MongoDB 3.0 用户创建
本文内容纲要：
摘要：
MongoDB3.0安全权限访问控制，在添加用户上面3.0版本和之前的版本有很大的区别，这里就说明下3.0的添加用户的方法。
环境、测试：
在安装MongoDB之后，先关闭auth认证，进入查看数据库，只有一个local库，admin库是不存在的：
root@zhoujinyi:/usr/local/mongo4#mongo--port=27020
MongoDBshellversion:3.0.4
connectingto:127.0.0.1:27020/test
2015-06-29T09:31:08.673-0400ICONTROL[initandlisten]
>showdbs;
local0.078GB
现在需要创建一个帐号，该账号需要有grant权限，即：账号管理的授权权限。注意一点，帐号是跟着库走的，所以在指定库里授权，必须也在指定库里验证(auth)。
>useadmin
switchedtodbadmin
>db.createUser(
...{
...user:"dba",
...pwd:"dba",
...roles:[{role:"userAdminAnyDatabase",db:"admin"}]
...}
...)
Successfullyaddeduser:{
"user":"dba",
"roles":[
{
"role":"userAdminAnyDatabase",
"db":"admin"
}
]
}
上面加粗的就是执行的命令：
user：用户名
pwd：密码
roles：指定用户的角色，可以用一个空数组给新用户设定空角色；在roles字段,可以指定内置角色和用户定义的角色。role里的角色可以选：
Built-InRoles（内置角色）：
1.数据库用户角色：read、readWrite;
2.数据库管理角色：dbAdmin、dbOwner、userAdmin；
3.集群管理角色：clusterAdmin、clusterManager、clusterMonitor、hostManager；
4.备份恢复角色：backup、restore；
5.所有数据库角色：readAnyDatabase、readWriteAnyDatabase、userAdminAnyDatabase、dbAdminAnyDatabase
6.超级用户角色：root
//这里还有几个角色间接或直接提供了系统超级用户的访问（dbOwner、userAdmin、userAdminAnyDatabase）
7.内部角色：__system
具体角色：
Read：允许用户读取指定数据库
readWrite：允许用户读写指定数据库
dbAdmin：允许用户在指定数据库中执行管理函数，如索引创建、删除，查看统计或访问system.profile
userAdmin：允许用户向system.users集合写入，可以找指定数据库里创建、删除和管理用户
clusterAdmin：只在admin数据库中可用，赋予用户所有分片和复制集相关函数的管理权限。
readAnyDatabase：只在admin数据库中可用，赋予用户所有数据库的读权限
readWriteAnyDatabase：只在admin数据库中可用，赋予用户所有数据库的读写权限
userAdminAnyDatabase：只在admin数据库中可用，赋予用户所有数据库的userAdmin权限
dbAdminAnyDatabase：只在admin数据库中可用，赋予用户所有数据库的dbAdmin权限。
root：只在admin数据库中可用。超级账号，超级权限
刚建立了userAdminAnyDatabase角色，用来管理用户，可以通过这个角色来创建、删除用户。验证：需要开启auth参数。
root@zhoujinyi:/usr/local/mongo4#mongo--port=27020
MongoDBshellversion:3.0.4
connectingto:127.0.0.1:27020/test
>showdbs;####没有验证，导致没权限。
2015-06-29T10:02:16.634-0400EQUERYError:listDatabasesfailed:{
"ok":0,
"errmsg":"notauthorizedonadmintoexecutecommand{listDatabases:1.0}",
"code":13
}
atError(<anonymous>)
atMongo.getDBs(src/mongo/shell/mongo.js:47:15)
atshellHelper.show(src/mongo/shell/utils.js:630:33)
atshellHelper(src/mongo/shell/utils.js:524:36)
at(shellhelp2):1:1atsrc/mongo/shell/mongo.js:47
>useadmin#验证，因为在admin下面添加的帐号，所以要到admin下面验证。
switchedtodbadmin
>db.auth('dba','dba')
1
>showdbs;
admin0.078GB
local0.078GB
>usetest#在test库里创建帐号
switchedtodbtest
>db.createUser(
...{
...user:"zjyr",
...pwd:"zjyr",
...roles:[
...{role:"read",db:"test"}#只读帐号
...]
...}
...)
Successfullyaddeduser:{
"user":"zjyr",
"roles":[
{
"role":"read",
"db":"test"
}
]
}
>db.createUser(
...{
...user:"zjy",
...pwd:"zjy",
...roles:[
...{role:"readWrite",db:"test"}#读写帐号
...]
...}
...)
