将用户添加到新的/另一个mongo数据库需要什么MongoDB用户权限？

Question

在添加一个具有以下权限的管理员用户后,我在MongoDB配置文件中启用了身份验证:userAdmin和userAdminAnyDatabase.

现在我将此用户连接到定义了此管理员用户的数据库(否​​则我得到exception: login failed).

我成功连接后,我想将新用户添加到新数据库.为此,我正在努力:

use another
db.addUser(...)

但是我收到一个错误:

Wed Dec 11 17:45:18.277 couldn't add user: not authorized for insert on app.system.users at src/mongo/shell/db.js:128

如何创建新数据库并向其添加第一个用户？

---

详细(在此示例中,所有用户都有1234作为密码)

$ mongo mono -u admin_all -p 1234
MongoDB shell version: 2.4.6
connecting to: mono
> db.system.users.find()
{ "_id" : ObjectId("52a9831de41eb640bb0f5f64"), "user" : "admin_all", "pwd" : "a6316ed4886c10663cce46bc216ea375", "roles" : [  "userAdmin",  "userAdminAnyDatabase" ] }
{ "_id" : ObjectId("52a98404ef1f9bc934b62e11"), "user" : "admin_one", "pwd" : "884f516cf308a4c6a75bbc5a0a00807b", "roles" : [  "userAdmin" ] }
{ "_id" : ObjectId("52a98415ef1f9bc934b62e12"), "user" : "admin_any", "pwd" : "1616611df9b47c58b607054d384cab99", "roles" : [  "userAdminAnyDatabase" ] }
> use another
switched to db another
> db.addUser({ user: "user", pwd: "1234", roles: ["read"] })
{
    "user" : "user",
    "pwd" : "461d4f349d8d4ec3d22a4c945010c330",
    "roles" : [
        "read"
    ],
    "_id" : ObjectId("52a985372fcdbfd033003a7e")
}
Thu Dec 12 10:43:19.091 couldn't add user: not authorized for insert on another.system.users at src/mongo/shell/db.js:128

Answer 1

犯的错误是,我使用userAdminAnyDatabase的是用户是不是在管理数据库(见本说明).所以必须在你的服务器上有一个名为admin的数据库!正如文档所说的"AnyDatabase"特权:

如果将任何这些角色添加到admin数据库之外的用户权限文档,则该权限将不起作用.

所以你必须:

• 添加userAdminAnyDatabase到admin数据库

  $ mongo admin
  > db.createUser({ user: "myadmin", pwd: "1234", roles: ["userAdminAnyDatabase"] })
  

• 打开身份验证

  auth = true
  setParameter = enableLocalhostAuthBypass=0
  

• 使用新myadmin用户连接到您想要的任何数据库并添加更多用户:

  $ mongo another -u myadmin -p 1234
  > db.createUser({ user: "user", pwd: "1234", roles: ["readWrite"] })
  

  要么

  > use another
  > db.createUser({ user: "user", pwd: "1234", roles: ["readWrite"] })