Update Self-Managed Replica Set to Keyfile Authentication (No Downtime)将自我管理副本集更新为键文件身份验证（无停机时间）

Create the user administrator.创建用户管理员。

Connect to the primary to create a user with userAdminAnyDatabase role. 连接到主服务器以创建具有userAdminAnyDatabase角色的用户。The userAdminAnyDatabase role grants access to user creation on any database in the deployment.userAdminAnyDatabase角色授予对部署中任何数据库上的用户创建的访问权限。

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.以下示例在admin数据库上创建了具有userAdminAnyDatabase角色的用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: " passwordPrompt(),     // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

At the completion of this procedure, any client that administers users in the replica set must authenticate as this user, or a user with similar permissions.完成此过程后，管理副本集中用户的任何客户端都必须以该用户或具有类似权限的用户身份进行身份验证。

See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参阅数据库用户角色。

Create the cluster administrator.创建群集管理员。

Connect to the primary to create a user with clusterAdmin role. 连接到主服务器以创建具有clusterAdmin角色的用户。The clusterAdmin role grants access to replication operations, such as configuring the replica set.clusterAdmin角色授予对复制操作的访问权限，例如配置副本集。

The following example creates the user ravi with the clusterAdmin role on the admin database.以下示例在admin数据库上创建了具有clusterAdmin角色的用户ravi。

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" :  passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ] 
  }
)

At the completion of this procedure, any client that administrates or maintains the replica set must authenticate as this user, or a user with similar permissions.完成此过程后，任何管理或维护副本集的客户端都必须以该用户或具有类似权限的用户身份进行身份验证。

See Cluster Administration Roles for a full list of built-in roles related to replica set operations.有关与副本集操作相关的内置角色的完整列表，请参阅群集管理角色。

Create users for client applications.为客户端应用程序创建用户。

Create users to allow client application to connect and interact with the replica set. At the completion of this tutorial, clients must authenticate as a configured user to connect to the replica set.创建用户以允许客户端应用程序连接副本集并与之交互。完成本教程后，客户端必须作为配置用户进行身份验证才能连接到副本集。

See Database User Roles for basic built-in roles to use in creating read-only and read-write users.有关创建只读和读写用户时使用的基本内置角色，请参阅数据库用户角色。

The following creates a user with read and write permissions on the foo database.下面创建一个对foo数据库具有读写权限的用户。

Create a user with the readWrite role in the foo database.在foo数据库中创建一个具有readWrite角色的用户。

db.getSiblingDB("foo").createUser(
  {
    "user" : "joe",
    "pwd" :  passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "readWrite", "db" : "foo" } ] 
  }
)

Clients authenticating as this user can perform read and write operations against the foo database. 以该用户身份进行身份验证的客户端可以对foo数据库执行读写操作。See Authenticate a User with Self-Managed Deployments for more on creating an authenticated connection to the replica set.有关创建到副本集的经过身份验证的连接的更多信息，请参阅使用自我管理部署对用户进行身份验证。

See the Add Users tutorial for more information on adding users. 有关添加用户的更多信息，请参阅添加用户教程。Consider security best practices when adding new users.添加新用户时考虑安全最佳实践。

Update Client Applications更新客户端应用程序

At this point in the procedure, the replica set does not enforce authentication. However, client applications can still specify auth credentials and connect to the replica set.在该过程的这一点上，副本集不强制进行身份验证。但是，客户端应用程序仍然可以指定身份验证凭据并连接到副本集。

Update client applications to authenticate to the replica set using a configured user. Authenticated connections require a username, password, and the authentication database. 更新客户端应用程序，使用配置的用户对副本集进行身份验证。经过身份验证的连接需要用户名、密码和身份验证数据库。See Authenticate a User with Self-Managed Deployments.请参阅使用自我管理部署对用户进行身份验证。

For example, the following connects to a replica set named mongoRepl and authenticates as the user joe.例如，以下内容连接到名为mongoRepl的副本集，并验证为用户joe。

mongosh  -u joe -password  -authenticationDatabase foo --host mongoRepl/mongo1.example.net:27017, mongo2.example.net:27017, mongo3.example.net:27017

