Troubleshoot Self-Managed Kerberos Authentication自我管理Kerberos身份验证疑难解答

mongokerberos Validation Tool验证工具

The mongokerberos program provides a convenient method to verify your platform's Kerberos configuration for use with MongoDB, and to test that Kerberos authentication from a MongoDB client works as expected.mongokerberos程序提供了一种方便的方法来验证平台与MongoDB一起使用的Kerberos配置，并测试MongoDB客户端的Kerberos身份验证是否按预期工作。

The mongokerberos tool can help diagnose common configuration issues, and is the recommended place to start when troubleshooting your Kerberos configuration. mongokerberos工具可以帮助诊断常见的配置问题，是排除Kerberos配置故障时的推荐起点。See the mongokerberos documentation for more information.有关更多信息，请参阅mongokerberos文档。

mongokerberos is available in MongoDB Enterprise only.仅在MongoDB Enterprise中可用。

Kerberos Configuration Debugging StrategiesKerberos配置调试策略

If you have difficulty starting or authenticating against mongod or mongos with Kerberos, consider the following:如果您在启动或使用Kerberos对mongod或mongos进行身份验证时遇到困难，请考虑以下情况：

• Ensure that you are running MongoDB Enterprise, not MongoDB Community Edition. Kerberos authentication is a MongoDB Enterprise feature and will not work with MongoDB Community Edition binaries.确保您运行的是MongoDB企业版，而不是MongoDB社区版。Kerberos身份验证是MongoDB企业版的一项功能，不适用于MongoDB社区版二进制文件。

  To verify that you are using MongoDB Enterprise, pass the --version command line option to the mongod or mongos:要验证您是否正在使用MongoDB Enterprise，请将--version命令行选项传递给mongod或mongos：

  mongod --version

  In the output from this command, look for the string modules: subscription or modules: enterprise to confirm you are using the MongoDB Enterprise binaries.在此命令的输出中，查找字符串modules: subscription或modules: enterprise，以确认您正在使用MongoDB enterprise二进制文件。

• Ensure that the canonical system hostname of the mongod or mongos instance is a resolvable, fully qualified domain name.确保mongod或mongos实例的规范系统主机名是可解析的完全限定域名。

  On Linux, you can verify the system hostname resolution with the hostname -f command at the system prompt.在Linux上，您可以在系统提示符下使用hostname -f命令验证系统主机名解析。

• On Linux, ensure that the primary component of the service principal name (SPN) of the SPN is mongodb. 在Linux上，确保SPN的服务主体名称（SPN）的主要组件是mongodb。If the primary component of the SPN is not mongodb, you must specify the primary component using --setParameter saslServiceName.如果SPN的主要组件不是mongodb，则必须使用--setParameter saslServiceName指定主要组件。

• On Linux, ensure that the instance component of the service principal name (SPN) in the keytab file matches the canonical system hostname of the mongod or mongos instance. 在Linux上，确保keytab文件中服务主体名称（SPN）的实例组件与mongod或mongos实例的规范系统主机名匹配。If the mongod or mongos instance's system hostname is not in the keytab file, authentication will fail with a GSSAPI error acquiring credentials. error message.如果mongod或mongos实例的系统主机名不在keytab文件中，则身份验证将失败，并获取GSSAPI error acquiring credentials.错误消息。

  If the hostname of your mongod or mongos instance as returned by hostname -f is not fully qualified, use --setParameter saslHostName to set the instance's fully qualified domain name when starting your mongod or mongos.如果hostname -f返回的mongod或mongos实例的主机名不是完全限定的，请在启动mongod和mongos时使用--setParameter saslHostName设置实例的完全限定域名。

• Ensure that each host that runs a mongod or mongos instance has A and PTR DNS records to provide both forward and reverse DNS lookup. 确保运行mongod或mongos实例的每个主机都有a和PTR DNS记录，以提供正向和反向DNS查找。The A record should map to the mongod or mongos's FQDN.A记录应映射到mongod或mongos的FQDN。
• Ensure that clocks on the servers hosting your MongoDB instances and Kerberos infrastructure are within the maximum time skew: 5 minutes by default. Time differences greater than the maximum time skew prevent successful authentication.确保托管MongoDB实例和Kerberos基础架构的服务器上的时钟在最大时间偏差内：默认情况下为5分钟。大于最大时间偏差的时间差会阻止成功的身份验证。
• Ensure that Linux KRB5 keytabs contain principal names that end in @<KERBEROS REALM>. To validate SPNs, run setspn -Q <spn> on Active Directory. 确保Linux KRB5键表包含以@<KERBEROS REALM>结尾的主体名称。要验证spn，请在活动目录上运行setspn -Q <spn>。If correctly configured, this command returns one Distinguished Name for the account that is attached to the SPN. 如果配置正确，此命令将为连接到SPN的帐户返回一个可分辨名称。If you run klist -k <keytab> on Linux, <spn>@<KERBEROS REALM> appears in the keytab.如果你在Linux上运行klist -k <keytab>，<spn>@<KERBEROS REALM>会出现在keytab中。
• If you use Active Directory as a KDC, ensure that the MongoDB service account is a user account, not a machine account.如果将活动目录用作KDC，请确保MongoDB服务帐户是用户帐户，而不是计算机帐户。
• If you use AES encryption with Active Directory, enable AES on the MongoDB service account with either the msDS-SupportedEncryptionTypes property or the "Network Security: Configure Encryption types allowed for Kerberos" policy setting.如果在活动目录中使用AES加密，请使用msDS-SupportedEncryptionTypes属性或“网络安全：配置Kerberos允许的加密类型”策略设置在MongoDB服务帐户上启用AES。

