Enable Access Control启用访问控制¶

Start MongoDB without access control.在没有访问控制的情况下启动MongoDB。¶

Start a standalone mongod instance without access control.启动没有访问控制的独立mongod实例。

For example, open a terminal and issue the following:例如，打开终端并发出以下命令：

mongod --port 27017 --dbpath /var/lib/mongodb

Connect to the instance.连接到实例。¶

For example, open a new terminal and connect a mongo shell to the instance:例如，打开一个新的终端，将mongo shell连接到实例：

mongo --port 27017

Specify additional command line options as appropriate to connect the mongo shell to your deployment, such as --host.根据需要指定其他命令行选项以将mongo shell连接到部署，例如--host。

Create the user administrator.创建用户管理员。¶

From the mongo shell, add a user with the userAdminAnyDatabase role in the admin database.在mongo shell中，在admin数据库中添加一个具有userAdminAnyDatabase角色的用户。Include additional roles as needed for this user.包括此用户所需的其他角色。For example, the following creates the user myUserAdmin in the admin database with the userAdminAnyDatabase role and the readWriteAnyDatabase role.例如，下面在admin数据库中创建用户myUserAdmin，角色为userAdminAnyDatabase和readWriteAnyDatabase。

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
  }
)

Re-start the MongoDB instance with access control.使用访问控制重新启动MongoDB实例。¶

1. Shut down the mongod instance.关闭mongod实例。For example, from the mongo shell, issue the following command:例如，从mongo shell发出以下命令：

   db.adminCommand( { shutdown: 1 } )

2. Exit the mongo shell.退出mongo shell。
3. Start the mongod with access control enabled.在启用访问控制的情况下启动mongod。
   • If you start the mongod from the command line, add the --auth command line option:如果从命令行启动mongod，请添加--auth命令行选项：

     mongod --auth --port 27017 --dbpath /var/lib/mongodb

   • If you start the mongod using a configuration file, add the security.authorization configuration file setting:如果使用配置文件启动mongod，请添加security.authorization配置文件设置：

     security:
         authorization: enabled

Clients that connect to this instance must now authenticate themselves as a MongoDB user.连接到此实例的客户端现在必须将自己验证为MongoDB用户。Clients can only perform actions as determined by their assigned roles.客户端只能执行由其分配的角色确定的操作。

Connect and authenticate as the user administrator.以用户管理员身份进行连接和身份验证。¶

Using the mongo shell, you can:使用mongo shell，您可以：

• Connect with authentication by passing in user credentials, or通过传入用户凭据连接身份验证，或
• Connect first without authentication, and then issue the db.auth() method to authenticate.先连接而不进行身份验证，然后发出db.auth()验证方法。

mongo --port 27017  --authenticationDatabase "admin" -u "myUserAdmin" -p

mongo --port 27017

use admin
db.auth("myUserAdmin", passwordPrompt()) // or cleartext password

Create additional users as needed for your deployment.根据部署需要创建其他用户。¶

Once authenticated as the user administrator, use db.createUser() to create additional users.身份验证为用户管理员后，使用db.createUser()以创建其他用户。You can assign any built-in roles or user-defined roles to the users.您可以将任何内置角色或用户定义的角色分配给用户。

The following operation adds a user myTester to the test database who has readWrite role in the test database as well as read role in the reporting database.以下操作将用户myTester添加到test数据库中，该用户在测试数据库中具有readWrite角色，在reporting数据库中具有read角色。

use test
db.createUser(
  {
    user: "myTester",
    pwd:  passwordPrompt(),   // or cleartext password
    roles: [ { role: "readWrite", db: "test" },
             { role: "read", db: "reporting" } ]
  }
)

After creating the additional users, disconnect the mongo shell.创建其他用户后，断开mongo shell的连接。

Connect to the instance and authenticate as myTester.连接到实例并作为myTester进行身份验证。¶

After disconnecting the mongo shell as myUserAdmin, reconnect as myTester.以myUserAdmin身份断开mongo shell后，以myTester身份重新连接。You can:你可以：

• Connect with authentication by passing in user credentials, or通过传入用户凭据连接身份验证，或
• Connect first withouth authentication, and then issue the db.auth() method to authenticate.先连接而不进行身份验证，然后发出db.auth()方法验证。

mongo --port 27017 -u "myTester" --authenticationDatabase "test" -p

mongo --port 27017

use test
db.auth("myTester", passwordPrompt())  // or cleartext password

Insert a document as myTester.插入一个文档作为myTester。¶

As myTester, you have privileges to perform read and write operations in the test database (as well as perform read operations in the reporting database).作为myTester，您有权在test数据库中执行读写操作（以及在reporting数据库中执行读操作）。Once authenticated as myTester, insert a document into a collection in test database.作为myTester进行身份验证后，将文档插入到测试数据库中的集合中。For example, you can perform the following insert operation in the test database:例如，可以在test数据库中执行以下插入操作：

db.foo.insert( { x: 1, y: 1 } )