Authenticate Using Self-Managed SASL and LDAP with OpenLDAP通过OpenLDAP使用自管理SASL和LDAP进行身份验证

Specify the mechanism.指定机制。

On systems that configure saslauthd with the /etc/sysconfig/saslauthd file, such as Red Hat Enterprise Linux, Fedora, CentOS, and Amazon Linux AMI, set the mechanism MECH to ldap:在使用/etc/sysconfig/saslauthd文件配置saslauthd的系统上，如Red Hat Enterprise Linux、Fedora、CentOS和Amazon Linux AMI，将机制MECH设置为ldap：

MECH=ldap

On systems that configure saslauthd with the /etc/default/saslauthd file, such as Ubuntu, set the MECHANISMS option to ldap:在使用/etc/default/saslauthd文件配置saslauthd的系统上，如Ubuntu，将MECHANISMS选项设置为ldap：

MECHANISMS="ldap"

Adjust caching behavior.调整缓存行为。

On certain Linux distributions, saslauthd starts with the caching of authentication credentials enabled. Until restarted or until the cache expires, saslauthd will not contact the LDAP server to re-authenticate users in its authentication cache. 在某些Linux发行版上，saslaund从启用身份验证凭据缓存开始。在重新启动或缓存过期之前，saslauthd不会联系LDAP服务器以在其身份验证缓存中重新对用户进行身份验证。This allows saslauthd to successfully authenticate users in its cache, even in the LDAP server is down or if the cached users' credentials are revoked.这允许saslauthd在其缓存中成功验证用户，即使在LDAP服务器关闭或缓存的用户凭据被撤销的情况下也是如此。

To set the expiration time (in seconds) for the authentication cache, see the -t option of saslauthd.要设置身份验证缓存的过期时间（以秒为单位），请参阅saslauthd的-t选项。

Configure LDAP Options with OpenLDAP.使用OpenLDAP配置LDAP选项。

If the saslauthd.conf file does not exist, create it. 如果saslauthd.conf文件不存在，请创建它。The saslauthd.conf file usually resides in the /etc folder. saslauthd.conf文件通常位于/etc文件夹中。If specifying a different file path, see the -O option of saslauthd.如果指定不同的文件路径，请参阅saslauthd的-O选项。

To connect to an OpenLDAP server, update the saslauthd.conf file with the following configuration options:要连接到OpenLDAP服务器，请使用以下配置选项更新saslauthd.conf文件：

ldap_servers: <ldap uri>
ldap_search_base: <search base>
ldap_filter: <filter>

The ldap_servers specifies the uri of the LDAP server used for authentication. ldap_servers指定用于身份验证的ldap服务器的uri。In general, for OpenLDAP installed on the local machine, you can specify the value ldap://localhost:389 or if using LDAP over TLS/SSL, you can specify the value ldaps://localhost:636.通常，对于安装在本地计算机上的OpenLDAP，可以指定值ldap://localhost:389或者，如果使用TLS/SSL上的LDAP，则可以指定该值ldaps://localhost:636。

The ldap_search_base specifies distinguished name to which the search is relative. The search includes the base or objects below.ldap_search_base指定与搜索相关的可分辨名称。搜索包括以下基础或对象。

The ldap_filter specifies the search filter.ldap_filter指定搜索筛选器。

The values for these configuration options should correspond to the values specific for your test. For example, to filter on email, specify ldap_filter: (mail=%n) instead.这些配置选项的值应与测试特定的值相对应。例如，要筛选电子邮件，请指定ldap_filter: (mail=%n)。

ldap_servers: ldaps://ad.example.net
ldap_search_base: ou=Users,dc=example,dc=com
ldap_filter: (uid=%u)

Test the saslauthd configuration.测试saslauthd配置。

Use testsaslauthd utility to test the saslauthd configuration. For example:使用testsaslauthd实用程序测试saslauthd配置。例如：

testsaslauthd -u testuser -p testpassword -f /var/run/saslauthd/mux

• 0: OK "Success" indicates successful authentication.表示身份验证成功。
• 0: NO "authentication failed" indicates a username, password, or configuration error.表示用户名、密码或配置错误。

Modify the file path with respect to the location of the saslauthd directory on the host operating system.修改主机操作系统上saslauthd目录位置的文件路径。

