Database Manual / Self-Managed Deployments / Security / Authentication / Internal

Update Self-Managed Sharded Cluster to Keyfile Authentication (No Downtime)将自我管理的分片群集更新为键文件身份验证（无停机）

Overview概述

Important

The following procedure applies to sharded clusters using MongoDB 3.4 or later.以下过程适用于使用MongoDB 3.4或更高版本的分片集群。

Earlier versions of MongoDB do not support no-downtime upgrade. For sharded clusters using earlier versions of MongoDB, see Update Self-Managed Sharded Cluster to Keyfile Authentication.早期版本的MongoDB不支持无停机升级。对于使用早期版本MongoDB的分片集群，请参阅将自我管理分片集群更新为键文件身份验证。

A MongoDB sharded cluster can enforce user authentication as well as internal authentication of its components to secure against unauthorized access.MongoDB分片集群可以强制用户身份验证及其组件的内部身份验证，以防止未经授权的访问。

The following tutorial describes a procedure using security.transitionToAuth to transition an existing sharded cluster to enforce authentication without incurring downtime.以下教程描述了一个使用security.transitionToAuth转换现有分片集群以强制身份验证而不会导致停机的过程。

Before you attempt this tutorial, please familiarize yourself with the contents of this document.在您尝试本教程之前，请熟悉本文档的内容。

Considerations注意事项

Cloud Manager and Ops Manager云经理和运维经理

If you are using Cloud Manager or Ops Manager to manage your deployment, refer to Configure Access Control for MongoDB Deployments in the Cloud Manager manual or Ops Manager manual to enforce authentication.如果您使用Cloud Manager或Ops Manager来管理部署，请参阅Cloud Manager手册或Ops管理器手册中的“为MongoDB部署配置访问控制”以强制进行身份验证。

IP BindingIP绑定

MongoDB binaries, mongod and mongos, bind to localhost by default.MongoDB二进制文件mongod和mongos默认绑定到localhost。

Internal and Client Authentication Mechanisms内部和客户端身份验证机制

This tutorial configures authentication using SCRAM for client authentication and a keyfile for internal authentication.本教程使用SCRAM配置客户端身份验证，使用键文件配置内部身份验证。

Refer to the Authentication on Self-Managed Deployments documentation for a complete list of available client and internal authentication mechanisms.有关可用客户端和内部身份验证机制的完整列表，请参阅自我管理部署的身份验证文档。

Architecture架构

This tutorial assumes that each shard replica set, as well as the config server replica set, can elect a new primary after stepping down its existing primary.本教程假设每个分片副本集以及配置服务器副本集都可以在退出现有主副本集后选择一个新的主副本集。

A replica set can elect a primary only if both of the following conditions are true:只有当以下两个条件都为真时，副本集才能选择主副本：

Minimum number of mongos instancesmongos实例的最小数量

Ensure your sharded cluster has at least two mongos instances available. This tutorial requires restarting each mongos in the cluster. 确保分片集群至少有两个mongos实例可用。本教程要求重新启动集群中的每个mongos。If your sharded cluster has only one mongos instance, this results in downtime during the period that the mongos is offline.如果分片集群只有一个mongos实例，这会导致mongos离线期间停机。

Before You Begin开始之前

Starting in MongoDB 8.0, you can use the directShardOperations role to perform maintenance operations that require you to execute commands directly against a shard.从MongoDB 8.0开始，您可以使用directShardOperations角色执行维护操作，这些操作要求您直接对分片执行命令。

Warning

Running commands using the directShardOperations role can cause your cluster to stop working correctly and may cause data corruption. 使用directShardOperations角色运行命令可能会导致集群停止正常工作，并可能导致数据损坏。Only use the directShardOperations role for maintenance purposes or under the guidance of MongoDB support. Once you are done performing maintenance operations, stop using the directShardOperations role.仅将directShardOperations角色用于维护目的或在MongoDB支持的指导下使用。完成维护操作后，停止使用directShardOperations角色。

