? ?開啟MongoDB服務(wù)時(shí)不添加任何參數(shù)時(shí),默認(rèn)是沒(méi)有權(quán)限驗(yàn)證的,登錄的用戶可以對(duì)數(shù)據(jù)庫(kù)任意操作而且可以遠(yuǎn)程訪問(wèn)數(shù)據(jù)庫(kù)！
? ?在剛安裝完畢的時(shí)候MongoDB都默認(rèn)有一個(gè)admin數(shù)據(jù)庫(kù),此時(shí)admin數(shù)據(jù)庫(kù)是空的,沒(méi)有記錄權(quán)限相關(guān)的信息！當(dāng)admin.system.users一個(gè)用戶都沒(méi)有時(shí)，即使mongod啟動(dòng)時(shí)添加了--auth參數(shù),如果沒(méi)有在admin數(shù)據(jù)庫(kù)中添加用戶,此時(shí)不進(jìn)行任何認(rèn)證還是可以做任何操作(不管是否是以--auth 參數(shù)啟動(dòng)),直到在admin.system.users中添加了一個(gè)用戶。
需要注意的是:admin.system.users中將會(huì)保存比在其它數(shù)據(jù)庫(kù)中設(shè)置的用戶權(quán)限更大的用戶信息,擁有超級(jí)權(quán)限，也就是說(shuō)在admin中創(chuàng)建的用戶可以對(duì)mongodb中的其他數(shù)據(jù)庫(kù)數(shù)據(jù)進(jìn)行操作。
1 mongodb系統(tǒng)中,數(shù)據(jù)庫(kù)是由超級(jí)用戶來(lái)創(chuàng)建的,一個(gè)數(shù)據(jù)庫(kù)可以包含多個(gè)用戶,一個(gè)用戶只能在一個(gè)數(shù)據(jù)庫(kù)下,不同數(shù)據(jù)庫(kù)中的用戶可以同名！
2 當(dāng)admin.system.users一個(gè)用戶都沒(méi)有時(shí)，即使mongod啟動(dòng)時(shí)添加了--auth參數(shù),如果沒(méi)有在admin數(shù)據(jù)庫(kù)中添加用戶,此時(shí)不進(jìn)行任何認(rèn)證還是可以做任何操作(不管是否是以--auth 參數(shù)啟動(dòng)),直到在admin.system.users中添加了一個(gè)用戶。
3 特定數(shù)據(jù)庫(kù)比如DB1下的用戶User1,不能夠訪問(wèn)其他數(shù)據(jù)庫(kù)DB2,但是可以訪問(wèn)本數(shù)據(jù)庫(kù)下其他用戶創(chuàng)建的數(shù)據(jù)！
4 不同數(shù)據(jù)庫(kù)中同名的用戶不能夠登錄其他數(shù)據(jù)庫(kù)！比如DB1,DB2都有user1，以u(píng)ser1登錄DB1后,不能夠登錄到DB2進(jìn)行數(shù)據(jù)庫(kù)操作！
5 在admin數(shù)據(jù)庫(kù)創(chuàng)建的用戶具有超級(jí)權(quán)限，可以對(duì)mongodb系統(tǒng)內(nèi)的任何數(shù)據(jù)庫(kù)的數(shù)據(jù)對(duì)象進(jìn)行操作！

