副本集身份认证：无需密钥文件仅用账号密码可行吗？

Absolutely, you can get your MongoDB replica set authenticated with just username and password—no keyfile required. The unauthorized error in your logs is happening because your replica set members aren't using a valid authenticated user for their internal heartbeat communication. Let's fix this step by step:

Why the error pops up #

When you enable authorization on a replica set, each member needs to authenticate itself to the others when sending replSetHeartbeat commands (like you see in your logs). Without a dedicated internal user for this, the heartbeat requests get rejected as unauthorized.

Step 1: Create a dedicated replication user on the primary node #

First, connect to your primary replica set member as an admin-level user (like your existing DBAdmin), then create a user specifically for inter-member authentication:

use admin
db.createUser({
  user: "replClusterAdmin",
  pwd: "YourSuperStrongPassword123!", // Use a secure, unique password here
  roles: [
    { role: "clusterManager", db: "admin" }, // Grants permissions for cluster operations like heartbeats
    { role: "readWrite", db: "local" } // Required to access replica set metadata and oplog in the local database
  ]
})

Step 2: Update mongod configuration on all members #

Edit the mongod.conf file on every replica set member to enable authorization and set the secure SCRAM authentication mechanism:

security:
  authorization: enabled
  authenticationMechanisms: SCRAM-SHA-256 # Use SCRAM-SHA-1 if you're on MongoDB 3.0-3.2
replication:
  replSetName: rs0 # Match your actual replica set name here

Important: If you had a keyFile setting in your config before, remove it—keyfile authentication takes precedence over username/password for inter-member communication.

Step 3: Restart all mongod instances #

Restart each replica set member to apply the new configuration. Once restarted, connect to each member and authenticate with the replClusterAdmin user:

# From the command line
mongo --host <member-ip>:27017 -u replClusterAdmin -p YourSuperStrongPassword123! --authenticationDatabase admin

Or from the MongoDB shell:

use admin
db.auth("replClusterAdmin", "YourSuperStrongPassword123!")

Step 4: Verify the fix #

Check the replica set status to confirm all members are communicating properly:

rs.status()

You should see all members in a healthy state, and the Unauthorized errors in your logs will stop appearing.

Key Notes #

• All replica set members must use the same authentication mechanism (don't mix SCRAM with older mechanisms like MONGODB-CR).
• Keep the replClusterAdmin password secure—this user has critical permissions for cluster operation.
• While you could use your existing DBAdmin user for inter-member auth, it's best practice to use a dedicated user for replication to follow the principle of least privilege.

内容的提问来源于stack exchange，提问作者Mike