Enforce Keyfile Access Control on an Existing Sharded Cluster对现有分片群集实施键文件访问控制

Create and Distribute the Keyfile创建和分发键文件

With keyfile authentication, each mongod or mongos instances in the sharded cluster uses the contents of the keyfile as the shared password for authenticating other members in the deployment. 通过键文件身份验证，分片集群中的每个mongod或mongos实例都使用键文件的内容作为共享密码，用于对部署中的其他成员进行身份验证。Only mongod or mongos instances with the correct keyfile can join the sharded cluster.只有具有正确键文件的mongod或mongos实例才能加入分片集群。

Note

Keyfiles for internal membership authentication用于内部成员身份验证的键文件 use YAML format to allow for multiple keys in a keyfile. The YAML format accepts either:使用YAML格式允许键文件中有多个键。YAML格式接受以下任一格式：

  • A single key string (same as in earlier versions)单个键字符串（与早期版本相同）
  • A sequence of key strings一串键串

The YAML format is compatible with the existing single-key keyfiles that use the text file format.YAML格式与使用文本文件格式的现有单键键文件兼容。

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. All members of the sharded cluster must share at least one common key.键的长度必须在6到1024个字符之间，并且只能包含base64集合中的字符。分片集群的所有成员必须至少共享一个公共键。

Note

On UNIX systems, the keyfile must not have group or world permissions. On Windows systems, keyfile permissions are not checked.在UNIX系统上，键文件不得具有组或世界权限。在Windows系统上，不检查键文件权限。

You can generate a keyfile using any method you choose. For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. 您可以使用您选择的任何方法生成键文件。例如，以下操作使用openssl生成一个复杂的伪随机1024字符串，用作共享密码。It then uses chmod to change file permissions to provide read permissions for the file owner only:然后，它使用chmod更改文件权限，仅为文件所有者提供读取权限：

openssl rand -base64 755 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

Copy the keyfile to each server hosting the sharded cluster members. 将键文件复制到托管分片集群成员的每个服务器。Ensure that the user running the mongod or mongos instances is the owner of the file and can access the keyfile.确保运行mongod或mongos实例的用户是文件的所有者，并且可以访问键文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod or mongos instances, such as a USB drive or a network attached storage device.避免将键文件存储在容易与托管mongod或mongos实例的硬件断开连接的存储介质上，例如USB驱动器或网络连接的存储设备。

For more information on using keyfiles for internal authentication, refer to Keyfiles.有关使用键文件进行内部身份验证的更多信息，请参阅键文件。

Configure Sharded Cluster Admin User and Client Users配置分片群集管理用户和客户端用户

You must connect to a mongos to complete the steps in this section. The users created in these steps are cluster-level users and cannot be used for accessing individual shard replica sets.您必须连接到mongos才能完成本节中的步骤。在这些步骤中创建的用户是集群级用户，不能用于访问单个分片副本集。

1

Create the adminstrator user.创建管理员用户。

Use the db.createUser() method to create an administrator user and assign it the following roles:使用db.createUser()方法创建管理员用户，并为其分配以下角色：

Clients performing maintenance operations or user administrative operations on the sharded cluster must authenticate as this user at the completion of this tutorial. Create this user now to ensure that you have access to the cluster after enforcing authentication.在完成本教程时，对分片集群执行维护操作或用户管理操作的客户端必须以该用户身份进行身份验证。立即创建此用户，以确保在强制身份验证后可以访问群集。

admin = db.getSiblingDB("admin");
admin.createUser(
  {
    user: "admin",
    pwd: "<password>",
    roles: [
      { role: "clusterAdmin", db: "admin" },
      { role: "userAdmin", db: "admin" }
    ]
  }
);

Important

Passwords should be random, long, and complex to prevent or hinder malicious access.密码应该是随机的、长的和复杂的，以防止或阻止恶意访问。

2

Optional: Create additional users for client applications.可选：为客户端应用程序创建其他用户。

In addition to the administrator user, you can create additional users before enforcing authentication.. This ensures access to the sharded cluster once you fully enforce authentication.除了管理员用户，您还可以在强制身份验证之前创建其他用户。。这可确保在完全强制身份验证后访问分片集群。

