## 1.用户授权

## (1) 在非--auth模式下启动

/mongodb/bin/mongod --dbpath=/data/mongodb

--logpath=/mongodb/logs/mongodb.log --logappend --journal --fork

--port=27017

> use admin

switched to db admin

> db.dropDatabase();

{ "dropped" : "admin", "ok" : 1 }

> use admin

switched to db admin

## 创建一个用户,有root权限

> db.createUser({user:"admin",pwd:"admin", roles:

[{role:"root", db:"admin"}]});

Successfully added user: {

"user" : "admin",

"roles" : [

{

"role" :

"root",

"db" :

"admin"

}

]

}

## (2) 可以看到相关集合以及关于新建用户的内容

> show collections;

system.indexes

system.users

system.version

> db.system.users.find();

{ "_id" : "admin.admin", "user" : "admin", "db" : "admin",

"credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000,

"salt" : "2XdOg1YlUa5wwLj3Fx8WhA==", "storedKey"

:

"ENNWUOiKxfasE1Dz16qcXky44F4=", "serverKey" :

"deQB8LeyV4wkT4bfDf8gmbXiO9I=" } }, "roles" : [ { "role" : "root",

"db" : "admin" } ] }

> db.system.indexes.find();

{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" :

"admin.system.version" }

{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" :

"admin.system.users" }

{ "v" : 1, "unique" : true, "key" : { "user" : 1, "db" : 1 },

"name" : "user_1_db_1", "ns" : "admin.system.users" }

> db.system.version.find();

{ "_id" : "authSchema", "currentVersion" : 5 }

>

## (3)现在启用--auth

/mongodb/bin/mongod --dbpath=/data/mongodb

--logpath=/mongodb/logs/mongodb.log --logappend --journal --fork

--port=27017 --auth

## 直接mongo进去,发现啥也做不了

[root@centos511 ~]# mongo

MongoDB shell version: 3.0.7

connecting to: test

> show dbs;

2016-01-13T16:01:12.396+0800 E QUERY  Error: listDatabases failed:{

"ok" : 0,

"errmsg" : "not authorized on admin to execute

command { listDatabases: 1.0 }",

"code" : 13

}

at Error ()

at Mongo.getDBs

(src/mongo/shell/mongo.js:47:15)

at shellHelper.show

(src/mongo/shell/utils.js:630:33)

at shellHelper

(src/mongo/shell/utils.js:524:36)

at (shellhelp2):1:1 at

src/mongo/shell/mongo.js:47

>

## (4)刚才在数据库admin创建了一个账户叫admin密码admin,

##  先切换到admin库进行连接(其他db则登录失败)：

[root@centos511 ~]# mongo

MongoDB shell version: 3.0.7

connecting to: test

> db.auth("admin","admin");

Error: 18 Authentication failed.

0

> use my_mongodb;

switched to db my_mongodb

> db.auth("admin","admin");

Error: 18 Authentication failed.

0

> use admin;

switched to db admin

> db.auth("admin","admin")

1

## db.auth("admin","admin")返回值为1，说明登录成功！

##

db.auth("admin","admin")的记录是不存在的，执行完后这一行在shell中不会记录历史。

## (5) 到admin库直接用db.auth登录

> use admin;

switched to db admin

> db.auth("admin","admin");

1

## 如果写错了库名admin,

可以写正确库名admin后db.auth登录,

## 进去后可以直接删除,可以直接删除

> use amin;

switched to db amin

> db.dropDatabase();

{ "ok" : 1 }

## 切换到admin库,登录admin用户

> use admin;

switched to db admin

> db.auth("admin","admin");

1

> show dbs;

admin  0.078GB

local  0.078GB

my_mongodb  0.078GB

test  0.078GB

## (6) 所以现在创建另一个用户rwuser(切换在admin数据库创建), 有readWrite权限

>

db.createUser({user:"rwuser",pwd:"rwuser",roles:[{role:"readWrite",db:"my_mongodb"}]});

Successfully added user: {

"user" : "rwuser",

"roles" : [

{

"role" :

"readWrite",

"db" :

"my_mongodb"

}

]

}

> use my_mongodb

switched to db my_mongodb

> show tables;

system.indexes

user

## 发现无法登录

> db.auth("rwuser","rwuser");

Error: 18 Authentication failed.

