MongoDB 基础（六）安全认证（权限操作）

标签：

和其他所有数据库一样，权限的管理都差不多一样。mongodb存储所有的用户信息在admin 数据库的集合system.users中，保存用户名、密码和数据库信息。mongodb默认不启用授权认证，只要能连接到该服务器，就可连接到mongod。若要启用安全认证，需要更改配置文件参数auth。

以下测试理解

查看数据库：

> show dbs

找了好久，找不到相关说明，于是直接创建用户admin

use admin


db.createUser(
  {
    user: "admin",
    pwd: "admin",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

> show collections
system.indexes
system.users
system.version

> db.system.users.find();
{ "_id" : "admin.admin", "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "cFISfpbm04pmIFpqiL340g==", "storedKey" : "WG1DSEEEHUZUBjsjsnEA4RFVY2M=", "serverKey" : "9Lm+IX6l9kfaE/4C25/ghsQpDkE=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
> 
> db.system.indexes.find();
{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" : "admin.system.version" }
{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" : "admin.system.users" }
{ "v" : 1, "unique" : true, "key" : { "user" : 1, "db" : 1 }, "name" : "user_1_db_1", "ns" : "admin.system.users" }
> 
> db.system.version.find();
{ "_id" : "authSchema", "currentVersion" : 5 }
> 

auth=true

[root@localhost ~]# service mongod restart

直接默认登录，查看集合，发现无权操作了：

[root@localhost ~]# mongo

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
> show dbs
2015-05-09T21:57:03.176-0700 E QUERY    Error: listDatabases failed:{
	"ok" : 0,
	"errmsg" : "not authorized on admin to execute command { listDatabases: 1.0 }",
	"code" : 13
}
    at Error (<anonymous>)
    at Mongo.getDBs (src/mongo/shell/mongo.js:47:15)
    at shellHelper.show (src/mongo/shell/utils.js:630:33)
    at shellHelper (src/mongo/shell/utils.js:524:36)
    at (shellhelp2):1:1 at src/mongo/shell/mongo.js:47
> 

刚才在数据库 admin 创建了一个账户 admin ，先到数据admin进来连接（其他db则失败）：

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
>
> db.auth("admin","admin")
Error: 18 Authentication failed.
0
> use mydb
switched to db mydb
> db.auth("admin","admin")
Error: 18 Authentication failed.
0
> use admin
switched to db admin
> db.auth("admin","admin")
1
> 

所以现在创建另一个用户"myuser"

db.createUser(
  {
    user: "myuser",
    pwd: "myuser",
    roles: [ { role: "readWrite", db: "mydb" } ]
  }
)

#授予角色：db.grantRolesToUser( "userName" , [ { role: "<role>", db: "<database>" } ])

db.grantRolesToUser( "myuser" , [ { role: "dbOwner", db: "mydb" } ])


#取消角色：db.grantRolesToUser( "userName" , [ { role: "<role>", db: "<database>" } ])

db.revokeRolesFromUser( "myuser" , [ { role: "readWrite", db: "mydb" } ])

> db.auth("myuser","myuser")
Error: 18 Authentication failed.
0
> 
> db
mydb
> use admin
switched to db admin
> db.auth("myuser","myuser");
1
> 

> use mydb
switched to db mydb
> 
> db.tab.save({"id":999});
WriteResult({ "nInserted" : 1 })
> 
> db.tab.find({"id":999});
{ "_id" : ObjectId("554ef5ac1b590330c00c7d02"), "id" : 999 }
> 
> show collections
system.indexes
tab
> 

use admin

db.auth("admin","admin")

use mydb

db.createUser(
  {
    user: "userkk",
    pwd: "userkk",
    roles: [ { role: "dbOwner", db: "mydb" } ]
  }
)

db.auth("userkk","userkk")

------------------------------------------------------------------------------------------------------------------

                                                      华丽分割

------------------------------------------------------------------------------------------------------------------

现在授权测试：

#先访问到admin数据库

use admin

db.auth("admin","admin")

use mydb

db.createRole({ 
 role: "testRole",
 privileges: [{ resource: { db: "mydb", collection: "" }, actions: [ "find" ] }],
 roles: []
})

> use admin
switched to db admin
> 
> show collections
system.indexes
system.roles
system.users
system.version
> 
> db.system.roles.find();
{ "_id" : "mydb.testRole", "role" : "testRole", "db" : "mydb", "privileges" : [ { "resource" : { "db" : "mydb", "collection" : "" }, "actions" : [ "find" ] } ], "roles" : [ ] }
> 

use mydb

db.createUser(
  {
    user: "userkk",
    pwd: "userkk",
    roles: [ { role: "testRole", db: "mydb" } ]
  }
)

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
> use mydb
switched to db mydb
> 
> db.auth("userkk","userkk")
1
> 
> db.tab.find({"id":999})
{ "_id" : ObjectId("554ef5ac1b590330c00c7d02"), "id" : 999 }
> 
> db.tab.insert({"id":1000})
WriteResult({
	"writeError" : {
		"code" : 13,
		"errmsg" : "not authorized on mydb to execute command { insert: \"tab\", documents: [ { _id: ObjectId('554f145cdf782b42499d80e5'), id: 1000.0 } ], ordered: true }"
	}
})
> 

use admin

db.auth("admin","admin")

use mydb

#添加Privileges给角色
db.grantPrivilegesToRole("testRole",
 [{ resource: { db: "mydb", collection: "" },actions: [ "update", "insert", "remove" ]}
])


exit #退出mongodb重新登录


use mydb

db.auth("userkk","userkk")


#增删数据可以操作了！~
db.tab.insert({"id":1000})
db.tab.find({"id":1000})
db.tab.remove({"id":1000})


#此时admin的角色记录为：
> db.system.roles.find();
{ "_id" : "mydb.testRole", "role" : "testRole", "db" : "mydb", "privileges" : [ { "resource" : { "db" : "mydb", "collection" : "" }, "actions" : [ "find", "insert", "remove", "update" ] } ], "roles" : [ ] }
> 

use admin

db.auth("admin","admin")

use mydb

db.updateRole("testRole",{ roles:[{ role: "readWrite",db: "mydb"}]},{ w:"majority" })

db.auth("userkk","userkk")

show dbs

关于角色，参考官方文档提取总结如下：

参考：mongo Shell Methods  ， Built-In Roles

MongoDB 基础（六）安全认证（权限操作）

标签：

原文地址：http://blog.csdn.net/kk185800961/article/details/45619863