Configure Self-Managed MongoDB with Kerberos Authentication on Windows在Windows上配置具有Kerberos身份验证的自管理MongoDB

Start mongod.exe without Kerberos.在没有Kerberos的情况下启动mongod.exe。

For the initial addition of Kerberos users, start mongod.exe without Kerberos support.对于最初添加的Kerberos用户，请在不支持Kerberos的情况下启动mongod.exe。

If a Kerberos user is already in MongoDB and has the privileges required to create a user, you can start mongod.exe with Kerberos support.如果Kerberos用户已经在MongoDB中，并且具有创建用户所需的权限，则可以使用Kerberos支持启动mongod.exe。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

Connect to mongod.连接到mongod。

Connect mongosh to the mongod.exe instance. 将mongosh连接到mongod.exe实例。If mongod.exe has --auth enabled, ensure you connect with the privileges required to create a user.如果mongod.exe启用了--auth，请确保您具有创建用户所需的权限进行连接。

Add Kerberos Principal(s) to MongoDB.将Kerberos主体添加到MongoDB。

Add a Kerberos principal, <username>@<KERBEROS REALM>, to MongoDB in the $external database. Specify the Kerberos realm in ALL UPPERCASE. 将Kerberos主体<username>@<KERBEROS REALM>添加到$external数据库中的MongoDB。在所有大写字母中指定Kerberos领域。The $external database allows mongod.exe to consult an external source (e.g. Kerberos) to authenticate. To specify the user's privileges, assign roles to the user.$external数据库允许mongod.exe查询外部源（例如Kerberos）进行身份验证。要指定用户的权限，请为用户分配角色。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

The following example adds the Kerberos principal reportingapp@EXAMPLE.NET with read-only access to the records database:以下示例添加了Kerberos主体reportingapp@EXAMPLE.NET具有对records数据库的只读访问权限：

use $external
db.createUser(
   {
     user: "reportingapp@EXAMPLE.NET",
     roles: [ { role: "read", db: "records" } ]
   }
)

Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. For more information about creating and managing users, see User Management Commands.根据需要添加其他主体。对于每个要使用Kerberos进行身份验证的用户，您必须在MongoDB中创建一个相应的用户。有关创建和管理用户的详细信息，请参阅用户管理命令。

Start mongod.exe with Kerberos support.使用Kerberos支持启动mongod.exe。

You must start mongod.exe as the service principal account.您必须将mongod.exe作为服务主体帐户启动。

To start mongod.exe with Kerberos support, set the mongod.exe parameter authenticationMechanisms to GSSAPI:要启动支持Kerberos的mongod.exe，请将mongod.exe参数authenticationMechanisms设置为GSSAPI：

mongod.exe --setParameter authenticationMechanisms=GSSAPI <additional mongod.exe options>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

For example, the following starts a standalone mongod.exe instance with Kerberos support:例如，以下内容启动了一个支持Kerberos的独立mongod.exe实例：

mongod.exe --auth --setParameter authenticationMechanisms=GSSAPI --bind_ip localhost,<hostname(s)|ip address(es)>

Connect mongosh.exe shell to mongod.exe and authenticate.将mongosh.exe shell连接到mongod.exe并进行身份验证。

Connect the mongosh shell client as the Kerberos principal application@EXAMPLE.NET.将mongosh shell客户端连接为Kerberos主体application@EXAMPLE.NET。

You can connect and authenticate from the command line.您可以通过命令行进行连接和身份验证。

Using cmd.exe:使用cmd.exe：

mongosh.exe --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase=$external --username reportingapp@EXAMPLE.NET

Using Windows PowerShell:使用Windows PowerShell：

mongosh.exe --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username reportingapp@EXAMPLE.NET  

If you are connecting to a system whose hostname matches the Kerberos name, ensure that you specify the fully qualified domain name (FQDN) for the --host option, rather than an IP address or unqualified hostname.如果要连接到主机名与Kerberos名称匹配的系统，请确保为--host选项指定完全限定域名（FQDN），而不是IP地址或非限定主机名。

If you are connecting to a system whose hostname does not match the Kerberos name, first connect the mongosh shell to mongod.exe, and then from the mongosh shell, use the db.auth() method to authenticate in the $external database.如果要连接到主机名与Kerberos名称不匹配的系统，请首先将mongosh shell连接到mongod.exe，然后从mongosh shell使用db.auth()方法在$external数据库中进行身份验证。

use $external
db.auth( { mechanism: "GSSAPI", user: "reportingapp@EXAMPLE.NET" } )