mongodb 无法在 mongo 中进行身份验证，“身份验证失败”

Cannot authenticate into mongo, "auth fails"

提问by justkevin

I've created an admin user for mongo using these directions:

我使用以下说明为 mongo 创建了一个管理员用户：

http://docs.mongodb.org/manual/tutorial/add-user-administrator/

http://docs.mongodb.org/manual/tutorial/add-user-administrator/

From the mongo client it looks like I can authenticate:

从 mongo 客户端看来，我可以进行身份​​验证：

> use admin
switched to db admin
> db.auth('admin','SECRETPASSWORD');
1
>

But I can't connect any other way. For example:

但我无法以任何其他方式连接。例如：

mongo -u admin -p SECRETPASSWORD

mongo -u admin -p 密码

gives the error:

给出错误：

JavaScript execution failed: Error: 18 { code: 18, ok: 0.0, errmsg: "auth fails" } at src/mongo/shell/db.js:L228

I have auth = truein etc/mongod.conf.

我auth = true在etc/mongod.conf.

What am I missing?

我错过了什么？

回答by gilo

Authentication is managed at a database level. When you try to connect to the system using a database, mongo actually checks for the credentials you provide in the collection <database>.system.users. So, basically when you are trying to connect to "test", it looks for the credentials in test.system.usersand returns an error because it cannot find them (as they are stored in admin.system.users). Having the right to read and write from all db doesn't mean you can directly connect to them.

身份验证在数据库级别进行管理。当您尝试使用数据库连接到系统时，mongo 实际上会检查您在集合中提供的凭据<database>.system.users。因此，基本上当您尝试连接到“测试”时，它会在 中查找凭据test.system.users并返回错误，因为它找不到它们（因为它们存储在 中admin.system.users）。有权读取和写入所有数据库并不意味着您可以直接连接到它们。

You have to connect to the database holding the credentials first. Try:

您必须先连接到保存凭据的数据库。尝试：

mongo admin -u admin -p SECRETPASSWORD

For more info, check this http://docs.mongodb.org/manual/reference/privilege-documents/

有关更多信息，请查看此http://docs.mongodb.org/manual/reference/privilege-documents/

回答by Chad E.

I also received this error, what I needed was to specify the database where the user authentication data was stored:

我也收到这个错误，我需要的是指定存储用户身份验证数据的数据库：

mongo -u admin -p SECRETPASSWORD --authenticationDatabase admin

mongo -u admin -p SECRETPASSWORD --authenticationDatabase admin

Update Nov 18 2017:

2017 年 11 月 18 日更新：

mongo admin -u admin -p

is a better solution. Mongo will prompt you for your password, this way you won't put your cleartext password into the shell history which is just terrible security practice.

是更好的解决方案。Mongo 会提示您输入密码，这样您就不会将明文密码放入 shell 历史记录中，这只是一种糟糕的安全做法。

回答by lmyers

You may need to upgrade your mongo shell. I had version 2.4.9 of the mongo shell locally, and I got this error trying to connect to a mongo 3 database. Upgrading the shell version to 3 solved the problem.

您可能需要升级 mongo shell。我在本地有 2.4.9 版的 mongo shell，在尝试连接到 mongo 3 数据库时出现此错误。将shell版本升级到3解决了这个问题。

回答by user3609666

I know this may seem obvious but I also had to use a single quote around the u/n and p/w before it worked

我知道这可能看起来很明显，但在它起作用之前，我还必须在 u/n 和 p/w 周围使用单引号

mongo admin -u 'user' -p 'password'

mongo admin -u '用户' -p '密码'

回答by Lee Parayno

In MongoDB 3.0, it now supports multiple authentication mechanisms.

在 MongoDB 3.0 中，它现在支持多种身份验证机制。

1. MongoDB Challenge and Response (SCRAM-SHA-1) - default in 3.0
2. MongoDB Challenge and Response (MONGODB-CR) - previous default (< 3.0)

1. MongoDB 挑战和响应 (SCRAM-SHA-1) - 3.0 中的默认值
2. MongoDB 挑战和响应 (MONGODB-CR) - 以前的默认值 (< 3.0)

If you started with a new 3.0 database with new users created, they would have been created using SCRAM-SHA-1.

如果您从创建了新用户的新 3.0 数据库开始，他们将使用 SCRAM-SHA-1 创建。

So you will need a driver capable of that authentication:

因此，您将需要一个能够进行该身份验证的驱动程序：

http://docs.mongodb.org/manual/release-notes/3.0-scram/#considerations-scram-sha-1-drivers

http://docs.mongodb.org/manual/release-notes/3.0-scram/#thinkations-scram-sha-1-drivers

If you had a database upgraded from 2.x with existing user data, they would still be using MONGODB-CR, and the user authentication database would have to be upgraded:

如果您有一个从 2.x 升级的数据库，并使用现有用户数据，他们仍将使用 MONGODB-CR，并且必须升级用户身份验证数据库：

http://docs.mongodb.org/manual/release-notes/3.0-scram/#upgrade-mongodb-cr-to-scram

http://docs.mongodb.org/manual/release-notes/3.0-scram/#upgrade-mongodb-cr-to-scram

Now, connecting to MongoDB 3.0 with users created with SCRAM-SHA-1 are required to specify the authentication database (via command line mongo client), and using other mechanisms if using a driver.

现在，使用 SCRAM-SHA-1 创建的用户连接到 MongoDB 3.0 需要指定身份验证数据库（通过命令行 mongo 客户端），如果使用驱动程序，则使用其他机制。

$> mongo -u USER -p PASSWORD --authenticationDatabase admin

$> mongo -u USER -p PASSWORD --authenticationDatabase admin

In this case, the "admin" database, which is also the default will be used to authenticate.

