Configure Self-Managed MongoDB with Kerberos and Active Directory Authorization使用Kerberos和活动目录授权配置自管理MongoDB

Configure TLS/SSL for the server running MongoDB.为运行MongoDB的服务器配置TLS/SSL。

To connect to the AD (AD) server via TLS/SSL, the mongod or mongos require access to the AD server's Certificate Authority (CA) certificate.要通过TLS/SSL连接到AD(AD)服务器，mongod或mongos需要访问AD服务器的证书颁发机构（CA）证书。

On Linux, specify the AD server's CA certificates via the TLS_CACERT or TLS_CACERTDIR option in the ldap.conf file.在Linux上，通过ldap.conf文件中的TLS_CAMERT或TLS_CAMERTDIR选项指定AD服务器的CA证书。

Your platform's package manager creates the ldap.conf file while installing MongoDB Enterprise's libldap dependency. 在安装MongoDB Enterprise的libldap依赖项时，平台的包管理器会创建ldap.conf文件。For complete documentation on the configuration file or the referenced options, see ldap.conf.有关配置文件或引用选项的完整文档，请参阅ldap.conf。

On Microsoft Windows, load the AD server's Certificate Authority (CA) certificates with the platform's credential management tool. 在Microsoft Windows上，使用平台的凭据管理工具加载AD服务器的证书颁发机构（CA）证书。The exact credential management tool is Windows version dependent. To use the tool, refer to its documentation for your version of Windows.确切的凭据管理工具取决于Windows版本。要使用该工具，请参阅适用于Windows版本的文档。

If mongod or mongos cannot access to the AD CA files, they cannot create TLS/SSL connections to the Active Directory server.如果mongod或mongos无法访问AD CA文件，则无法创建到活动目录服务器的TLS/SSL连接。

Optionally, set security.ldap.transportSecurity to none to disable TLS/SSL.（可选）将security.ldap.transportSecurity设置为none以禁用TLS/SSL。

(Windows only) Assign Service Principal Name to MongoDB Windows Service.（仅限Windows）将服务主体名称分配给MongoDB Windows服务。

For MongoDB servers running on the Windows operating system, you must use setspn.exe to assign the service principal name (SPN) to the account running the MongoDB service.对于在Windows操作系统上运行的MongoDB服务器，您必须使用setspn.exe将服务主体名称（SPN）分配给运行MongoDB服务的帐户。

setspn.exe -S <service>/<fully qualified domain name> <service account name>

setspn.exe -S mongodb/mongodbserver.example.com mongodb_dev@example.com

(Linux only) Create keytab file for the MongoDB server.（仅限Linux）为MongoDB服务器创建keytab文件。

For MongoDB servers running on the Linux platform, you must ensure the server has a copy of the keytab file specific to the MongoDB instance running on that server.对于在Linux平台上运行的MongoDB服务器，您必须确保该服务器具有特定于该服务器上运行的MongoDB实例的keytab文件的副本。

You must grant the Linux user running the MongoDB service read permissions on the keytab file. Take note of the full path of the keytab file location.您必须授予运行MongoDB服务的Linux用户对keytab文件的读取权限。记下keytab文件位置的完整路径。

Connect to the MongoDB server.连接到MongoDB服务器。

Connect to the MongoDB server using mongosh using the --host and --port options.使用--host和--port选项使用mongosh连接到MongoDB服务器。

mongosh --host <hostname> --port <port>

If your MongoDB server currently enforces authentication, you must authenticate to the admin database as a user with role management privileges, such as those provided by userAdmin or userAdminAnyDatabase. 如果MongoDB服务器当前强制执行身份验证，则必须以具有角色管理权限的用户身份向admin数据库进行身份验证，例如userAdmin或userAdminAnyDatabase提供的权限。Include the appropriate --authenticationMechanism for the MongoDB server's configured authentication mechanism.为MongoDB服务器配置的身份验证机制包括适当的--authenticationMechanism。

mongosh --host <hostname> --port <port> --username <user> --password <pass> --authenticationDatabase="admin" --authenticationMechanism="<mechanism>"

Create user administrative role.创建用户管理角色。

To manage MongoDB users using AD, you need to create at least one role on the admin database that can create and manage roles, such as those provided by userAdmin or userAdminAnyDatabase.要使用AD管理MongoDB用户，您需要在admin数据库上创建至少一个可以创建和管理角色的角色，例如userAdmin或userAdminAnyDatabase提供的角色。

