Use SCRAM to Authenticate Clients on Self-Managed Deployments使用SCRAM对自我管理部署上的客户端进行身份验证

Start MongoDB without access control启动MongoDB而不进行访问控制

Start a standalone mongod instance without access control.启动一个没有访问控制的独立mongod实例。

Open a terminal and run the following command as the mongod user:打开一个终端，以mongod用户身份运行以下命令：

mongod --port 27017 --dbpath /var/lib/mongodb

The mongod instance in this tutorial uses port 27017 and the /var/lib/mongodb data directory.本教程中的mongod实例使用port 27017端口27017和/var/lib/mongodb数据目录。

The tutorial assumes that the /var/lib/mongodb directory exists and is the default dbPath. You may specify a different data directory or port as needed.本教程假设/var/lib/mongodb目录存在，并且是默认的dbPath。您可以根据需要指定其他数据目录或端口。

Connect to the instance连接到实例

Open a new terminal and connect to the cluster with mongosh:打开一个新终端，用mongosh连接到集群：

mongosh --port 27017

If you are connecting to a different deployment, specify additional command line options, such as --host, as needed to connect.如果要连接到其他部署，请根据需要指定其他命令行选项，如--host，以进行连接。

Create the user administrator创建用户管理员

Using mongosh:使用蒙古语：

1. switch to the admin database切换到admin数据库
2. add the myUserAdmin user with the userAdminAnyDatabase and readWriteAnyDatabase roles":添加具有userAdminAnyDatabase和readWriteAnyDatabase角色的myUserAdmin用户：

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [
      { role: "userAdminAnyDatabase", db: "admin" },
      { role: "readWriteAnyDatabase", db: "admin" }
    ]
  }
)

The userAdminAnyDatabase role allows this user to:userAdminAnyDatabase角色允许此用户：

• create users创建用户
• grant or revoke roles from users授予或撤销用户的角色
• create or modify customs roles创建或修改自定义角色

You can assign your user additional built-in roles or user-defined roles as needed.您可以根据需要为用户分配额外的内置角色或用户定义的角色。

The database where you create the user, in this example admin, is the user's authentication database. Although the user needs to authenticate to this database, the user can have roles in other databases. The user's authentication database doesn't limit the user's privileges.创建用户的数据库（在本例中为admin）是用户的身份验证数据库。虽然用户需要对此数据库进行身份验证，但用户可以在其他数据库中拥有角色。用户的身份验证数据库不会限制用户的权限。

Re-start the MongoDB instance with access control使用访问控制重新启动MongoDB实例

Shut down the mongod instance. Using mongosh, issue the following command:关闭mongod实例。使用mongosh发出以下命令：

db.adminCommand( { shutdown: 1 } )

Exit mongosh.退出猫鼬。

Start the mongod with access control enabled.在启用访问控制的情况下启动mongod。

• If you start the mongod from the command line, add the --auth command line option:如果从命令行启动mongod，请添加--auth命令行选项：

  mongod --auth --port 27017 --dbpath /var/lib/mongodb

• If you start the mongod using a configuration file, add the security.authorization configuration file setting:如果使用配置文件启动mongod，请添加security.authorization配置文件设置：

  security:
      authorization: enabled

Clients that connect to this instance must now authenticate themselves and can only perform actions as determined by their assigned roles.连接到此实例的客户端现在必须进行身份验证，并且只能执行由其分配的角色确定的操作。

Connect and authenticate as the user administrator以用户管理员身份进行连接和身份验证

Using mongosh, you can:使用mongosh，您可以：

mongosh --port 27017  --authenticationDatabase \
    "admin" -u "myUserAdmin" -p

mongosh --port 27017

use admin
db.auth("myUserAdmin", passwordPrompt()) // or cleartext password