Configure Self-Managed MongoDB with Kerberos Authentication on Linux在Linux上配置具有Kerberos身份验证的自管理MongoDB

Start mongod without Kerberos.在没有Kerberos的情况下启动mongod。

For the initial addition of Kerberos users, start mongod without Kerberos support.对于最初添加的Kerberos用户，请在不支持Kerberos的情况下启动mongod。

If a Kerberos user is already in MongoDB and has the privileges required to create a user, you can start mongod with Kerberos support.如果Kerberos用户已经在MongoDB中，并且具有创建用户所需的权限，则可以使用Kerberos支持启动mongod。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

Connect to mongod.连接到mongod。

Connect mongosh to the mongod instance. 将mongosh连接到mongod实例。If mongod has --auth enabled, ensure you connect with the privileges required to create a user.如果mongod启用了--auth，请确保您具有创建用户所需的权限进行连接。

Add Kerberos Principal(s) to MongoDB.将Kerberos主体添加到MongoDB。

Add a Kerberos principal, <username>@<KERBEROS REALM> or <username>/<instance>@<KERBEROS REALM>, to MongoDB in the $external database. 在$external数据库中的MongoDB中添加一个Kerberos主体，<username>@<KERBEROS REALM>或<username>/<instance>@<KERBEROS REALM>。Specify the Kerberos realm in all uppercase. 以大写字母指定Kerberos领域。The $external database allows mongod to consult an external source (e.g. Kerberos) to authenticate. $external数据库允许mongod查询外部源（例如Kerberos）进行身份验证。To specify the user's privileges, assign roles to the user.要指定用户的权限，请为用户分配角色。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$外部身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

The following example adds the Kerberos principal application/reporting@EXAMPLE.NET with read-only access to the records database:以下示例添加了Kerberos主体application/reporting@EXAMPLE.NET具有对records数据库的只读访问权限：

use $external
db.createUser(
   {
     user: "application/reporting@EXAMPLE.NET",
     roles: [ { role: "read", db: "records" } ]
   }
)

Add additional principals as needed. For every user you want to authenticate using Kerberos, you must create a corresponding user in MongoDB. For more information about creating and managing users, see User Management Commands.根据需要添加其他主体。对于每个要使用Kerberos进行身份验证的用户，您必须在MongoDB中创建一个相应的用户。有关创建和管理用户的详细信息，请参阅用户管理命令。

Start mongod with Kerberos support.使用Kerberos支持启动mongod。

To start mongod with Kerberos support, set the environmental variable KRB5_KTNAME to the path of the keytab file and the mongod parameter authenticationMechanisms to GSSAPI in the following form:要使用Kerberos支持启动mongod，请将环境变量KRB5_KTNAME设置为keytab文件的路径，并将mongod参数authenticationMechanisms设置为GSSAPI，格式如下：

env KRB5_KTNAME=<path to keytab file> \
mongod \
--setParameter authenticationMechanisms=GSSAPI \
<additional mongod options>

Include additional options as required for your configuration. 根据配置要求，包括其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

For example, the following starts a standalone mongod instance with Kerberos support:例如，以下内容启动了一个支持Kerberos的独立mongod实例：

env KRB5_KTNAME=/opt/mongodb/mongod.keytab \
/opt/mongodb/bin/mongod --auth \
--setParameter authenticationMechanisms=GSSAPI \
--dbpath /opt/mongodb/data --bind_ip localhost,<hostname(s)|ip address(es)>

The path to your mongod as well as your keytab file may differ. mongod和keytab文件的路径可能不同。The keytab file must be only accessible to the owner of the mongod process.keytab文件必须只能由mongod进程的所有者访问。

With the official .deb or .rpm packages, you can set the KRB5_KTNAME in a environment settings file. See KRB5_KTNAME for details.使用官方.deb或.rpm包，您可以在环境设置文件中设置KRB5_KTNAME。详见KRB5_KTNAME。

Connect mongosh to mongod and authenticate.将mongosh连接到mongod并进行身份验证。

Connect mongosh client as the Kerberos principal application/reporting@EXAMPLE.NET. 将mongosh客户端连接为Kerberos主体application/reporting@EXAMPLE.NET。Before connecting, you must have used Kerberos's kinit program to get credentials for application/reporting@EXAMPLE.NET.在连接之前，您必须使用Kerberos的kinit程序来获取application/reporting@EXAMPLE.NET的凭据。

You can connect and authenticate from the command line.您可以通过命令行进行连接和身份验证。

mongosh --host hostname.example.net --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username application/reporting@EXAMPLE.NET

If you are connecting to a system whose hostname matches the Kerberos name, ensure that you specify the fully qualified domain name (FQDN) for the --host option, rather than an IP address or unqualified hostname.如果要连接到主机名与Kerberos名称匹配的系统，请确保为--host选项指定完全限定域名（FQDN），而不是IP地址或非限定主机名。

If you are connecting to a system whose hostname does not match the Kerberos name, first connect mongosh to the mongod, and then from mongosh, use the db.auth() method to authenticate in the $external database.如果要连接到主机名与Kerberos名称不匹配的系统，请先将mongosh连接到mongod，然后从mongosh使用db.auth()方法在$external数据库中进行身份验证。

use $external
db.auth( { mechanism: "GSSAPI", user: "application/reporting@EXAMPLE.NET" } )