原博地址：MongoDB用戶認證和權限
開啓MongoDB服務時不添加任何參數時,默認是沒有權限驗證的,登錄的用戶可以對數據庫任意操作而且可以遠程訪問數據庫！
在剛安裝完畢的時候MongoDB都默認有一個admin數據庫,此時admin數據庫是空的,沒有記錄權限相關的信息！當admin.system.users一個用戶都沒有時，即使mongod啓動時添加了--auth參數,如果沒有在admin數據庫中添加用戶,此時不進行任何認證還是可以做任何操作(不管是否是以--auth 參數啓動),直到在admin.system.users中添加了一個用戶。
需要注意的是:admin.system.users中將會保存比在其它數據庫中設置的用戶權限更大的用戶信息,擁有超級權限，也就是說在admin中創建的用戶可以對mongodb中的其他數據庫數據進行操作。
1 mongodb系統中,數據庫是由超級用戶來創建的,一個數據庫可以包含多個用戶,一個用戶只能在一個數據庫下,不同數據庫中的用戶可以同名！
2 當admin.system.users一個用戶都沒有時，即使mongod啓動時添加了--auth參數,如果沒有在admin數據庫中添加用戶,此時不進行任何認證還是可以做任何操作(不管是否是以--auth 參數啓動),直到在admin.system.users中添加了一個用戶。
3 特定數據庫比如DB1下的用戶User1,不能夠訪問其他數據庫DB2,但是可以訪問本數據庫下其他用戶創建的數據！
4 不同數據庫中同名的用戶不能夠登錄其他數據庫！比如DB1,DB2都有user1，以user1登錄DB1後,不能夠登錄到DB2進行數據庫操作！
5 在admin數據庫創建的用戶具有超級權限，可以對mongodb系統內的任何數據庫的數據對象進行操作！
下面通過實驗的方式進程驗證(可能不全面，歡迎大家指正):
1 第一次安裝monogdb時，admin數據庫中沒有任何用戶，此時不管是否以--auth方式啓動數據庫,其他數據庫(比如test數據庫)中的用戶都可以對另外的數據庫(比如db1數據庫)中的數據進行操作~！
a)以默認的方式啓動mongodb
[mongodb@rac3 bin]$ ./mongod --dbpath=/opt/mongodata/data --port=27000
在另一個窗口進入mongodb shell,默認是直接進入test 數據庫的，並且此時用戶擁有超級權限,可以操作任何數據庫對象！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
> show dbs
local (empty)
#查看admin 數據庫中的用戶信息，因爲是剛建立的數據庫所以user 爲空~！
> use admin
switched to db admin
> db.system.users.find() ;
#創建test數據庫，並創建對象yql，插入數據！
> use test
switched to db test
>
> db.yql.insert({id:2,val:"yangql is learing monogdb master slave!"});
#創建db1數據庫，並創建對象db1_test，插入數據！
> use db1
switched to db db1
>
> db.db1_test.insert({id:1,val:"this data is in db1 !"});
> db.db1_test.insert({id:2,val:"this data is in db1 !"});
> db.db1_test.insert({id:3,val:"this data is in db1 !"});
#創建db2數據庫，並創建對象db2_test，插入數據！
> use db2
switched to db db2
>
> db.db2_test.insert({id:1,val:"this data is in db2!"});
> db.db2_test.insert({id:2,val:"this data is in db2!"});
> db.db2_test.insert({id:3,val:"this data is in db2!"});
> db.db2_test.find();
{ "_id" : ObjectId("4f2bbcdf2a801e73e6493f31"), "id" : 1, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce52a801e73e6493f32"), "id" : 2, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce92a801e73e6493f33"), "id" : 3, "val" : "this data is in db2!" }
>
> show dbs
admin (empty)
db1 0.203125GB
db2 0.203125GB
local (empty)
test 0.203125GB
#在test 數據庫中創建用戶yql，密碼爲yql
> use test
switched to db test
>
> db.addUser("yql","yql")
{ "n" : 0, "connectionId" : 1, "err" : null, "ok" : 1 }
{
"user" : "yql",
"readOnly" : false,
"pwd" : "868ed7035435f33b60ebeba2f363ad91",
"_id" : ObjectId("4f2bbed556f179b1ccc295d1")
}
> db.auth("yql","yql") #驗證函數，驗證數據庫中是否存在對應的用戶
1
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> exit
bye
b)關閉mongod 服務,並以認證方式啓動數據庫
[mongodb@rac3 bin]$ ./mongod --dbpath=/opt/mongodata/data --port=27000 --auth
再次登錄，雖然在test中創建了用戶,但是沒有在admin 數據庫中創建用戶,所以以默認方式登錄的用戶依然具有超級權限
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> use test
switched to db test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
>
> use db1
switched to db db1
>
> db.db1_test.find();
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
> exit
bye
使用特定用戶登錄數據庫，也可以訪問其他的數據庫。下面的例子說明，test的用戶可以訪問db1的數據
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -pyql
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> use db1
switched to db db1
> db.db1_test.find();