Example示例

The following operation creates the user joe on the marketing database, assigning to this user the readWrite role on the marketing database`.以下操作将在marketing数据库上创建用户joe，并为该用户分配marketing数据库上的readWrite角色。

db.getSiblingDB("marketing").createUser(
  {
    "user": "joe",
    "pwd": "<password>",
    "roles": [ { "role" : "readWrite", "db" : "marketing" } ]
  }
)

Clients authenticating as "joe" can perform read and write operations on the marketing database.以"joe"身份验证的客户端可以对marketing数据库执行读写操作。

See Database User Roles for roles provided by MongoDB.有关MongoDB提供的角色，请参阅数据库用户角色。

See the Add Users tutorial for more information on adding users. Consider security best practices when adding new users.有关添加用户的更多信息，请参阅添加用户教程。添加新用户时考虑安全最佳实践。

3

Optional: Update client applications to specify authentication credentials.可选：更新客户端应用程序以指定身份验证凭据。

While the sharded cluster does not currently enforce authentication, you can still update client applications to specify authentication credentials when connecting to the sharded cluster. This may prevent loss of connectivity at the completion of this tutorial.虽然分片集群当前不强制身份验证，但您仍然可以在连接到分片集群时更新客户端应用程序以指定身份验证凭据。这可以防止在完成本教程时失去连接。

Example示例

The following operation connects to the sharded cluster using mongosh, authenticating as the user joe on the marketing database.以下操作使用mongosh连接到分片集群，在marketing数据库上验证用户joe的身份。

mongosh  --username "joe" --password "<password>" \
  --authenticationDatabase "marketing" --host mongos1.example.net:27017

If your application uses a MongoDB driver, see the associated driver documentation for instructions on creating an authenticated connection.如果应用程序使用MongoDB驱动程序，请参阅相关的驱动程序文档，了解创建经过身份验证的连接的说明。

Transition Each mongos Instance to Enforce Authentication转换每个mongos实例以强制身份验证

1

Create a new mongos configuration file.创建一个新的mongos配置文件。

For each mongos:对于每一个mongos：

  1. Copy the existing mongos configuration file, giving it a distinct name such as <filename>-secure.conf (or .cfg if using Windows). 复制现有的mongos配置文件，为其指定一个不同的名称，如<filename>-secure.conf（如果使用Windows，则为.cfg）。You will use this new configuration file to transition the mongos to enforce authentication in the sharded cluster. Retain the original configuration file for backup purposes.您将使用这个新的配置文件来转换mongos，以在分片集群中强制进行身份验证。保留原始配置文件以备备份。

  2. To the new configuration file, add the following settings:在新的配置文件中，添加以下设置：

    • security.transitionToAuth set to 设置为true

    • security.keyFile set to the keyfile path.设置为键文件路径。

      If using a different internal authentication mechanism, specify settings appropriate for the mechanism.如果使用不同的内部身份验证机制，请指定适合该机制的设置。

    security:
       transitionToAuth: true
       keyFile: <path-to-keyfile>

    The new configuration file should contain all of the configuration settings previously used by the mongos as well as the new security settings.新的配置文件应包含mongos以前使用的所有配置设置以及新的安全设置。

2

One at a time, restart the mongos with the new configuration file.一次一个，用新的配置文件重新启动mongos。

Note

If your cluster has only one mongos, this step results in downtime while the mongos is offline.如果集群只有一个mongos，这一步会导致mongos离线时停机。

Follow the procedure to restart the mongos instance, one mongos at a time:按照以下过程重新启动mongos实例，一次一个mongos：

  1. Connect to the mongos to shutdown.连接到mongos以关闭。

  2. Use the db.shutdownServer() method against the admin database to safely shut down the mongos.对admin数据库使用db.shutdownServer()方法来安全关闭mongos。

    db.getSiblingDB("admin").shutdownServer()