• Kerberos salts its key generation algorithms to ensure that two users with the same password result in distinct keys. Kerberos为其键生成算法添加盐，以确保具有相同密码的两个用户产生不同的键。ktutil on Linux and Active Directory (AD) don't use the same process to generate salts. Linux和活动目录(AD)上的ktutil不使用相同的过程来生成盐。This discrepancy can result in authentication failures when working across Linux and Windows environments. To mitigate this issue, you can:在跨Linux和Windows环境工作时，这种差异可能会导致身份验证失败。为了缓解这个问题，您可以：

  • Generate the keytab file on the AD server and move the resulting file to the Linux server.在AD服务器上生成keytab文件，并将生成的文件移动到Linux服务器。

    ktpass /out <outfile.keytab> /princ <spn>@<KERBEROS REALM> /mapuser <current userPrincipalName> /crypto ALL /ptype KRB5_NT_PRINCIPAL +rndpass

    Note

    This will change userPrincipalName to the value in /princ.这将把userPrincipalName更改为/princ中的值。

  • Use ktutil on Linux and force it to use the correct salt. To force ktutil to use the correct salt:在Linux上使用ktutil并强制它使用正确的盐。要强制ktutil使用正确的盐：

    1. Generate a keytab entry that uses userPrincipalName as the principal name.生成一个使用userPrincipalName作为主体名称的keytab条目。

       ktutil:  add_entry -password -p <userPrincipalName>@<KERBEROS REALM> -e aes256-cts-hmac-sha1-96 -k <KVNO>
       Password for <userPrincipalName>@<KERBEROS REALM>:
       ktutil:  list -k
       slot KVNO Principal

    2. Hexdump the key.把钥匙交出来。

    3. Create a new keytab entry, using <spn>@<KERBEROS REALM> as the principal name and use the hexdumped key.使用<spn>@<KERBEROS REALM>作为主体名称创建一个新的keytab条目，并使用十六进制转储键。

       1    <KVNO> <userPrincipalName>@<KERBEROS REALM>(0x<HEXDUMP>)
       ktutil:  add_entry -key -p <spn>@<KERBEROS REALM> -e aes256-cts-hmac-sha1-96 -k <KVNO>
       Key for <spn>@<KERBEROS REALM> (hex): <HEXDUMP>
       ktutil:  write_kt mongodb_ad.keytab

  • Use RC4-HMAC, which does not use salts, although this is not recommended.使用RC4-HMAC，它不使用盐，尽管不建议这样做。

Kerberos Trace Logging on LinuxLinux上的Kerberos跟踪日志记录

MIT Kerberos provides the KRB5_TRACE environment variable for trace logging output. MIT Kerberos为跟踪日志输出提供了KRB5_TRACE环境变量。If you are having persistent problems with MIT Kerberos on Linux, you can set KRB5_TRACE when starting your mongod, mongos, or mongosh instances to produce verbose logging.如果您在Linux上使用MIT Kerberos时遇到持续问题，可以在启动mongod、mongos或mongosh实例时设置KRB5_TRACE以生成详细日志记录。

For example, the following command starts a standalone mongod whose keytab file is at the default /etc/krb5.keytab path and sets KRB5_TRACE to write to /logs/mongodb-kerberos.log:例如，以下命令启动一个独立的mongod，其keytab文件位于默认的/etc/krb5.keytab路径，并将KRB5_TRACE设置为写入/logs/mongodb-kerberos.log：

env KRB5_KTNAME=/etc/krb5.keytab \
    KRB5_TRACE=/logs/mongodb-kerberos.log \
    mongod --dbpath /data/db --logpath /data/db/mongodb.log \
    --auth --setParameter authenticationMechanisms=GSSAPI \
    --bind_ip localhost,<hostname(s)|ip address(es)> --fork

Common Error Messages常见错误消息

In some situations, MongoDB will return error messages from the GSSAPI interface if there is a problem with the Kerberos service. Some common error messages are:在某些情况下，如果Kerberos服务出现问题，MongoDB将从GSSAPI接口返回错误消息。一些常见的错误消息是：

GSSAPI error in client while negotiating security context.

This error occurs on the client and reflects insufficient credentials or a malicious attempt to authenticate.此错误发生在客户端上，反映了凭据不足或恶意尝试进行身份验证。

If you receive this error, ensure that you are using the correct credentials and the correct fully qualified domain name when connecting to the host.如果收到此错误，请确保在连接到主机时使用了正确的凭据和正确的完全限定域名。

GSSAPI error acquiring credentials.

This error occurs during the start of the mongod or mongos and reflects improper configuration of the system hostname or a missing or incorrectly configured keytab file.此错误发生在mongod或mongos启动期间，反映了系统主机名的配置不正确，或者缺少或配置不正确的keytab文件。