mongodb - 通过 debezium mongodb 连接器连接到 mongodb 时身份验证失败

Question

部署了Strimzi Kafka、Strimzi Zookeeper和Debezium mongodb连接器，并配置了Debezium mongodb，

curl 'http://my-connect-cluster-connect-api:8083/connectors' -X POST -i -H "Content-Type:application/json" -d '{
  "name": "mongodb-connector", 
  "config": {
    "connector.class": "io.debezium.connector.mongodb.MongoDbConnector",
    "mongodb.hosts": "MainRepSet/mongod-0.mongodb-service.kafka.svc.cluster.local:27017,mongod-1.mongodb-service.kafka.svc.cluster.local:27017,mongod-2.mongodb-service.kafka.svc.cluster.local:27017", 
    "mongodb.name": "MainRepSet", 
    "collection.whitelist": "springdatabase[.]*",
    "mongodb.user": "springuser",
    "mongodb.password": "password"
  }
}'

但是得到了身份验证异常，

2019-01-29 13:13:40,170 ERROR Error while reading the 'shards' collection in the 'config' database: Timed out after 30000 ms while waiting to connect. Client view of cluster state is {type=UNKNOWN, servers=[{address=mongod-2.mongodb-service.kafka.svc.cluster.local:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSecurityException: Exception authenticating MongoCredential{mechanism=null, userName='springuser', source='admin', password=<hidden>, mechanismProperties={}}}, caused by {com.mongodb.MongoCommandException: Command failed with error 18: 'Authentication failed.' on server mongod-2.mongodb-service.kafka.svc.cluster.local:27017. The full response is { "operationTime" : { "$timestamp" : { "t" : 1548767616, "i" : 1 } }, "ok" : 0.0, "errmsg" : "Authentication failed.", "code" : 18, "codeName" : "AuthenticationFailed", "$clusterTime" : { "clusterTime" : { "$timestamp" : { "t" : 1548767616, "i" : 1 } }, "signature" : { "hash" : { "$binary" : "M7qA9dMzPj1sC8lfT681vT57oPw=", "$type" : "00" }, "keyId" : { "$numberLong" : "6651444731228192769" } } } }}},

以及我通过以下语句创建的 mongodb 帐户，

db.createUser({user:"springuser",pwd:"password",roles:[{role:"readWrite",db:"springdatabase"}]})

分析异常，debezium mongodb authSource默认使用"source='admin'"，但是我mongodb账号的authSource是'springdatabase'，我认为是认证失败的原因。

解决方法之一是使用默认的“admin”创建 mongodb 帐户。但是我们的生产 mongodb 帐户已经创建，因此我们无法更改它。

那么是否有任何配置属性来设置“authSource”？

Answer 1

事实上，Debezium 对管理连接进行了硬编码，这可能是为了方便，因为它需要从 oplog 中读取。

我看到您在项目本身中创建了一个错误，但是如果您想拥有 - 现在 - 必要的安全权限，您可以:

// Create a role which allows to list the databases
db.runCommand({createRole:"listDatabases",privileges:[{resource:{cluster:true},
           actions:["listDatabases"]}],roles:[]})

// Create a user which can, list the databases, read the oplog (local db), and read the source database (for initial syncs)
db.createUser({
"user" : "debezium_read_only",
    "roles" : [
        {
            "role" : "justListDatabases",
            "db" : "admin"
        },
        {
            "role" : "read",
            "db" : "database_where_collections_are"
        },
        {
            "role" : "read",
            "db" : "local"
        }
    ]
})

我希望这有助于保护您的设置，直到在 Debezium 中提供更好的登录选项。