Successfullyaddeduser:{
"user":"zjy",
"roles":[
{
"role":"readWrite",#读写账号
"db":"test"
}
]
}
>showusers;#查看当前库下的用户
{
"_id":"test.zjyr",
"user":"zjyr",
"db":"test",
"roles":[
{
"role":"read",
"db":"test"
}
]
}
{
"_id":"test.zjy",
"user":"zjy",
"db":"test",
"roles":[
{
"role":"readWrite",
"db":"test"
}
]
}
上面创建了2个帐号，现在验证下：验证前提需要一个集合
>db.abc.insert({"a":1,"b":2})#插入失败，没有权限，userAdminAnyDatabase权限只是针对用户管理的，对其他是没有权限的。
WriteResult({
"writeError":{
"code":13,
"errmsg":"notauthorizedontesttoexecutecommand{insert:\"abc\",documents:[{_id:ObjectId('55915185d629831d887ce2cb'),a:1.0,b:2.0}],ordered:true}"
}
})
>
bye
root@zhoujinyi:/usr/local/mongo4#mongo--port=27020
MongoDBshellversion:3.0.4
connectingto:127.0.0.1:27020/test
>usetest
switchedtodbtest
>db.auth('zjy','zjy')#用创建的readWrite帐号进行写入
1
>db.abc.insert({"a":1,"b":2})
WriteResult({"nInserted":1})
>db.abc.insert({"a":11,"b":22})
WriteResult({"nInserted":1})
>db.abc.insert({"a":111,"b":222})
WriteResult({"nInserted":1})
>db.abc.find()
{"_id":ObjectId("559151a1b78649ebd8316853"),"a":1,"b":2}
{"_id":ObjectId("559151cab78649ebd8316854"),"a":11,"b":22}
{"_id":ObjectId("559151ceb78649ebd8316855"),"a":111,"b":222}
>db.auth('zjyr','zjyr')#切换到只有read权限的帐号
1
>db.abc.insert({"a":1111,"b":2222})#不能写入
WriteResult({
"writeError":{
"code":13,
"errmsg":"notauthorizedontesttoexecutecommand{insert:\"abc\",documents:[{_id:ObjectId('559151ebb78649ebd8316856'),a:1111.0,b:2222.0}],ordered:true}"
}
})
>db.abc.find()#可以查看
{"_id":ObjectId("559151a1b78649ebd8316853"),"a":1,"b":2}
{"_id":ObjectId("559151cab78649ebd8316854"),"a":11,"b":22}
{"_id":ObjectId("559151ceb78649ebd8316855"),"a":111,"b":222}
有没有一个超级权限？不仅可以授权，而且也可以对集合进行任意操作？答案是肯定的，只是不建议使用。那就是role角色设置成root。
>db.auth('dba','dba')
1
>db.createUser(
...{
...user:"zhoujinyi",
...pwd:"zhoujinyi",
...roles:[
...{role:"root",db:"admin"}#超级root帐号
...]
...}
...)
Successfullyaddeduser:{
"user":"zhoujinyi",
"roles":[
{
"role":"root",
"db":"admin"
}
]
}
>
>showusers;#查看当前库下的用户
{
"_id":"admin.dba",
"user":"dba",
"db":"admin",
"roles":[
{
"role":"userAdminAnyDatabase",
"db":"admin"
}
]
}
{
"_id":"admin.zhoujinyi",
"user":"zhoujinyi",
"db":"admin",
"roles":[
{
"role":"root",
"db":"admin"
}
]
}
>useadmin
switchedtodbadmin
>db.auth('zhoujinyi','zhoujinyi')
1
>usetest
switchedtodbtest
>db.abc.insert({"a":1,"b":2})
WriteResult({"nInserted":1})
>db.abc.insert({"a":1111,"b":2222})#权限都有
WriteResult({"nInserted":1})
>db.abc.find()
{"_id":ObjectId("5591539bb78649ebd8316857"),"a":1,"b":2}
{"_id":ObjectId("559153a0b78649ebd8316858"),"a":1111,"b":2222}
>db.abc.remove({})
WriteResult({"nRemoved":2})
因为帐号都是在当前需要授权的数据库下授权的，那要是不在当前数据库下会怎么样？
>db
admin
>db.createUser(
...{
...user:"dxy",
...pwd:"dxy",
...roles:[
...{role:"readWrite",db:"test"},#在当前库下创建其他库的帐号，在admin库下创建test、abc库的帐号
...{role:"readWrite",db:"abc"}
...]
...}
...)
Successfullyaddeduser:{
"user":"dxy",
"roles":[
{
"role":"readWrite",
"db":"test"
},
{
"role":"readWrite",
"db":"abc"
}
]
}
>
>showusers;
{
"_id":"admin.dba",
"user":"dba",
"db":"admin",
"roles":[
{
"role":"userAdminAnyDatabase",
"db":"admin"
}
]
}
{
"_id":"admin.zhoujinyi",
"user":"zhoujinyi",
"db":"admin",
"roles":[
{
"role":"root",
"db":"admin"
}
]
}
{
"_id":"admin.dxy",
"user":"dxy",
"db":"admin",
"roles":[
{
"role":"readWrite",
"db":"test"
},
{
"role":"readWrite",
"db":"abc"
}
]
}
>usetest
switchedtodbtest
>db.auth('dxy','dxy')#在admin下创建的帐号，不能直接在其他库验证，
Error:18Authenticationfailed.