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
bye
2 在admin.system.users中添加用戶之後，mongodb的認證,授權服務生效！
#在admin 數據庫中創建用戶！supper 密碼爲sup
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
> use admin
switched to db admin
>
> db.addUser("supper", "sup")
{ "n" : 0, "connectionId" : 4, "err" : null, "ok" : 1 }
{
"user" : "supper",
"readOnly" : false,
"pwd" : "51a481f72b8b8218df9fee50b3737c44",
"_id" : ObjectId("4f2bc0d357a309043c6947a4")
}
>
> db.auth("supper","sup")
1
>
> exit
bye
[mongodb@rac3 bin]$
默認方式登錄,即以無認證用戶登錄,查詢的時候會顯示無權限！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> db.system.users.find();
error: {
"$err" : "unauthorized db:test lock type:-1 client:127.0.0.1",
"code" : 10057
}
>
> show dbs
Fri Feb 3 19:12:30 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
>
>
> exit
bye
在admin數據庫創建用戶後,使用認證方式登錄,可進行對應數據庫的查詢操作且僅僅能夠查詢對應的數據庫中的信息！不能夠查詢其他mongodb系統的其他數據庫信息！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -pyql
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> db.yql.find();
{ "_id" : ObjectId("4f2bb3662a801e73e6493f2a"), "id" : 2, "val" : "yangql is learing monogdb master slave!" }
>查詢系統數據庫信息時,報如下錯誤！
> show dbs;
Fri Feb 3 19:15:56 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
#登錄db1
> use db1
switched to db db1
#查詢的時候，會報錯，非授權用戶！
> db.db1_test.find();
error: {
"$err" : "unauthorized db:db1 lock type:-1 client:127.0.0.1",
"code" : 10057
}
> use db2
switched to db db2
>
> db.db2_test.find()
error: {
"$err" : "unauthorized db:db2 lock type:-1 client:127.0.0.1",
"code" : 10057
}
>
> exit
bye
使用db1的用戶可以查詢db1的數據，但是不能查看其他的數據庫的數據！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
>
> db.db1_test.find()
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bc2d7b85653a70aa4fc50"), "user" : "db1", "readOnly" : false, "pwd" : "08a3bfa3cdef4464c4738a7180465adf" }
>
> db.auth("db1","db1")
1
>
> show dbs
Fri Feb 3 19:21:08 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }
>
> use db2
switched to db db2
>
> show collections
Fri Feb 3 19:21:24 uncaught exception: error: {
"$err" : "unauthorized db:db2 lock type:-1 client:127.0.0.1",
"code" : 10057
}
> use db1
switched to db db1
> show collections
db1_test
system.indexes
system.users
>
特定數據庫比如DB1下的用戶User1,是可以訪問本數據庫下其他用戶創建的數據
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
>
> db.user_db1.insert({id:1,val:"this data is created by db1 in db2!"});
> db.user_db1.insert({id:2,val:"this data is created by db1 in db2!"});
> exit
bye
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb2 -pdb2
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
>
> db.user_db1.find();
{ "_id" : ObjectId("4f2bd237c19753688c950aaf"), "id" : 1, "val" : "this data is created by db1 in db2!" }
{ "_id" : ObjectId("4f2bd23bc19753688c950ab0"), "id" : 2, "val" : "this data is created by db1 in db2!" }
>
>
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -usupper -psup
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
Fri Feb 3 19:16:55 uncaught exception: login failed
exception: login failed
3 使用supper 用戶登錄！可以對mongodb系統內的所有數據庫進行查詢,DML操作！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/admin -usupper -psup
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/admin
>
> show dbs
admin 0.203125GB
db1 0.203125GB
db2 0.203125GB
local (empty)
test 0.203125GB