下面通過(guò)實(shí)驗(yàn)的方式進(jìn)程驗(yàn)證(可能不全面，歡迎大家指正):
1 第一次安裝monogdb時(shí)，admin數(shù)據(jù)庫(kù)中沒(méi)有任何用戶，此時(shí)不管是否以--auth方式啟動(dòng)數(shù)據(jù)庫(kù),其他數(shù)據(jù)庫(kù)(比如test數(shù)據(jù)庫(kù))中的用戶都可以對(duì)另外的數(shù)據(jù)庫(kù)(比如db1數(shù)據(jù)庫(kù))中的數(shù)據(jù)進(jìn)行操作~！
a)以默認(rèn)的方式啟動(dòng)mongodb
[mongodb@rac3 bin]$ ./mongod? --dbpath=/opt/mongodata/data --port=27000
在另一個(gè)窗口進(jìn)入mongodb shell,默認(rèn)是直接進(jìn)入test 數(shù)據(jù)庫(kù)的，并且此時(shí)用戶擁有超級(jí)權(quán)限,可以操作任何數(shù)據(jù)庫(kù)對(duì)象！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
> show dbs
local?? (empty)
#查看admin 數(shù)據(jù)庫(kù)中的用戶信息，因?yàn)槭莿偨⒌臄?shù)據(jù)庫(kù)所以u(píng)ser 為空~！
> use admin
switched to db admin
> db.system.users.find() ;
#創(chuàng)建test數(shù)據(jù)庫(kù)，并創(chuàng)建對(duì)象yql，插入數(shù)據(jù)！
> use test
switched to db test
>
> db.yql.insert({id:2,val:"yangql is learing monogdb master slave!"});
#創(chuàng)建db1數(shù)據(jù)庫(kù)，并創(chuàng)建對(duì)象db1_test，插入數(shù)據(jù)！
> use db1
switched to db db1
>
> db.db1_test.insert({id:1,val:"this data is in db1 !"});
> db.db1_test.insert({id:2,val:"this data is in db1 !"});
> db.db1_test.insert({id:3,val:"this data is in db1 !"});
#創(chuàng)建db2數(shù)據(jù)庫(kù)，并創(chuàng)建對(duì)象db2_test，插入數(shù)據(jù)！
> use db2
switched to db db2
>
> db.db2_test.insert({id:1,val:"this data is in db2!"});
> db.db2_test.insert({id:2,val:"this data is in db2!"});
> db.db2_test.insert({id:3,val:"this data is in db2!"});
> db.db2_test.find();
{ "_id" : ObjectId("4f2bbcdf2a801e73e6493f31"), "id" : 1, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce52a801e73e6493f32"), "id" : 2, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce92a801e73e6493f33"), "id" : 3, "val" : "this data is in db2!" }
>
> show dbs
admin?? (empty)
db1???? 0.203125GB
db2???? 0.203125GB
local?? (empty)
test??? 0.203125GB
#在test 數(shù)據(jù)庫(kù)中創(chuàng)建用戶yql，密碼為yql
> use test
switched to db test
>
> db.addUser("yql","yql")
{ "n" : 0, "connectionId" : 1, "err" : null, "ok" : 1 }
{
??????? "user" : "yql",
??????? "readOnly" : false,
??????? "pwd" : "868ed7035435f33b60ebeba2f363ad91",
??????? "_id" : ObjectId("4f2bbed556f179b1ccc295d1")
}

> db.auth("yql","yql") #驗(yàn)證函數(shù)，驗(yàn)證數(shù)據(jù)庫(kù)中是否存在對(duì)應(yīng)的用戶
1
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> exit
bye

b)關(guān)閉mongod 服務(wù),并以認(rèn)證方式啟動(dòng)數(shù)據(jù)庫(kù)
[mongodb@rac3 bin]$ ./mongod? --dbpath=/opt/mongodata/data --port=27000 --auth
再次登錄，雖然在test中創(chuàng)建了用戶,但是沒(méi)有在admin 數(shù)據(jù)庫(kù)中創(chuàng)建用戶,所以以默認(rèn)方式登錄的用戶依然具有超級(jí)權(quán)限
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> use test
switched to db test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
>
> use db1
switched to db db1
>
> db.db1_test.find();
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
> exit
bye
使用特定用戶登錄數(shù)據(jù)庫(kù)，也可以訪問(wèn)其他的數(shù)據(jù)庫(kù)。下面的例子說(shuō)明，test的用戶可以訪問(wèn)db1的數(shù)據(jù)
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -pyql
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> use db1
switched to db db1
> db.db1_test.find();
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
bye

