

Connect to the MongoDB server.连接到MongoDB服务器。

Connect to the MongoDB server, authenticating as a user whose direct or transitive group membership corresponds to a MongoDB role on the admin database with userAdmin, userAdminAnyDatabase, or a custom role with equivalent privileges.连接到MongoDB服务器，作为一个用户进行身份验证，该用户的直接或可传递组成员资格对应admin数据库上具有userAdmin、userAdminAnyDatabase或具有同等权限的自定义角色的MongoDB角色。

Use mongosh to authenticate to the MongoDB server, set the following options:要向MongoDB服务器进行身份验证，请设置以下选项：

• --host with the hostname of the MongoDB server使用MongoDB服务器的主机名
• --port with the port of the MongoDB server使用MongoDB服务器的端口
• --username to the user's username为用户的用户名
• --password to the user's password为用户的密码
• --authenticationMechanism to 'PLAIN'
• --authenticationDatabase to '$external'

mongosh --username sam@DBA.EXAMPLE.COM --password  --authenticationMechanism 'PLAIN' --authenticationDatabase '$external' --host <hostname> --port <port>

Windows MongoDB deployments must use mongo.exe instead of mongosh.Windows MongoDB部署必须使用mongo.exe而不是mongosh。

Given the configured Active Directory users, the user authenticates successfully and receives the appropriate permissions.给定配置的活动目录用户，用户将成功进行身份验证并获得相应的权限。

Create roles for mapping returned AD groups.为映射返回的AD组创建角色。

For each group on the AD server you wish to use for MongoDB authorization, you must create a matching role on the MongoDB server's admin database.对于您希望用于MongoDB授权的AD服务器上的每个组，您必须在MongoDB服务器的admin数据库上创建一个匹配的角色。

db.getSiblingDB("admin").createRole(
   {
     role: "CN=PrimaryApplication,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [
       { role: "readWrite", db: "PrimaryApplication" }
     ]
   }
)

Transition existing users from $external to the ActiveDirectory server将现有用户从$external迁移到活动目录服务器

If upgrading an existing installation with users configured on the $external database, you must meet the following requirements for each user to ensure access after configuring MongoDB for AD authentication and authorization:如果使用在$external数据库上配置的用户升级现有安装，则必须满足每个用户的以下要求，以确保在配置MongoDB进行AD身份验证和授权后能够访问：

• User has a corresponding user object on the AD server.用户在AD服务器上有一个相应的用户对象。
• User has membership in the appropriate groups on the AD server.用户具有AD服务器上相应组的成员资格。
• MongoDB contains the roles on the admin database named for the user's AD groups, such that the authorized user retains its privileges.MongoDB包含以用户AD组命名的admin数据库上的角色，以便授权用户保留其权限。

{
  user : "joe@ANALYTICS.EXAMPLE.COM",
  roles: [
    { role : "read", db : "web_analytics" },
    { role : "read", db : "PrimaryApplication" }
  ]
}

db.getSiblingDB("admin").createRole(
   {
     role: "CN=marketing,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [
       { role: "read", db: "web_analytics" }
       { role: "read", db: "PrimaryApplication" }
     ]
   }
)

If you want to continue allowing users on non-$external databases to access MongoDB, you must include SCRAM authentication mechanism (e.g. SCRAM-SHA-1 and/or SCRAM-SHA-256) in the setParameter authenticationMechanisms configuration option. For example:如果你想继续允许非$external数据库上的用户访问MongoDB，你必须通过setParameter使authenticationMechanisms配置选项中包含SCRAM身份验证机制（例如SCRAM-SHA-1和/或SCRAM-SHA-256）。例如：

setParameter:
  authenticationMechanisms: "PLAIN,SCRAM-SHA-1,SCRAM-SHA-256"

Alternatively, transition non-$external users to AD by following the above procedure.或者，按照上述过程将非$external用户转换为AD。