>
> use db1
switched to db db1
> db.db1_test.find()
{ "_id" : ObjectId("4f2bb3a42a801e73e6493f2b"), "id" : 1, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3ae2a801e73e6493f2c"), "id" : 2, "val" : "this data is in db1 !" }
{ "_id" : ObjectId("4f2bb3b32a801e73e6493f2d"), "id" : 3, "val" : "this data is in db1 !" }
> use db2
switched to db db2
> db.db2_test.find()
{ "_id" : ObjectId("4f2bbcdf2a801e73e6493f31"), "id" : 1, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce52a801e73e6493f32"), "id" : 2, "val" : "this data is in db2!" }
{ "_id" : ObjectId("4f2bbce92a801e73e6493f33"), "id" : 3, "val" : "this data is in db2!" }
>
> use test
switched to db test
>
> db.system.users.find();
{ "_id" : ObjectId("4f2bbed556f179b1ccc295d1"), "user" : "yql", "readOnly" : false, "pwd" : "868ed7035435f33b60ebeba2f363ad91" }
>
> db.yql.find();
{ "_id" : ObjectId("4f2bb3662a801e73e6493f2a"), "id" : 2, "val" : "yangql is learing monogdb master slave!" }
>
> db.yql.remove();###刪除數據###
>
> db.yql.find();
>
> use db1
switched to db db1
>
> db.addUser("db1", "db1")
{ "n" : 0, "connectionId" : 9, "err" : null, "ok" : 1 }
{
"user" : "db1",
"readOnly" : false,
"pwd" : "08a3bfa3cdef4464c4738a7180465adf",
"_id" : ObjectId("4f2bc2d7b85653a70aa4fc50")
}
> exit
bye
4 不同數據庫中的用戶可以同名,不同數據庫中同名的用戶依然不登錄其他數據庫！比如DB1,DB2都有user1，以user1登錄DB1後,不能夠登錄到DB2進行數據庫操作！
在不同數據庫中創建相同的用戶,進行測試！
測試場景:在test，db2數據庫中創建用戶db1，密碼db1
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/admin -usupper -ppwd2
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/admin
>
> use db2
switched to db db2
>
> db.addUser("db1", "db1")
{ "n" : 0, "connectionId" : 17, "err" : null, "ok" : 1 }
{
"user" : "db1",
"readOnly" : false,
"pwd" : "08a3bfa3cdef4464c4738a7180465adf",
"_id" : ObjectId("4f2bccb3e39cb674302ce2dd")
}
>
> exit
bye
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000 -uyql -ppwd1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/test
>
> db.addUser("db1", "db1")
{ "n" : 0, "connectionId" : 19, "err" : null, "ok" : 1 }
{
"user" : "db1",
"readOnly" : false,
"pwd" : "08a3bfa3cdef4464c4738a7180465adf",
"_id" : ObjectId("4f2bcce9b5accbdac9e71a93")
}
> exit
bye
[mongodb@rac3 bin]$
使用用戶db1登錄db2數據庫,然後嘗試登錄db1，並進行查詢測試，報錯顯示未授權！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db2 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db2
>
> use db1
switched to db db1
>
> db.db1_test.find();
error: {
"$err" : "unauthorized db:db1 lock type:-1 client:127.0.0.1",
"code" : 10057
}
>
某個數據庫中對應的用戶只能對本數據庫進行操作，而不能操作其他數據庫，包括查詢和創建其他數據庫！
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
>
>
> use db3
switched to db db3
>
> db.db3_test.insert({id:1,val:"this data is in db3!"});
unauthorized
> db.db3_test.insert({id:2,val:"this data is in db3!"});
unauthorized
> db.db3_test.find();
error: {
"$err" : "unauthorized db:db3 lock type:-1 client:127.0.0.1",
"code" : 10057
}
> exit
bye
使用db.auth()可以對數據庫中的用戶進行驗證，如果驗證成功則返回1，否則返回0！db.auth() 只能針對登錄用戶所屬的數據庫的用戶信息進行驗證，不能驗證其他數據庫的用戶信息，因爲訪問不了其他數據庫(有點小白的解釋）
[mongodb@rac3 bin]$ ./mongo 127.0.0.1:27000/db1 -udb1 -pdb1
MongoDB shell version: 2.0.1
connecting to: 127.0.0.1:27000/db1
>
> db.auth("yql","pwd")
0
> db.auth("db1","db1")
1
>
> exit
bye
------------------------------EOF-----------------------------