0

## 只能在admin登录

> use admin

switched to db admin

> db.auth("rwuser","rwuser");

1

## 这时再切换到my_mongodb测试库,可以使用

> use my_mongodb

switched to db my_mongodb

> show tables;

system.indexes

user

## (7)对于用户, 可以增减角色:

## 增加角色:

db.grantRolesToUser("username",[{role:"",db:""}]);

db.grantRolesToUser('rwuser',[{role:"dbOwner",db:"my_mongodb"}]);

## 取消角色:

db.revokeRolesFromUser("username",[{role:"",db:""}]);

db.revokeRolesFromUser('rwuser',[{role:"readWrite",db:"my_mongodb"}]);

## 切换到admin用户

> use admin;

switched to db admin

> db.auth("admin","admin");

1

## 授予dbOwner角色, 并取消readWrite角色

>

db.grantRolesToUser('rwuser',[{role:"dbOwner",db:"my_mongodb"}]);

>

db.revokeRolesFromUser('rwuser',[{role:"readWrite",db:"my_mongodb"}]);

## my_mongodb直接登录失败

> use my_mongodb;

switched to db my_mongodb

> db.auth("rwuser","rwuser");

Error: 18 Authentication failed.

0

> db

my_mongodb

## 切换到admin登录

> use admin

switched to db admin

> db.auth("rwuser","rwuser");

1

> use my_mongodb;

switched to db my_mongodb

## dbOwner有list collections权限, 插入权限, find权限

> show collections;

system.indexes

user

>

db.user.save({"uid":3,"username":"Steven","age":27});

WriteResult({ "nInserted" : 1 })

> db.user.find({uid:3});

{ "_id" : ObjectId("56961538e8fc7d6a180d4607"), "uid" : 3,

"username" : "Steven", "age" : 27 }

(8) 在创建用户时可以在其数据库创建,不用每次切换到admin数据库登录后再切换

## 1) admin登录

> use admin;

switched to db admin

> db.auth("admin","admin");

1

## 2) 切换到业务库,进行创建用户,发现可以直接在业务库进行新用户登录

> use my_mongodb

switched to db my_mongodb

>

db.createUser({user:"usersteven",pwd:"usersteven",roles:[{

role:"dbOwner",db:"my_mongodb"}]});

Successfully added user: {

"user" : "usersteven",

"roles" : [

{

"role" :

"dbOwner",

"db" :

"my_mongodb"

}

]

}

> db.auth("usersteven","usersteven");

1

## 2.创建角色

## 切换到my_mongodb并且在数据库my_mongodb中创建角色

## roles:  创建角色"testRole"在数据库"my_mongodb" 中

## privileges: 该角色可查看"find"数据库"my_mongodb"的所有集合

## db.dropRole("testRole")进行删除角色

## (1)切换admin库admin用户登录

> use admin;

switched to db admin

> db.auth("admin","admin");

1

## (2)切换至my_mongodb,并创建角色,action行为配置为find

> use my_mongodb

switched to db my_mongodb

>

db.createRole({role:"testRole",privileges:[{resource:{db:"my_mongodb",collection:""},

actions:["find"]}],roles:[]});

{

"role" : "testRole",

"privileges" : [

{

"resource"

: {

"db" : "my_mongodb",

"collection" : ""

},

"actions"

: [

"find"

]

}

],

"roles" : [ ]

}

## (3) 去admin库admin用户登录查看授权情况

> use admin;

switched to db admin

> show collections;

system.indexes

system.roles

system.users

system.version

> db.system.roles.find();

{ "_id" : "my_mongodb.testRole", "role" : "testRole", "db" :