The role's name must exactly match the Distinguished Name of an AD group. The group must have at least one AD user as a member.角色的名称必须与AD组的可分辨名称完全匹配。该组必须至少有一个AD用户作为成员。

Given the available Active Directory groups,the following operation:给定可用的活动目录组，执行以下操作：

• Creates a role named for the AD group CN=dba,CN=Users,DC=example,DC=com, and创建一个以AD组CN=dba,CN=Users,DC=example,DC=com命名的角色，以及
• Assigns it the userAdminAnyDatabase role on the admin database.在admin数据库上为其分配userAdminAnyDatabase角色。

var admin = db.getSiblingDB("admin")
admin.createRole(
   {
     role: "CN=dba,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [ "userAdminAnyDatabase" ]
   }
)

You could alternatively grant the userAdmin role for each database the user should have user administrative privileges on. These roles provide the necessary privileges for role creation and management.您也可以为每个用户应该具有用户管理权限的数据库授予userAdmin角色。这些角色为角色创建和管理提供了必要的权限。

Create a MongoDB configuration file.创建MongoDB配置文件。

A MongoDB configuration file is a plain-text YAML file with the .conf file extension.MongoDB配置文件是一个扩展名为.conf的纯文本YAML文件。

• If you are upgrading an existing MongoDB deployment, copy the current configuration file and work from that copy.如果要升级现有的MongoDB部署，请复制当前配置文件并从该副本开始工作。
• (Linux Only) If this is a new deployment and you used your platform's package manager to install MongoDB Enterprise, the installation includes the /etc/mongod.conf default configuration file. Use that default configuration file, or make a copy of that file to work from.（仅限Linux）如果这是一个新的部署，并且您使用平台的包管理器安装了MongoDB Enterprise，则安装包括/etc/mongod.conf默认配置文件。使用默认配置文件，或复制该文件以从中工作。
• If no such file exists, create an empty file with the .conf extension and work from that new configuration file.如果不存在这样的文件，请创建一个扩展名为.conf的空文件，并从新的配置文件开始工作。

Configure MongoDB to connect to Active Directory`.配置MongoDB以连接到活动目录。

In the MongoDB configuration file, set security.ldap.servers to the host and port of the AD server. 在MongoDB配置文件中，将security.ldap.servers设置为AD服务器的主机和端口。If your AD infrastructure includes multiple AD servers for the purpose of replication, specify the host and port of the servers as a comma-delimited list to security.ldap.servers.如果AD基础架构包含多个用于复制的AD服务器，请将服务器的主机和端口指定为逗号分隔的列表，以供security.ldap.servers使用。

security:
  ldap:
    servers: "activedirectory.example.net"

MongoDB must bind to the AD server to perform queries. By default, MongoDB uses the simple authentication mechanism to bind itself to the AD server.MongoDB必须绑定到AD服务器才能执行查询。默认情况下，MongoDB使用简单的身份验证机制将自己绑定到AD服务器。

Alternatively, you can configure the following settings in the configuration file to bind to the AD server using SASL:或者，您可以在配置文件中配置以下设置，以使用SASL绑定到AD服务器：

• Set security.ldap.bind.method to sasl
• security.ldap.bind.saslMechanisms, specifying a string of comma-separated SASL mechanisms the AD server supports.，指定AD服务器支持的逗号分隔的SASL机制字符串。

This tutorial uses the default simple LDAP authentication mechanism.本教程使用默认的simpleLDAP身份验证机制。

Configure MongoDB for Kerberos authentication.配置MongoDB进行Kerberos身份验证。

In the MongoDB configuration file, set security.authorization to enabled and setParameter authenticationMechanisms to GSSAPI在MongoDB配置文件中，将security.authorization设置为enabled，并将setParameter authenticationMechanisms设置为GSSAPI

To enable authentication via Kerberos, include the following in the configuration file:要通过Kerberos启用身份验证，请在配置文件中包含以下内容：

security:
  authorization: "enabled"
setParameter:
  authenticationMechanisms: "GSSAPI"

Configure LDAP Query Template for authorization.配置LDAP查询模板以进行授权。

In the MongoDB configuration file, set security.ldap.authz.queryTemplate to an RFC4516 formatted LDAP query URL template.在MongoDB配置文件中，将security.ldap.authz.queryTemplate设置为RFC4516格式的LDAP查询URL模板。