  3. Restart mongos with the new configuration file, specifying the path to the config file using --config. 使用新的配置文件重新启动mongos，使用--config指定配置文件的路径。For example, if the new configuration file were named mongos-secure.conf:例如，如果新的配置文件名为mongos-secure.conf：

    mongos --config <path>/mongos-secure.conf

    where <path> represents the system path to the folder containing the new configuration file.其中<path>表示包含新配置文件的文件夹的系统路径。

Repeat the restart process for the next mongos instance until all mongos instances in the sharded cluster have been restarted.对下一个mongos实例重复重启过程，直到分片集群中的所有mongos示例都已重启。

At the end of this section, all mongos instances in the sharded cluster are running with security.transitionToAuth and security.keyFile internal authentication.在本节末尾，分片集群中的所有mongos实例都使用security.transitionToAuth和security.keyFile内部身份验证运行。

Transition Config Server Replica Set Members to Enforce Authentication转换配置服务器副本集成员以强制身份验证

1

Create a new mongod configuration file.创建一个新的mongod配置文件。

For each mongod in the config server replica set,对于配置服务器副本集中的每个mongod，

  1. Copy the existing mongod configuration file, giving it a distinct name such as <filename>-secure.conf (or .cfg if using Windows). 复制现有的mongod配置文件，为其指定一个不同的名称，如<filename>-secureconf（如果使用Windows，则为.cfg）。You will use this new configuration file to transition the mongod to enforce authentication in the sharded cluster. Retain the original configuration file for backup purposes.您将使用这个新的配置文件来转换mongod，以在分片集群中强制进行身份验证。保留原始配置文件以备备份。

  2. To the new configuration file, add the following settings:在新的配置文件中，添加以下设置：

    • security.transitionToAuth set to 设置为true

    • security.keyFile set to the keyfile path.设置为键文件路径。

      If using a different internal authentication mechanism, specify settings appropriate for the mechanism.如果使用不同的内部身份验证机制，请指定适合该机制的设置。

    security:
       transitionToAuth: true
       keyFile: <path-to-keyfile>
2

One at a time, restart the mongod with the new configuration file.一次一个，用新的配置文件重新启动mongod。

Restart the replica set, one member at a time, starting with the secondary members.重新启动副本集，一次一个成员，从次要成员开始。

  1. To restart the secondary members one at a time,为了一次重新启动一个secondary成员，

    1. Connect to the mongod and use the db.shutdownServer() method against the admin database to safely shut down the mongod.连接到mongod，并对admin数据库使用db.shutdownServer()方法安全关闭mongod。

      db.getSiblingDB("admin").shutdownServer()

    2. Restart the mongod with the new configuration file, specifying the path to the config file using --config. 使用新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the new configuration file.其中<path>表示包含新配置文件的文件夹的系统路径。

    Once this member is up, repeat for the next secondary member.此成员启动后，对下一个次要成员重复此操作。

  2. Once all the secondary members have restarted and are up, restart the primary:所有次要成员重新启动并启动后，重新启动主要成员：

    1. Connect to the mongod.连接到mongod。

    2. Use the rs.stepDown() method to step down the primary and trigger an election.使用rs.stepDown()方法取消初选并触发选举。

      rs.stepDown()

      You can use the rs.status() method to ensure the replica set has elected a new primary.您可以使用rs.status()方法来确保副本集已选择新的主副本。

    3. Once you step down the primary and a new primary has been elected, shut down the old primary using the db.shutdownServer() method against the admin database.一旦您关闭了主服务器并选择了新的主服务器，请使用db.shutdownServer()方法对admin数据库关闭旧的主服务器。

      db.getSiblingDB("admin").shutdownServer()

    4. Restart the mongod with the new configuration file, specifying the path to the config file using --config. 使用新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the new configuration file.其中<path>表示包含新配置文件的文件夹的系统路径。

At the end of this section, all mongod instances in the config server replica set is running with security.transitionToAuth and security.keyFile internal authentication.在本节末尾，配置服务器副本集中的所有mongod实例都使用security.transitionToAuth和security.keyFile内部身份验证运行。