Add user to MongoDB for authentication.将用户添加到MongoDB进行身份验证。

Add the user to the $external database in MongoDB. To specify the user's privileges, assign roles to the user.将用户添加到MongoDB中的$external数据库。要指定用户的权限，请为用户分配角色。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

For example, the following adds a user with read-only access to the records database.例如，下面添加了一个对records数据库具有只读访问权限的用户。

db.getSiblingDB("$external").createUser(
    {
      user : <username>,
      roles: [ { role: "read", db: "records" } ]
    }
)

Add additional principals as needed. For more information about creating and managing users, see User Management Commands.根据需要添加其他主体。有关创建和管理用户的详细信息，请参阅用户管理命令。

Configure MongoDB server.配置MongoDB服务器。

To configure the MongoDB server to use the saslauthd instance for proxy authentication, include the following options when starting mongod:要将MongoDB服务器配置为使用saslauthd实例进行代理身份验证，请在启动mongod时包含以下选项：

• --auth command line option or security.authorization setting,命令行选项或security.authorization设置，
• authenticationMechanisms parameter set to PLAIN, and参数设置为PLAIN，以及

• saslauthdPath parameter set to the path to the Unix-domain Socket of the saslauthd instance.saslauthdPath参数设置为saslauthd实例的Unix域Socket的路径。

  Important

  The parent directory of the saslauthd Unix domain socket file specified to security.sasl.saslauthdSocketPath or --setParameter saslauthdPath must grant read and execute (r-x) permissions for either:指定给security.sasl.saslauthdSocketPath或--setParameter saslauthdPath的saslauthd Unix域套接字文件的父目录必须为以下任一项授予读取和执行（r-x）权限：

  • The user starting the mongod or mongos, or启动mongod或mongos的用户，或
  • A group to which that user belongs.该用户所属的组。

  The mongod or mongos cannot successfully authenticate via saslauthd without the specified permission on the saslauthd directory and its contents.如果没有对saslaund目录及其内容的指定权限，mongod或mongos无法通过saslauthd成功进行身份验证。

If you use the authorization option to enforce authentication, you will need privileges to create a user.如果使用authorization选项强制身份验证，则需要权限来创建用户。

mongod --auth --setParameter saslauthdPath=/<some>/<path>/saslauthd/mux --setParameter authenticationMechanisms=PLAIN

Or if using a YAML format configuration file, specify the following settings in the file:或者，如果使用YAML格式配置文件，请在文件中指定以下设置：

security:
   authorization: enabled

setParameter:
   saslauthdPath: /<some>/<path>/saslauthd/mux
   authenticationMechanisms: PLAIN

Or, if using the older configuration file format:或者，如果使用较旧的配置文件格式：

auth=true
setParameter=saslauthdPath=/<some>/<path>/saslauthd/mux
setParameter=authenticationMechanisms=PLAIN

mongod --auth --setParameter saslauthdPath="" --setParameter authenticationMechanisms=PLAIN

Or if using a YAML format configuration file, specify the following settings in the file:或者，如果使用YAML格式配置文件，请在文件中指定以下设置：

security:
   authorization: enabled

setParameter:
   saslauthdPath: ""
   authenticationMechanisms: PLAIN

Or, if using the older configuration file format:或者，如果使用较旧的配置文件格式：

auth=true
setParameter=saslauthdPath=""
setParameter=authenticationMechanisms=PLAIN

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Authenticate the user in mongosh.用mongosh对用户进行身份验证。

You can authenticate from the command line during connection, or connect first and then authenticate using db.auth() method.您可以在连接期间从命令行进行身份验证，也可以先连接，然后使用db.auth()方法进行身份验证。

mongosh --host <host> --authenticationMechanism PLAIN --authenticationDatabase '$external' -u <user> -p

db.getSiblingDB("$external").auth(
   {
     mechanism: "PLAIN",
     user: <username>,
     pwd:  passwordPrompt() // or cleartext password
   }
)

The server forwards the password in plain text. In general, use only on a trusted channel (VPN, TLS/SSL, trusted wired network). See Considerations.服务器以纯文本形式转发密码。一般来说，仅在受信任的通道（VPN、TLS/SSL、受信任的有线网络）上使用。请参阅注意事项。