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果不在-p命令行选项中指定密码，mongosh会提示输入密码。

If your application uses a MongoDB driver, see the associated driver documentation for instructions on creating an authenticated connection.如果应用程序使用MongoDB驱动程序，请参阅相关的驱动程序文档，了解创建经过身份验证的连接的说明。

At the completion of this tutorial, the replica set rejects non-authenticated client connections. Performing this step now ensures clients can connect to the replica set before and after the transition.完成本教程后，副本集将拒绝未经身份验证的客户端连接。现在执行此步骤可确保客户端可以在转换前后连接到副本集。

Create a keyfile.创建键文件。

With keyfile authentication, each mongod instances in the replica set uses the contents of the keyfile as the shared password for authenticating other members in the deployment. 通过键文件身份验证，副本集中的每个mongod实例都使用键文件的内容作为共享密码，用于对部署中的其他成员进行身份验证。Only mongod instances with the correct keyfile can join the replica set.只有具有正确键文件的mongod实例才能加入副本集。

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. All members of the replica set must share at least one common key.键的长度必须在6到1024个字符之间，并且只能包含base64集合中的字符。副本集的所有成员必须至少共享一个公共键。

You can generate a keyfile using any method you choose. 您可以使用您选择的任何方法生成键文件。For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. 例如，以下操作使用openssl生成一个复杂的伪随机1024字符串，用作共享密码。It then uses chmod to change file permissions to provide read permissions for the file owner only:然后，它使用chmod更改文件权限，仅为文件所有者提供读取权限：

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用键文件的其他详细信息和要求，请参阅键文件。

Copy the keyfile to each replica set member.将键文件复制到每个副本集成员。

Copy the keyfile to each server hosting the replica set members. Ensure that the user running the mongod instances is the owner of the file and can access the keyfile.将键文件复制到承载副本集成员的每个服务器。确保运行mongod实例的用户是文件的所有者，并且可以访问键文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod instances, such as a USB drive or a network attached storage device.避免将键文件存储在容易与托管mongod实例的硬件断开连接的存储介质上，例如USB驱动器或网络连接的存储设备。

Restart each secondary or arbiter member of the replica set with transitionToAuth.使用transitionToAuth重新启动副本集的每个辅助成员或仲裁器成员。

Restart each secondary or arbiter member in the replica set, including in the configuration:重新启动副本集中的每个辅助或仲裁器成员，包括配置中的成员：

• The security.transitionToAuth setting. security.transitionToAuth设置。Starting the mongod with security.transitionToAuth set to true places the instance in a transition state where it can accept and create both authenticated and non-authenticated connections.将security.transitionToAuth设置为true启动mongod会将实例置于转换状态，在该状态下，它可以接受和创建经过身份验证和未经身份验证的连接。
• An internal authentication mechanism such as security.keyFile.一种内部身份验证机制，如security.keyFile。

You must restart each member one at a time to ensure a majority of members in the replica set remain online.您必须一次重新启动每个成员，以确保副本集中的大多数成员保持在线。

admin = db.getSiblingDB("admin")
admin.shutdownServer()

security:
  keyFile: <path-to-keyfile>
  transitionToAuth: true
replication:
  replSetName: <replicaSetName>

Specify the --config option with the path to the configuration file when starting the mongod.启动mongod时，使用配置文件的路径指定--config选项。

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

Alternatively, you can use the equivalent mongod command-line options (e.g. --transitionToAuth and --keyFile) when starting your mongod. 或者，您可以在启动mongod时使用等效的mongod命令行选项（例如--transitionToAuth和--keyFile）。See the mongod reference page for a complete list of options.有关完整的选项列表，请参阅mongod参考页面。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

At the end of this step, all secondaries and arbiters should be up and running with security.transitionToAuth set to true.在此步骤结束时，所有次级服务器和仲裁器都应该启动并运行，并将security.transitionToAuth设置为true。