Transition Each Shard Replica Set Members to Enforce Authentication转换每个分片副本集成员以强制身份验证

Create the shard-local administrator创建分片本地管理员

In a sharded cluster that enforces authentication, each shard replica set should have its own shard-local administrator. 在强制身份验证的分片集群中，每个分片副本集都应该有自己的分片本地管理员。You cannot use a shard-local administrator for one shard to access another shard or the sharded cluster.您不能使用一个分片的本地管理员来访问另一个分片或分片集群。

Connect to the primary member of each shard replica set and create a user with the db.createUser() method, assigning it the following roles:连接到每个分片副本集的主要成员，并使用db.createUser()方法创建一个用户，为其分配以下角色：

Tip

You can use the passwordPrompt() method in conjunction with various user authentication management methods and commands to prompt for the password instead of specifying the password directly in the method or command call. 您可以将passwordPrompt()方法与各种用户身份验证管理方法和命令结合使用，以提示输入密码，而不是直接在方法或命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "admin",
    pwd: passwordPrompt(),  // or cleartext password
    roles: [
      { role: "clusterAdmin", db: "admin" },
      { role: "userAdmin", db: "admin" }
    ]
  }
)

At the completion of this tutorial, if you want to connect to the shard to perform maintenance operation that require direct connection to a shard, you must authenticate as the shard-local administrator.完成本教程后，如果您想连接到分片以执行需要直接连接到分片来执行的维护操作，则必须以分片本地管理员的身份进行身份验证。

Note

Direct connections to a shard should only be for shard-specific maintenance and configuration. 与分片的直接连接应仅用于分片特定的维护和配置。In general, clients should connect to the sharded cluster through the mongos.一般来说，客户端应该通过mongos连接到分片集群。

Procedure过程

Transitioning one shard replica set at a time, repeat these steps for each shard replica set in the sharded cluster.一次转换一个分片副本集，对分片集群中的每个分片副本集中重复这些步骤。

1
Create a new mongod configuration file.创建一个新的mongod配置文件。

For each mongod in the shard replica set,对于分片复制集中的每个mongod，

  1. Copy the existing mongod configuration file, giving it a distinct name such as <filename>-secure.conf (or .cfg if using Windows). 复制现有的mongod配置文件，为其指定一个不同的名称，如<filename>-secure.conf-secureconf（如果使用Windows，则为.cfg）。You will use this new configuration file to transition the mongod to enforce authentication in the sharded cluster. Retain the original configuration file for backup purposes.您将使用这个新的配置文件来转换mongod，以在分片集群中强制进行身份验证。保留原始配置文件以备备份。

  2. To the new configuration file, add the following settings:在新的配置文件中，添加以下设置：

    • security.transitionToAuth set to true设置为true

    • security.keyFile set to the keyfile path.设置为键文件路径。

      If using a different internal authentication mechanism, specify settings appropriate for the mechanism.如果使用不同的内部身份验证机制，请指定适合该机制的设置。

    security:
       transitionToAuth: true
       keyFile: <path-to-keyfile>
2
One at a time, restart the mongod with the new configuration file.一次一个，用新的配置文件重新启动mongod。

Restart the replica set, one member at a time, starting with the secondary members.重新启动副本集，一次一个成员，从次要成员开始。

  1. To restart the secondary members one at a time,为了一次重新启动一个次级成员，

    1. Connect to the mongod and use the db.shutdownServer() method against the admin database to safely shut down the mongod.连接到mongod，并对admin数据库使用db.shutdownServer()方法安全关闭mongod。

      db.getSiblingDB("admin").shutdownServer()

    2. Restart the mongod with the new configuration file, specifying the path to the config file using --config. 使用新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the new configuration file.其中<path>表示包含新配置文件的文件夹的系统路径。

    Once this member is up, repeat for the next secondary member of the replica set until all secondaries have been updated.一旦此成员启动，对副本集的下一个次要成员重复此操作，直到所有次要成员都已更新。

