ActiveDirectory와 함께 자체 관리형 SASL 및 LDAP 를 사용하여 인증

Specify the mechanism.

On systems that configure saslauthd with the /etc/sysconfig/saslauthd file, such as Red Hat Enterprise Linux, Fedora, CentOS, and Amazon Linux AMI, set the mechanism MECH to ldap:

MECH=ldap

On systems that configure saslauthd with the /etc/default/saslauthd file, such as Ubuntu, set the MECHANISMS option to ldap:

MECHANISMS="ldap"

Adjust caching behavior.

On certain Linux distributions, saslauthd starts with the caching of authentication credentials enabled. Until restarted or until the cache expires, saslauthd will not contact the LDAP server to re-authenticate users in its authentication cache. This allows saslauthd to successfully authenticate users in its cache, even in the LDAP server is down or if the cached users' credentials are revoked.

To set the expiration time (in seconds) for the authentication cache, see the -t option of saslauthd.

Configure LDAP Options with ActiveDirectory.

If the saslauthd.conf file does not exist, create it. The saslauthd.conf file usually resides in the /etc folder. If specifying a different file path, see the -O option of saslauthd.

To use with ActiveDirectory, start saslauthd with the following configuration options set in the saslauthd.conf file:

ldap_servers: <ldap uri>
ldap_use_sasl: yes
ldap_mech: DIGEST-MD5
ldap_auth_method: fastbind

For the <ldap uri>, specify the uri of the ldap server. For example, ldap_servers: ldaps://ad.example.net.

For more information on saslauthd configuration, see http://www.openldap.org/doc/admin24/guide.html#Configuringsaslauthd.

Test the saslauthd configuration.

다음을 사용하세요. testsaslauthd utility to test the saslauthd configuration. For example:

testsaslauthd -u testuser -p testpassword -f /var/run/saslauthd/mux

• 0: OK "Success" indicates successful authentication.

• 0: NO "authentication failed" indicates a username, password, or configuration error.

Modify the file path with respect to the location of the saslauthd directory on the host operating system.

Add user to MongoDB for authentication.

Add the user to the $external database in MongoDB. To specify the user's privileges, assign roles to the user.

$external 인증 사용자(Kerberos, LDAP 또는 X.509 사용자)와 함께 클라이언트 세션 및 인과적 일관성 보장 을 사용하려면 사용자 이름이 10KB보다 클 수 없습니다.

For example, the following adds a user with read-only access to the records database.

db.getSiblingDB("$external").createUser(
    {
      user : <username>,
      roles: [ { role: "read", db: "records" } ]
    }
)

Add additional principals as needed. For more information about creating and managing users, see 사용자 관리 명령.

Configure MongoDB server.

To configure the MongoDB server to use the saslauthd instance for proxy authentication, include the following options when starting mongod:

• --auth command line option or security.authorization setting,

• authenticationMechanisms parameter set to PLAIN, and

• saslauthdPath parameter set to the path to the Unix-domain Socket of the saslauthd instance.

  중요

  security.sasl.saslauthdSocketPath 또는 --setParameter saslauthdPath로 지정된 saslauthd Unix 도메인 소켓 파일의 상위 디렉토리에 다음 대상에 대해 읽기 및 실행(r-x) 권한을 부여해야 합니다:

  • mongod 또는 mongos를 시작하는 사용자 또는

  • 해당 사용자가 속한 그룹.

  mongod 또는 mongos는 saslauthd 디렉토리 및 해당 콘텐츠에 대해 지정된 권한이 없으면 saslauthd를 통해 인증할 수 없습니다.

If you use the authorization option to enforce authentication, you will need privileges to create a user.

mongod --auth --setParameter saslauthdPath=/<some>/<path>/saslauthd/mux --setParameter authenticationMechanisms=PLAIN

Or if using a YAML format configuration file, specify the following settings in the file:

security:
   authorization: enabled
setParameter:
   saslauthdPath: /<some>/<path>/saslauthd/mux
   authenticationMechanisms: PLAIN

Or, if using the older configuration file format:

auth=true
setParameter=saslauthdPath=/<some>/<path>/saslauthd/mux
setParameter=authenticationMechanisms=PLAIN

mongod --auth --setParameter saslauthdPath="" --setParameter authenticationMechanisms=PLAIN

Or if using a YAML format configuration file, specify the following settings in the file:

security:
   authorization: enabled
setParameter:
   saslauthdPath: ""
   authenticationMechanisms: PLAIN

Or, if using the older configuration file format:

auth=true
setParameter=saslauthdPath=""
setParameter=authenticationMechanisms=PLAIN

구성에 필요한 추가 옵션을 포함합니다. 예를 들어 원격 클라이언트가 배포에 연결하거나 배포 멤버가 다른 호스트에서 실행되도록 하려면 net.bindIp 설정을 지정하세요.

Authenticate the user in mongosh.

You can authenticate from the command line during connection, or connect first and then authenticate using db.auth() method.

mongosh --host <host> --authenticationMechanism PLAIN --authenticationDatabase '$external' -u <user> -p

db.getSiblingDB("$external").auth(
   {
     mechanism: "PLAIN",
     user: <username>,
     pwd:  passwordPrompt() // or cleartext password
   }
)

The server forwards the password in plain text. In general, use only on a trusted channel (VPN, TLS/SSL, trusted wired network). See Considerations.