0
>useadmin
switchedtodbadmin#只能在帐号创建库下认证，再去其他库进行操作。
>db.auth('dxy','dxy')
1
>usetest
switchedtodbtest
>db.abc.insert({"a":1111,"b":2222})
WriteResult({"nInserted":1})
>useabc
switchedtodbabc
>db.abc.insert({"a":1111,"b":2222})
WriteResult({"nInserted":1})
上面更加进一步说明数据库帐号是跟着数据库来走的，哪里创建哪里认证。
创建了这么多帐号，怎么查看所有帐号？
>useadmin
switchedtodbadmin
>db.auth('dba','dba')
1
>db.system.users.find().pretty()
{
"_id":"admin.dba",
"user":"dba",
"db":"admin",
"credentials":{
"SCRAM-SHA-1":{
"iterationCount":10000,
"salt":"KfDUzCOIUo7WVjFr64ZOcQ==",
"storedKey":"t4sPsKG2dXnZztVYj5EgdUzT9sc=",
"serverKey":"2vCGiq9NIc1zKqeEL6VvO4rP26A="
}
},
"roles":[
{
"role":"userAdminAnyDatabase",
"db":"admin"
}
]
}
{
"_id":"test.zjyr",
"user":"zjyr",
"db":"test",
"credentials":{
"SCRAM-SHA-1":{
"iterationCount":10000,
"salt":"h1gOW3J7wzJuTqgmmQgJKQ==",
"storedKey":"7lkoANdxM2py0qiDBzFaZYPp1cM=",
"serverKey":"Qyu6IRNyaKLUvqJ2CAa/tQYY36c="
}
},
"roles":[
{
"role":"read",
"db":"test"
}
]
}
{
"_id":"test.zjy",
"user":"zjy",
"db":"test",
"credentials":{
"SCRAM-SHA-1":{
"iterationCount":10000,
"salt":"afwaKuTYPWwbDBduQ4Hm7g==",
"storedKey":"ebb2LYLn4hiOVlZqgrAKBdStfn8=",
"serverKey":"LG2qWwuuV+FNMmr9lWs+Rb3DIhQ="
}
},
"roles":[
{
"role":"readWrite",
"db":"test"
}
]
}
{
"_id":"admin.zhoujinyi",
"user":"zhoujinyi",
"db":"admin",
"credentials":{
"SCRAM-SHA-1":{
"iterationCount":10000,
"salt":"pE2cSOYtBOYevk8tqrwbSQ==",
"storedKey":"TwMxdnlB5Eiaqg4tNh9ByNuUp9A=",
"serverKey":"Mofr9ohVlFfR6/md4LMRkOhXouc="
}
},
"roles":[
{
"role":"root",
"db":"admin"
}
]
}
{
"_id":"admin.dxy",
"user":"dxy",
"db":"admin",
"credentials":{
"SCRAM-SHA-1":{
"iterationCount":10000,
"salt":"XD6smcWX4tdg/ZJPoLxxRg==",
"storedKey":"F4uiayykHDp/r9krAKZjdr+gqjM=",
"serverKey":"Kf51IU9J3RIrB8CFn5Z5hEKMSkw="
}
},
"roles":[
{
"role":"readWrite",
"db":"test"
},
{
"role":"readWrite",
"db":"abc"
}
]
}
>db.system.users.find().count()
5
备份还原使用那个角色的帐号？之前创建的帐号zjy:test库读写权限；zjyr:test库读权限
root@zhoujinyi:~#mongodump--port=27020-uzjyr-pzjyr--db=test-obackup#只要读权限就可以备份
2015-06-29T11:20:04.864-0400writingtest.abctobackup/test/abc.bson
2015-06-29T11:20:04.865-0400writingtest.abcmetadatatobackup/test/abc.metadata.json
2015-06-29T11:20:04.866-0400donedumpingtest.abc
2015-06-29T11:20:04.867-0400writingtest.system.indexestobackup/test/system.indexes.bson
root@zhoujinyi:~#mongorestore--port=27020-uzjy-pzjy--db=testbackup/test/#读写权限可以进行还原
2015-06-29T11:20:26.607-0400buildingalistofcollectionstorestorefrombackup/test/dir
2015-06-29T11:20:26.609-0400readingmetadatafilefrombackup/test/abc.metadata.json
2015-06-29T11:20:26.609-0400restoringtest.abcfromfilebackup/test/abc.bson
2015-06-29T11:20:26.611-0400error:E11000duplicatekeyerrorindex:test.abc.$_id_dupkey:{:ObjectId('559154efb78649ebd831685a')}
2015-06-29T11:20:26.611-0400restoringindexesforcollectiontest.abcfrommetadata
2015-06-29T11:20:26.612-0400finishedrestoringtest.abc
2015-06-29T11:20:26.612-0400done
相关连接：
MongoDB权限控制系统简介
本文内容总结：
原文链接：https://www.cnblogs.com/zhoujinyi/p/4610050.html