  2. Once all the secondary members have restarted and are up, restart the primary:所有次要成员重新启动并启动后，重新启动主要成员：

    1. Connect to the mongod.连接到mongod。

    2. Use the rs.stepDown() method to step down the primary and trigger an election.使用rs.stepDown()方法取消初选并触发选举。

      rs.stepDown()

      You can use the rs.status() method to ensure the replica set has elected a new primary.您可以使用rs.status()方法来确保副本集已选择新的主副本。

    3. Once you step down the primary and a new primary has been elected, shut down the old primary using the db.shutdownServer() method against the admin database.一旦您关闭了主服务器并选择了新的主服务器，请使用db.shutdownServer()方法对admin数据库关闭旧的主服务器。

      db.getSiblingDB("admin").shutdownServer()

    4. Restart the mongod with the new configuration file, specifying the path to the config file using --config. 使用新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the new configuration file.其中<path>表示包含新配置文件的文件夹的系统路径。

At this point in the tutorial, every component of the sharded cluster is running with --transitionToAuth and security.keyFile internal authentication. 在本教程的这一点上，分片集群的每个组件都在使用--transitionToAuth和security.keyFile内部身份验证运行。The sharded cluster has at least one administrative user, and each shard replica set has a shard-local administrative user.分片集群至少有一个管理用户，每个分片副本集都有一个分片本地管理用户。

The remaining sections involve taking the sharded cluster out of the transition state to fully enforce authentication.其余部分涉及将分片集群从过渡状态中取出，以完全强制身份验证。

Restart Each mongos Instance without transitionToAuth重新启动每个mongos实例而不进行transitionToAuth

Important

At the end of this section, clients must specify authentication credentials to connect to the sharded cluster. Update clients to specify authentication credentials before completing this section to avoid loss of connectivity.在本节末尾，客户端必须指定身份验证凭据才能连接到分片集群。在完成此部分之前，更新客户端以指定身份验证凭据，以避免连接丢失。

To complete the transition to fully enforcing authentication in the sharded cluster, you must restart each mongos instance without the security.transitionToAuth setting.要完成向分片集群中完全强制身份验证的转换，您必须在不使用security.transitionToAuth设置的情况下重新启动每个mongos实例。

1

Remove transitionToAuth from the mongos configuration files.从mongos配置文件中删除transitionToAuth。

Remove the security.transitionToAuth key and its value from the mongos configuration files created during this tutorial. 从本教程中创建的mongos配置文件中删除security.transitionToAuth键及其值。Leave the security.keyFile setting added in the tutorial.保留教程中添加的security.keyFile设置。

security:
   keyFile: <path-to-keyfile>
2

Restart the mongos with the updated configuration file.使用更新的配置文件重新启动mongos。

Note

If your cluster has only one mongos, this step results in downtime while the mongos is offline.如果集群只有一个mongos，这一步会导致mongos离线时停机。

Follow the procedure to restart mongos instance, one mongos at a time:按照以下过程重新启动mongos实例，一次一个mongos：

  1. Connect to the mongos to shutdown.

  2. Use the db.shutdownServer() method against the admin database to safely shut down the mongos.对admin数据库使用db.shutdownServer()方法来安全关闭mongos。

    db.getSiblingDB("admin").shutdownServer()

  3. Restart mongos with the updated configuration file, specifying the path to the config file using --config. 使用更新的配置文件重新启动mongos，使用--config指定配置文件的路径。For example, if the updated configuration file were named mongos-secure.conf:例如，如果更新的配置文件名为mongos-secure.conf：

    mongos --config <path>/mongos-secure.conf

At the end of this section, all mongos instances enforce client authentication and security.keyFile internal authentication.在本节末尾，所有mongos实例都强制执行客户端身份验证和security.keyFile内部身份验证。

Restart Each Config Server Replica Set Member without transitionToAuth重新启动每个配置服务器副本集成员而不使用transitionToAuth