在这种情况下，将使用“admin”数据库（也是默认值）进行身份验证。

回答by justkevin

It appearsthe problem is that a user created via the method described in the mongo docs does not have permission to connect to the default database (test), even if that user was created with the "userAdminAnyDatabase" and "dbAdminAnyDatabase" roles.

它出现的问题是，通过在蒙戈文档中描述的方法创建的用户没有权限连接到默认数据库（测试），即使该用户是用“userAdminAnyDatabase”和“dbAdminAnyDatabase”角色创建。

回答by agm1984

This fixed my issue:

这解决了我的问题：

Go to terminal shell and type mongo.

转到终端外壳并键入mongo.

Then type use db_name.

然后键入use db_name。

Then type:

然后输入：

 db.createUser(
   {
     user: "mongodb",
     pwd: "dogmeatsubparflavour1337",
     roles: [ { role: "dbOwner", db: "db_name" } ]
   }
 )

Also try: db.getUsers()

还可以尝试： db.getUsers()

Quick sample:

快速样品：

const MongoClient = require('mongodb').MongoClient;

// MongoDB Connection Info
const url = 'mongodb://mongodb:[email protected]:27017/?authMechanism=DEFAULT&authSource=db_name';
// Additional options: https://docs.mongodb.com/manual/reference/connection-string/#connection-string-options

// Use Connect Method to connect to the Server
MongoClient.connect(url)
  .then((db) => {
    console.log(db);
    console.log('Casually connected correctly to server.');
    // Be careful with db.close() when working asynchronously
    db.close();
  })
  .catch((error) => {
    console.log(error);
  });

回答by agm1984

Another possibility: When you created the user, you may have accidentally been useing a database other than admin, or other than the one you wanted. You need to set --authenticationDatabaseto the database that the user was actually created under.

另一种可能性：当您创建用户时，您可能不小心使用了use以外的数据库admin，或者不是您想要的数据库。您需要设置--authenticationDatabase为用户实际创建的数据库。

mongodbseems to put you in the testdatabase by default when you open the shell, so you'd need to write --authenticationDatabase testrather than --authenticationDatabase adminif you accidentally were useing testwhen you ran db.createUser(...).

mongodbtest当您打开 shell 时，似乎默认情况下会将您放入数据库中，因此您需要编写--authenticationDatabase test而不是在运行时--authenticationDatabase admin不小心use输入.testdb.createUser(...)

Assuming you have access to the machine that's running the mongodb instance, y could disable authorization in /etc/mongod.conf(comment out authorizationwhich is nested under security), and then restart your server, and then run:

假设您有权访问运行 mongodb 实例的机器，您可以禁用授权/etc/mongod.conf（注释掉authorization嵌套在安全性下的），然后重新启动服务器，然后运行：

mongo
show users

And you might get something like this:

你可能会得到这样的东西：

{
    "_id" : "test.myusername",
    "user" : "myusername",
    "db" : "test",
    "roles" : [
        {
            "role" : "dbOwner",
            "db" : "mydatabasename"
        }
    ],
    "mechanisms" : [
        "SCRAM-SHA-1",
        "SCRAM-SHA-256"
    ]
}

Notice that the dbvalue equals test. That's because when I created the user, I didn't first run use adminor use desiredDatabaseName. So you can delete the user with db.dropUser("myusername")and then create another user under your desired database like so:

请注意，该db值等于test。那是因为当我创建用户时，我没有首先运行use admin或use desiredDatabaseName. 因此，您可以删除用户，db.dropUser("myusername")然后在所需的数据库下创建另一个用户，如下所示：

use desiredDatabaseName
db.createUser(...)

Hopefully that helps someone who was in my position as a noob with this stuff.

希望这可以帮助那些在我的位置上作为菜鸟的人。

回答by Sanjay-Dev

Unlike MYSQl and most RDBMS, MongoDB has a different setup .

与 MYSQl 和大多数 RDBMS 不同，MongoDB 具有不同的设置。

It doesn't comes with inbuilt basic auth user already setup.You need to setup manually . You need to go to Mongo.conf and enable Authorization , Please enable it cautiously failing to do so will throw error in starting your mongo instance . You then check if your mongo server started or not .

它没有内置基本身份验证用户已经设置。您需要手动设置。您需要转到 Mongo.conf 并启用授权，请谨慎启用它，否则将在启动 mongo 实例时引发错误。然后检查您的 mongo 服务器是否已启动。

Next Step is Enable Authorization in Mongo as User :-

下一步是以用户身份在 Mongo 中启用授权：-

We need to create a user which has root access and change mongo auth config .

我们需要创建一个具有 root 访问权限的用户并更改 mongo auth config 。

Switch to Admin DB:-

切换到管理数据库：-

use admin

Create User with Root Privilage :-

创建具有根权限的用户：-

 db.createUser({user:"admin",
                     pwd:"admin",
                    roles:[{role:"root",
                             db:"admin"
                            }] });

Change Your mongo.conf to Enable Authorization :-

将您的 mongo.conf 更改为启用授权：-

security:
    authorization: "enabled"

Please go through this step by step guide to Setupauth in MongoDB.

请仔细阅读此分步指南，以在 MongoDB 中设置身份验证。

回答by Moh .S

The proper way to login into mongo shell is

登录 mongo shell 的正确方法是

mongo localhost:27017 -u 'uuuuu' -p '>xxxxxx' --authenticationDatabase dbname

mongo 本地主机：27017 -u 'uuuuu' -p '>xxxxxx' --authenticationDatabase dbname