In the template, you can use either:在模板中，您可以使用：

• {USER} placeholder to substitute the authenticated username into the LDAP query URL.占位符，用于将经过身份验证的用户名替换为LDAP查询URL。
• {PROVIDED_USER} placeholder to substitute the supplied username, i.e. before either authentication or LDAP transformation, into the LDAP query.占位符，用于将提供的用户名替换为LDAP查询，即在身份验证或LDAP转换之前。

Design the query template to retrieve the user's groups.设计查询模板以检索用户的组。

security:
  ldap:
    authz:
      queryTemplate:
        "DC=example,DC=com??sub?(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={USER}))"

MongoDB maps each returned group DN to a role on the admin database. For each mapped group DN, if there is an existing role on the admin database whose name exactly matches the DN, MongoDB grants the user the roles and privileges assigned to that role.MongoDB将每个返回的组DN映射到admin数据库上的一个角色。对于每个映射的组DN，如果admin数据库上存在一个名称与DN完全匹配的现有角色，MongoDB会授予用户分配给该角色的角色和权限。

The matching rule LDAP_MATCHING_RULE_IN_CHAIN requires providing the full DN of the authenticating user. 匹配规则LDAP_MATCHING_RULE_IN_CHAIN要求提供身份验证用户的完整DN。Since Kerberos requires authenticating with a user's userPrincipalName, you must transform the incoming usernames into DNs using security.ldap.userToDNMapping. 由于Kerberos需要使用用户的userPrincipalName进行身份验证，因此必须使用security.ldap.userToDNMapping将传入的用户名转换为DN。The next step provides guidance on transforming incoming usernames to support the queryTemplate.下一步将提供有关转换传入用户名以支持queryTemplate的指导。

Transform incoming usernames for authentication via Active Directory.转换传入用户名以通过活动目录进行身份验证。

In the MongoDB configuration file, set userToDNMapping to transform the authenticating user's provided username into an AD DN to support the queryTemplate.在MongoDB配置文件中，设置userToDNMapping，将认证用户提供的用户名转换为AD DN，以支持queryTemplate。

security:
  ldap:
    userToDNMapping:
      '[
         {
            match : "(.+)",
            ldapQuery: "DC=example,DC=com??sub?(userPrincipalName={0})"
         }
    ]'

You must modify the given sample configuration to match your deployment. 您必须修改给定的示例配置以匹配部署。For example, the ldapQuery base DN must match the base DN which contains your user entities. Other modifications may be necessary to support your AD deployment.例如，ldapQuery基DN必须与包含用户实体的基DN匹配。可能需要进行其他修改以支持AD部署。

DC=example,DC=com??sub?(userPrincipalName=alice@ENGINEERING.EXAMPLE.COM)

Configure query credentials.配置查询凭据。

MongoDB requires credentials for performing queries on the AD server.MongoDB需要凭据才能在AD服务器上执行查询。

Configure the following settings in the configuration file:在配置文件中配置以下设置：

• security.ldap.bind.queryUser, specifying the Kerberos user the mongod or mongos binds as for performing queries on the AD server.，指定mongod或mongos绑定的Kerberos用户，以便在AD服务器上执行查询。
• security.ldap.bind.queryPassword, specifying the password for the specified queryUser.，为指定的queryUser指定密码。

security:
  ldap:
    bind:
      queryUser: "mongodbadmin@dba.example.com"
      queryPassword: "secret123"

On Windows MongoDB servers, you can set security.ldap.bind.useOSDefaults to true to use the credentials of the OS user instead of queryUser and queryPassword.在Windows MongoDB服务器上，您可以将security.ldap.bind.useOSDefaults设置为true，以使用操作系统用户的凭据，而不是queryUser和queryPassword。

The queryUser must have permission to perform all LDAP queries on behalf of MongoDB.queryUser必须具有代表MongoDB执行所有LDAP查询的权限。

Optional: Add additional configuration settings.可选：添加其他配置设置。

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the MongoDB server with Kerberos authentication and Active Directory authorization.使用Kerberos身份验证和活动目录授权启动MongoDB服务器。

Start the MongoDB server with the --config option, specifying the path to the configuration file created during this procedure. If the MongoDB server is currently running, make the appropriate preparations to stop the server.使用--config选项启动MongoDB服务器，指定在此过程中创建的配置文件的路径。如果MongoDB服务器当前正在运行，请做好停止服务器的适当准备。