2 在admin.system.users中添加用戶之后，mongodb的認(rèn)證,授權(quán)服務(wù)生效！?
#在admin 數(shù)據(jù)庫(kù)中創(chuàng)建用戶！supper 密碼為sup
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
> use admin
switched to db admin
>
> db.addUser("supper", "sup")??
{ "n" : 0, "connectionId" : 4, "err" : null, "ok" : 1 }
{
??????? "user" : "supper",
??????? "readOnly" : false,
??????? "pwd" : "51a481f72b8b8218df9fee50b3737c44",
??????? "_id" : ObjectId("4f2bc0d357a309043c6947a4")
}
>
> db.auth("supper","sup")
1
>
> exit
bye
[mongodb@rac3 bin]$
默認(rèn)方式登錄,即以無(wú)認(rèn)證用戶登錄,查詢的時(shí)候會(huì)顯示無(wú)權(quán)限！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> db.system.users.find();
error: {
??????? "$err" : "unauthorized db:test lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
>
> show dbs?
Fri Feb? 3 19:12:30 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
>
>
> exit
bye
在admin數(shù)據(jù)庫(kù)創(chuàng)建用戶后,使用認(rèn)證方式登錄,可進(jìn)行對(duì)應(yīng)數(shù)據(jù)庫(kù)的查詢操作且僅僅能夠查詢對(duì)應(yīng)的數(shù)據(jù)庫(kù)中的信息！不能夠查詢其他mongodb系統(tǒng)的其他數(shù)據(jù)庫(kù)信息！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -pyql
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> db.yql.find();
{ "_id" : ObjectId("4f2bb3662a801e73e6493f2a"), "id" : 2, "val" : "yangql is learing monogdb master slave!" }
> 查詢系統(tǒng)數(shù)據(jù)庫(kù)信息時(shí),報(bào)如下錯(cuò)誤！
> show dbs;?
Fri Feb? 3 19:15:56 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
#登錄db1
> use db1
switched to db db1
#查詢的時(shí)候，會(huì)報(bào)錯(cuò)，非授權(quán)用戶！
> db.db1_test.find();
error: {
??????? "$err" : "unauthorized db:db1 lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
> use db2
switched to db db2
>
> db.db2_test.find()
error: {
??????? "$err" : "unauthorized db:db2 lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
>
> exit
bye
使用db1的用戶可以查詢db1的數(shù)據(jù)，但是不能查看其他的數(shù)據(jù)庫(kù)的數(shù)據(jù)！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
>
> db.db1_test.find()
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bc2d7b85653a70aa4fc50"), "user" : "db1", "readOnly" : false, "pwd" : "08a3bfa3cdef4464c4738a7180465adf" }
>
> db.auth("db1","db1")
1
>
> show dbs
Fri Feb? 3 19:21:08 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
>
> use db2
switched to db db2
>
> show collections
Fri Feb? 3 19:21:24 uncaught exception: error: {
??????? "$err" : "unauthorized db:db2 lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
> use db1
switched to db db1
> show collections
db1_test
system.indexes
system.users
>
特定數(shù)據(jù)庫(kù)比如DB1下的用戶User1,是可以訪問(wèn)本數(shù)據(jù)庫(kù)下其他用戶創(chuàng)建的數(shù)據(jù)
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
>?
> db.user_db1.insert({id:1,val:"this data is created by db1 in db2!"});
> db.user_db1.insert({id:2,val:"this data is created by db1 in db2!"});
> exit
bye
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb2 -pdb2
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
>?
> db.user_db1.find();
{ "_id" : ObjectId("4f2bd237c19753688c950aaf"), "id" : 1, "val" : "this data is created by db1 in db2!" }
{ "_id" : ObjectId("4f2bd23bc19753688c950ab0"), "id" : 2, "val" : "this data is created by db1 in db2!" }
>?
>??
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -usupper -psup
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
Fri Feb? 3 19:16:55 uncaught exception: login failed
exception: login failed
3 使用supper 用戶登錄！可以對(duì)mongodb系統(tǒng)內(nèi)的所有數(shù)據(jù)庫(kù)進(jìn)行查詢,DML操作！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/admin? -usupper -psup