Important

At the end of this step, clients must specify authentication credentials to connect to the config server replica set. Update clients to specify authentication credentials before completing this section to avoid loss of connectivity.在此步骤结束时，客户端必须指定身份验证凭据以连接到配置服务器副本集。在完成此部分之前，更新客户端以指定身份验证凭据，以避免连接丢失。

To complete the transition to fully enforcing authentication in the sharded cluster, you must restart each mongod instance without the security.transitionToAuth setting.要完成向分片集群中完全强制身份验证的转换，您必须在不使用security.transitionToAuth设置的情况下重新启动每个mongod实例。

1

Remove transitionToAuth from the mongod configuration files.从mongod配置文件中删除transitionToAuth。

Remove the security.transitionToAuth key and its value from the config server configuration files created during this tutorial. Leave the security.keyFile setting added in the tutorial.从本教程中创建的配置服务器配置文件中删除security.transitionToAuth键及其值。保留教程中添加的security.keyFile设置。

security:
   keyFile: <path-to-keyfile>
2

One at a time, restart the mongod with the updated configuration file.一次一个，用更新的配置文件重新启动mongod。

Restart the replica set, one member at a time, starting with the secondary members.重新启动副本集，一次一个成员，从次要成员开始。

  1. To restart the secondary members one at a time,为了一次重新启动一个次级成员，

    1. Connect to the mongod and use the db.shutdownServer() method against the admin database to safely shut down the mongod.连接到mongod，并对admin数据库使用db.shutdownServer()方法安全关闭mongod。

      db.getSiblingDB("admin").shutdownServer()

    2. Restart the mongod with the updated configuration file, specifying the path to the config file using --config. 使用更新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the updated configuration file.其中<path>表示包含更新配置文件的文件夹的系统路径。

    Once this member is up, repeat for the next secondary member.此成员启动后，对下一个次要成员重复此操作。

  2. Once all the secondary members have restarted and are up, restart the primary:所有次要成员重新启动并启动后，重新启动主要成员：

    1. Connect to the mongod.连接到mongod。

    2. Use the rs.stepDown() method to step down the primary and trigger an election.使用rs.stepDown()方法取消初选并触发选举。

      rs.stepDown()

      You can use the rs.status() method to ensure the replica set has elected a new primary.您可以使用rs.status()方法来确保副本集已选择新的主副本。

    3. Once you step down the primary and a new primary has been elected, shut down the old primary using the db.shutdownServer() method against the admin database.一旦您关闭了主服务器并选择了新的主服务器，请使用db.shutdownServer()方法对admin数据库关闭旧的主服务器。

      db.getSiblingDB("admin").shutdownServer()

    4. Restart the mongod with the updated configuration file, specifying the path to the config file using --config. 使用更新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the updated configuration file.其中<path>表示包含更新配置文件的文件夹的系统路径。

At the end of this section, all mongod instances in the config server replica set enforce client authentication and security.keyFile internal authentication.在本节末尾，配置服务器副本集中的所有mongod实例都强制执行客户端身份验证和security.keyFile内部身份验证。

Restart Each Member in Each Shard Replica Set without transitionToAuth在不使用transitionToAuth的情况下重新启动每个分片副本集中的每个成员

Important

At the end of this step, clients must specify authentication credentials to connect to the shard replica set. Update clients to specify authentication credentials before completing this section to avoid loss of connectivity.在此步骤结束时，客户端必须指定身份验证凭据以连接到分片副本集。在完成此部分之前，更新客户端以指定身份验证凭据，以避免连接丢失。

To complete the transition to fully enforcing authentication in the sharded cluster, you must restart every member of every shard replica set in the sharded cluster without the security.transitionToAuth setting.要完成向分片集群中完全强制身份验证的过渡，您必须在没有security.transitionToAuth设置的情况下重新启动分片集群内每个分片副本集的每个成员。

Transitioning one shard replica set at a time, repeat these steps for each shard replica set in the sharded cluster.一次转换一个分片副本集，对分片集群中的每个分片副本集中重复这些步骤。

1

Remove transitionToAuth from the mongod configuration files.从mongod配置文件中删除transitionToAuth。