Step down the primary member of the replica set and restart it with --transitionToAuth.关闭副本集的主要成员，并使用--transitionToAuth重新启动它。

Step down the primary member in the replica set and restart the member, including in its configuration:关闭副本集中的primary成员并重新启动该成员，包括在其配置中：

• The security.transitionToAuth setting. security.transitionToAuth设置。Starting the mongod with security.transitionToAuth set to true places the instance in a transition state where it can accept and create both authenticated and non-authenticated connections.将security.transitionToAuth设置为true启动mongod会将实例置于转换状态，在该状态下，它可以接受和创建经过身份验证和未经身份验证的连接。
• An internal authentication mechanism such as security.keyFile.一种内部身份验证机制，如security.keyFile。

rs.stepDown()

admin = db.getSiblingDB("admin")
admin.shutdownServer()

security:
  keyFile: <path-to-keyfile>
  transitionToAuth: true
replication:
  replSetName: <replicaSetName>
  

Start the mongod using the configuration file.使用配置文件启动mongod。

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

Alternatively, you can use the equivalent mongod command-line options (e.g. --transitionToAuth and --keyFile) when starting your mongod. 或者，您可以在启动mongod时使用等效的mongod命令行选项（例如--transitionToAuth和--keyFile）。See the mongod reference page for a complete list of options.有关完整的选项列表，请参阅mongod参考页面。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

At the end of this step, all members of the replica set should be up and running with security.transitionToAuth set to true and security.keyFile set to the keyfile path.在此步骤结束时，副本集的所有成员都应启动并运行，security.transitionToAuth设置为true，security.keyFile设置为键文件路径。

Restart secondaries and arbiters without 重新启动二级服务器和仲裁器，而无需--transitionToAuth

Restart each secondary or arbiter member in the replica set, removing the security.transitionToAuth option on restart. 重新启动副本集中的每个辅助成员或仲裁器成员，在重新启动时删除security.transitionToAuth选项。You must do this one at a time to ensure a majority of members in the replica set remain online.您必须一次执行一个操作，以确保副本集中的大多数成员保持在线。

If the majority of replica set members are offline at the same time, the replica set may go into read-only mode.如果大多数副本集成员同时脱机，则副本集可能会进入只读模式。

admin = db.getSiblingDB("admin")
admin.shutdownServer()

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>

Start the mongod using the configuration file:使用配置文件启动mongod：

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

You can also use the equivalent mongod options when starting your mongod. 启动mongod时，您还可以使用等效的mongod选项。See the mongod reference page for a complete list of options.有关完整的选项列表，请参阅mongod参考页面。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

At the end of this step, all secondaries and arbiters should be up and running with internal authentication configured, but without security.transitionToAuth. 在此步骤结束时，所有二级服务器和仲裁器都应已启动并运行，并配置了内部身份验证，但没有security.transitionToAuth。Clients can only connect to these mongod instances by using the configured client authentication mechanism.客户端只能使用配置的客户端身份验证机制连接到这些mongod实例。

Step down and restart the primary replica set member without --transitionToAuth.在不使用--transitionToAuth的情况下关闭并重新启动主副本集成员。

Step down the primary member in the replica set, then restart it without the security.transitionToAuth option.关闭副本集中的primary成员，然后在不使用security.transitionToAuth选项的情况下重新启动它。

rs.stepDown()

admin = db.getSiblingDB("admin")
admin.shutdownServer()

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>
  

Start the mongod using the configuration file:使用配置文件启动mongod：

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

You can also use the equivalent mongod options when starting your mongod. See the mongod reference page for a complete list of options.启动mongod时，您还可以使用等效的mongod选项。有关完整的选项列表，请参阅mongod参考页面。

Include additional settings as appropriate to your deployment.根据部署情况包括其他设置。

At the end of this step, all members of the replica set should be up and running with authentication enforced. Clients can only connect to these mongod instances by using the configured client authentication mechanism.在此步骤结束时，副本集的所有成员都应启动并运行，并强制执行身份验证。客户端只能使用配置的客户端身份验证机制连接到这些mongod实例。