"my_mongodb", "privileges" : [ { "resource" : { "db" :

"my_mongodb", "collection" : "" }, "actions" : [ "find" ] } ],

"roles" : [ ] }

## (4) 回到my_mongodb,创建用户userwill,并授予自定义角色

> use my_mongodb

switched to db my_mongodb

>

db.createUser({user:"userwill",pwd:"userwill",roles:[{role:"testRole",

db:"my_mongodb"}]});

Successfully added user: {

"user" : "userwill",

"roles" : [

{

"role" :

"testRole",

"db" :

"my_mongodb"

}

]

}

## 退出,切库至my_mongodb,新用户userwill登录

> exit

bye

[root@centos511 ~]# mongo

MongoDB shell version: 3.0.7

connecting to: test

> use my_mongodb;

switched to db my_mongodb

> db.auth("userwill","userwill");

1

## 可以find

> db.user.find({uid:3});

{ "_id" : ObjectId("56961538e8fc7d6a180d4607"), "uid" : 3,

"username" : "Steven", "age" : 27 }

## 但也只有查询权限,

> db.user.save({"uid":4,"username":"will","age":28});

WriteResult({

"writeError" : {

"code" : 13,

"errmsg" : "not authorized on

my_mongodb to execute command { insert: "user", documents: [ {

uid: 4.0, username: "will", age: 28.0, _id:

ObjectId('56963bd65a3618cf60c7e08a') } ], ordered: true }"

}

})

##

(5)给testRole添加三个"privilege"权限:"update","insert","remove",再重新操作

## 给权限又只能切换到admin库admin用户登录

> use admin;

switched to db admin

> db.auth("admin","admin");

1

>

db.grantPrivilegesToRole("testRole",[{resource:{db:"my_mongodb",collection:""},actions:["update","insert","remove"]}]);

## 退出重新登录

> exit

[root@centos511 ~]# mongo

MongoDB shell version: 3.0.7

connecting to: test

## 切换到my_mongodb库

> use my_mongodb

switched to db my_mongodb

## 登录

> db.auth("userwill","userwill");

1

## 发现保存成功

> db.user.save({"uid":4,"username":"will","age":28});

WriteResult({ "nInserted" : 1 })

## uid=4记录保存成功

> db.user.find();

{ "_id" : ObjectId("56939ea79c8c3085fbb0283d"), "uid" : 2,

"username" : "Jerry", "age" : 100 }

{ "_id" : ObjectId("56939ea79c8c3085fbb0283e"), "uid" : 1,

"username" : "Tom", "age" : 25 }

{ "_id" : ObjectId("56961538e8fc7d6a180d4607"), "uid" : 3,

"username" : "Steven", "age" : 27 }

{ "_id" : ObjectId("5697399f23598adf661315c3"), "uid" : 4,

"username" : "will", "age" : 28 }

>

## 切换至admin库查看权限,发现不准

> use admin;

switched to db admin

> db.system.roles.find();

Error: error: { "$err" : "not authorized for query on

admin.system.roles", "code" : 13 }

## 只有登录admin用户才能查看权限

> db.auth("admin","admin");

1

> db.system.roles.find();

{ "_id" : "my_mongodb.testRole", "role" : "testRole", "db" :

"my_mongodb", "privileges" : [ { "resource" : { "db" :

"my_mongodb", "collection" : "" }, "actions" : [ "find", "insert",

"remove", "update" ] } ], "roles" : [ ] }

## (6) 更改角色roles, 不同于增加或减少授权, 而是完整更新。

Privileges也可以更新和替换!

> use admin

switched to db admin

> db.auth("admin","admin")

1

> use my_mongodb

switched to db my_mongodb

> db.updateRole("testRole",{ roles:[{ role: "readWrite",db:

"my_mongodb"}]},{ w:"majority" })

> db.auth("userwill","userwill");

1

> show dbs;

admin  0.078GB

local  0.078GB

my_mongodb  0.078GB

test  0.078GB