Remove the security.transitionToAuth key and its value from the config server configuration files created during this tutorial. 从本教程中创建的配置服务器配置文件中删除security.transitionToAuth键及其值。Leave the security.keyFile setting added in the tutorial.保留教程中添加的security.keyFile设置。

security:
   keyFile: <path-to-keyfile>
2

One at a time, restart the mongod with the updated configuration file.一次一个，用更新的配置文件重新启动mongod。

Restart the replica set, one member at a time, starting with the secondary members.重新启动副本集，一次一个成员，从次要成员开始。

  1. To restart the secondary members one at a time,为了一次重新启动一个次级成员，

    1. Connect to the mongod and use the db.shutdownServer() method against the admin database to safely shut down the mongod.连接到mongod，并对admin数据库使用db.shutdownServer()方法安全关闭mongod。

      db.getSiblingDB("admin").shutdownServer()

    2. Restart the mongod with the updated configuration file, specifying the path to the config file using --config. 使用更新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the updated configuration file.其中<path>表示包含更新配置文件的文件夹的系统路径。

    Once this member is up, repeat for the next secondary member.此成员启动后，对下一个次要成员重复此操作。

  2. Once all the secondary members have restarted and are up, restart the primary:所有次要成员重新启动并启动后，重新启动主要成员：

    1. Connect to the mongod.连接到mongod。

    2. Use the rs.stepDown() method to step down the primary and trigger an election.使用rs.stepDown()方法取消初选并触发选举。

      rs.stepDown()

      You can use the rs.status() method to ensure the replica set has elected a new primary.您可以使用rs.status()方法来确保副本集已选择新的主副本。

    3. Once you step down the primary and a new primary has been elected, shut down the old primary using the db.shutdownServer() method against the admin database.一旦您关闭了主服务器并选择了新的主服务器，请使用db.shutdownServer()方法对admin数据库关闭旧的主服务器。

      db.getSiblingDB("admin").shutdownServer()

    4. Restart the mongod with the updated configuration file, specifying the path to the config file using --config. 使用更新的配置文件重新启动mongod，使用--config指定配置文件的路径。For example, if the new configuration file were named mongod-secure.conf:例如，如果新的配置文件名为mongod-secure.conf：

      mongod --config <path>/mongod-secure.conf

      where <path> represents the system path to the folder containing the updated configuration file.其中<path>表示包含更新配置文件的文件夹的系统路径。

At the end of this section, all mongos and mongod instances in the sharded cluster enforce client authentication and security.keyFile internal authentication. 在本节末尾，分片集群中的所有mongos和mongod实例都强制执行客户端身份验证和security.keyFile内部身份验证。Clients can only connect to the sharded cluster by using the configured client authentication mechanism. Additional components can only join the cluster by specifying the correct keyfile.客户端只能使用配置的客户端身份验证机制连接到分片集群。其他组件只能通过指定正确的键文件加入集群。

X.509 Certificate Internal Authentication证书内部身份验证

MongoDB supports X.509 certificate authentication for use with a secure TLS/SSL connection. Sharded cluster members and replica set members can use X.509 certificates to verify their membership to the cluster or the replica set instead of using Keyfiles.MongoDB支持X.509证书身份验证，用于安全的TLS/SSL连接。分片集群成员和副本集成员可以使用X.509证书来验证他们对集群或副本集的成员资格，而不是使用键文件。

For details on using X.509 certificates for internal authentication, see Use X.509 Certificates for Membership Authentication with Self-Managed MongoDB.有关使用X.509证书进行内部身份验证的详细信息，请参阅使用X.509证书对自管理MongoDB进行成员身份验证。

Upgrade Self-Managed MongoDB from Keyfile Authentication to X.509 Authentication describes how to upgrade a deployment's internal auth mechanism from keyfile-based authentication to X.509 certificate-based auth.将自管理MongoDB从键文件身份验证升级为X.509身份验证描述了如何将部署的内部身份验证机制从基于键文件的身份验证升级到基于X.509证书的身份验证。