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/admin
>
> show dbs
admin?? 0.203125GB
db1???? 0.203125GB
db2???? 0.203125GB
local?? (empty)
test??? 0.203125GB
>
> use db1
switched to db db1
> db.db1_test.find()
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
> use db2
switched to db db2
> db.db2_test.find()
{ "_id" : ObjectId("4f2bbcdf2a801e73e6493f31"), "id" : 1, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce52a801e73e6493f32"), "id" : 2, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce92a801e73e6493f33"), "id" : 3, "val" : "this data is in db2!" }
>
> use test
switched to db test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> db.yql.find();
{ "_id" : ObjectId("4f2bb3662a801e73e6493f2a"), "id" : 2, "val" : "yangql is learing monogdb master slave!" }
>
> db.yql.remove();###刪除數(shù)據(jù)###
>
> db.yql.find();
>
> use db1
switched to db db1
>
> db.addUser("db1", "db1")??
{ "n" : 0, "connectionId" : 9, "err" : null, "ok" : 1 }
{
??????? "user" : "db1",
??????? "readOnly" : false,
??????? "pwd" : "08a3bfa3cdef4464c4738a7180465adf",
??????? "_id" : ObjectId("4f2bc2d7b85653a70aa4fc50")
}
> exit
bye
4 不同數(shù)據(jù)庫(kù)中的用戶可以同名,不同數(shù)據(jù)庫(kù)中同名的用戶依然不登錄其他數(shù)據(jù)庫(kù)！比如DB1,DB2都有user1，以u(píng)ser1登錄DB1后,不能夠登錄到DB2進(jìn)行數(shù)據(jù)庫(kù)操作！
在不同數(shù)據(jù)庫(kù)中創(chuàng)建相同的用戶,進(jìn)行測(cè)試！
測(cè)試場(chǎng)景:在test，db2數(shù)據(jù)庫(kù)中創(chuàng)建用戶db1，密碼db1
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/admin? -usupper -ppwd2
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/admin
> ?
> use db2
switched to db db2
> ?
> db.addUser("db1", "db1")??
{ "n" : 0, "connectionId" : 17, "err" : null, "ok" : 1 }
{
??????? "user" : "db1",
??????? "readOnly" : false,
??????? "pwd" : "08a3bfa3cdef4464c4738a7180465adf",
??????? "_id" : ObjectId("4f2bccb3e39cb674302ce2dd")
}
> ?
> exit
bye
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -ppwd1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
> ?
> db.addUser("db1", "db1")??
{ "n" : 0, "connectionId" : 19, "err" : null, "ok" : 1 }
{
??????? "user" : "db1",
??????? "readOnly" : false,
??????? "pwd" : "08a3bfa3cdef4464c4738a7180465adf",
??????? "_id" : ObjectId("4f2bcce9b5accbdac9e71a93")
}
> exit
bye
[mongodb@rac3 bin]$?
使用用戶db1登錄db2數(shù)據(jù)庫(kù),然后嘗試登錄db1，并進(jìn)行查詢測(cè)試，報(bào)錯(cuò)顯示未授權(quán)！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
> ?
> use db1
switched to db db1
> ?
> db.db1_test.find();
error: {
??????? "$err" : "unauthorized db:db1 lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
> ?
某個(gè)數(shù)據(jù)庫(kù)中對(duì)應(yīng)的用戶只能對(duì)本數(shù)據(jù)庫(kù)進(jìn)行操作，而不能操作其他數(shù)據(jù)庫(kù)，包括查詢和創(chuàng)建其他數(shù)據(jù)庫(kù)！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1???????
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
> ?
> ?
> use db3
switched to db db3
> ?
> db.db3_test.insert({id:1,val:"this data is in db3!"});
unauthorized
> db.db3_test.insert({id:2,val:"this data is in db3!"});
unauthorized
> db.db3_test.find();
error: {
??????? "$err" : "unauthorized db:db3 lock type:-1 client:127.0.0.1",
??????? "code" : 10057
}
> exit
bye

使用db.auth()可以對(duì)數(shù)據(jù)庫(kù)中的用戶進(jìn)行驗(yàn)證，如果驗(yàn)證成功則返回1，否則返回0！ db.auth()?只能針對(duì)登錄用戶所屬的數(shù)據(jù)庫(kù)的用戶信息進(jìn)行驗(yàn)證，不能驗(yàn)證其他數(shù)據(jù)庫(kù)的用戶信息，因?yàn)樵L問(wèn)不了其他數(shù)據(jù)庫(kù)(有點(diǎn)小白的解釋）
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
>
> db.auth("yql","pwd")
0
> db.auth("db1","db1")
1
>
> exit
bye

總結(jié)

以上是生活随笔為你收集整理的【Mongodb】用户和认证 权限总结的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。