Linux MongoDB Servers

On Linux, you must specify the KRB5_KTNAME environmental variable, specifying the path to the keytab file for the MongoDB server.在Linux上，您必须指定KRB5_KTNAME环境变量，指定MongoDB服务器的keytab文件的路径。

env KRB5_KTNAME <path-to-keytab> mongod --config <path-to-config-file>

Microsoft Windows MongoDB Servers

On Windows, you must start the MongoDB server as the service principal account as configured earlier in the procedure:在Windows上，您必须按照过程中前面配置的服务主体帐户启动MongoDB服务器：

mongod.exe --config <path-to-config-file>

Connect to the MongoDB server.连接到MongoDB服务器。

Connect to the MongoDB server, authenticating as a user whose direct or transitive group membership corresponds to a MongoDB role on the admin database with userAdmin, userAdminAnyDatabase, or a custom role with equivalent privileges.连接到MongoDB服务器，作为一个用户进行身份验证，该用户的直接或可传递组成员资格对应于admin数据库上具有userAdmin、userAdminAnyDatabase或具有同等权限的自定义角色的MongoDB角色。

Use mongosh to authenticate to the MongoDB server, set the following options:使用mongosh对MongoDB服务器进行身份验证，设置以下选项：

• --host with the hostname of the MongoDB server使用MongoDB服务器的主机名
• --port with the port of the MongoDB server使用MongoDB服务器的端口
• --username to the user's 为用户的userPrincipalName
• --password to the user's password (or omit to have mongosh prompt for the password)为用户的密码（或省略密码的mongosh提示）
• --authenticationMechanism to "GSSAPI"
• --authenticationDatabase to "$external"

mongosh --username sam@DBA.EXAMPLE.COM --password  --authenticationMechanisms="GSSAPI" --authenticationDatabase "$external" --host <hostname> --port <port>

Windows MongoDB deployments must use mongo.exe instead of mongosh.Windows MongoDB部署必须使用mongo.exe而不是mongosh。

Given the configured Active Directory users, the user authenticates successfully and receives the appropriate permissions.给定配置的活动目录用户，用户将成功进行身份验证并获得相应的权限。

Create roles for mapping returned AD groups.为映射返回的AD组创建角色。

For each group on the AD server you wish to use for MongoDB authorization, you must create a matching role on the MongoDB server's admin database.对于您希望用于MongoDB授权的AD服务器上的每个组，您必须在MongoDB服务器的admin数据库上创建一个匹配的角色。

db.getSiblingDB("admin").createRole(
   {
     role: "CN=PrimaryApplication,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [
       { role: "readWrite", db: "PrimaryApplication" }
     ]
   }
)

Optional: Transition existing users from $external to the Active Directory server.可选：将现有用户从$external迁移到活动目录服务器。

If upgrading an existing installation with users configured on the $external database, you must meet the following requirements for each user to ensure access after configuring MongoDB for Kerberos authentication and AD authorization:如果使用在$external数据库上配置的用户升级现有安装，则必须满足每个用户的以下要求，以确保在配置MongoDB进行Kerberos身份验证和AD授权后能够访问：

• User has a corresponding user object on the AD server.用户在AD服务器上有一个相应的用户对象。
• User has membership in the appropriate groups on the AD server.用户具有AD服务器上相应组的成员资格。
• MongoDB contains the roles on the admin database named for the user's AD groups, such that the authorized user retains its privileges.MongoDB包含以用户AD组命名的admin数据库上的角色，以便授权用户保留其权限。

{
  user : "joe@ANALYTICS.EXAMPLE.COM",
  roles: [
    { role : "read", db : "web_analytics" },
    { role : "read", db : "PrimaryApplication" }
  ]
}

db.getSiblingDB("admin").createRole(
   {
     role: "CN=marketing,CN=Users,DC=example,DC=com",
     privileges: [],
     roles: [
       { role: "read", db: "web_analytics" }
       { role: "read", db: "PrimaryApplication" }
     ]
   }
)

If you want to continue allowing users on non-$external databases to access MongoDB, you must include SCRAM authentication mechanism (e.g. SCRAM-SHA-1 and/or SCRAM-SHA-256) in the setParameter authenticationMechanisms configuration option.如果你想继续允许非$external数据库上的用户访问MongoDB，你必须在setParameter authenticationMechanisms配置选项中包含SCRAM身份验证机制（例如SCRAM-SHA-1和/或SCRAM-SHA-256）。

setParameter:
  authenticationMechanisms: "GSSAPI,SCRAM-SHA-1,SCRAM-SHA-256"

Alternatively, transition non-$external users to AD by following the above procedure.或者，按照上述过程将非$external用户转换为AD。