KeyVault.addKeyAlternateName()（mongosh方法）

KeyVault.addKeyAlternateName(UUID, keyAltName)

使用 UUID 将keyAltName添加到数据加密密钥的 keyAltNames数组。

keyAltName 在密钥保管库的所有密钥中必须是唯一的。 getKeyVault()方法自动在keyAltNames字段上创建唯一索引，并使用仅针对存在keyAltNames的文档的部分索引筛选器。

返回：	返回数据加密密钥文档的先前版本。如果没有数据加密密钥具有指定的，则返回`nullUUID()` 。

兼容性

此命令可用于以下环境中托管的部署：

MongoDB Atlas：用于云中 MongoDB 部署的完全托管服务

MongoDB Enterprise：基于订阅、自我管理的 MongoDB 版本
MongoDB Community：源代码可用、免费使用且可自行管理的 MongoDB 版本

语法

addKeyAlternateName() 通过以下语法实现：

keyVault = db.getMongo().getKeyVault()
keyVault.addKeyAlternateName(
   UUID("<UUID string>"),
   "keyAlternateName"
)

行为

需要在数据库连接上配置客户端字段级加密

The mongosh client-side field level encryption methods require a database connection with client-side field level encryption enabled. If the current database connection was not initiated with client-side field level encryption enabled, either:

Use the Mongo() constructor from the mongosh to establish a connection with the required client-side field level encryption options. The Mongo() method supports the following Key Management Service (KMS) providers for Customer Master Key (CMK) management:
or
Use the mongosh command line options to establish a connection with the required options. The command line options only support the Amazon Web Services KMS provider for CMK management.

例子

The following example is intended for rapid evaluation of client-side field level encryption. For specific examples of using KeyVault.addKeyAlternateName() with each supported KMS provider, see Encryption Key Management.

启动 mongosh

启动mongosh客户端。

mongosh --nodb

生成密钥

要为本地托管的密钥配置客户端字段级加密，请生成一个不带换行符的 base64 编码的 96 字节字符串。

const TEST_LOCAL_KEY = require("crypto").randomBytes(96).toString("base64")

创建客户端字段级加密选项

使用生成的本地密钥字符串创建客户端字段级加密选项：

 let autoEncryptionOpts = {
   "keyVaultNamespace" : "encryption.__dataKeys",
   "kmsProviders" : {
     "local" : {
       "key" : BinData(0, TEST_LOCAL_KEY)
     }
   }
 }

创建加密客户端

使用配置了客户端字段级加密选项的Mongo()构造函数来创建数据库连接。将mongodb://myMongo.example.net URI 替换为目标集群的连接字符串 URI 。

encryptedClient = Mongo(
  "mongodb://myMongo.example.net:27017/?replSetName=myMongo",
   autoEncryptionOpts
)

Retrieve the KeyVault object and use the KeyVault.addKeyAlternateName() method to add a new key alternate name to the data encryption key with matching UUID. The specified key alternate name must be unique:

keyVault = encryptedClient.getKeyVault()
keyVault.addKeyAlternateName(UUID("b4b41b33-5c97-412e-a02b-743498346079"),"Other-Data-Encryption-Key")

If successful, addKeyAlternateName() returns the previous version of data encryption key document:

{
    "_id" : UUID("b4b41b33-5c97-412e-a02b-743498346079"),
    "keyMaterial" : BinData(0,"PXRsLOAYxhzTS/mFQAI8486da7BwZgqA91UI7NKz/T/AjB0uJZxTvhvmQQsKbCJYsWVS/cp5Rqy/FUX2zZwxJOJmI3rosPhzV0OI5y1cuXhAlLWlj03CnTcOSRzE/YIrsCjMB0/NyiZ7MRWUYzLAEQnE30d947XCiiHIb8a0kt2SD0so8vZvSuP2n0Vtz4NYqnzF0CkhZSWFa2e2yA=="),
    "creationDate" : ISODate("2019-08-12T21:21:30.569Z"),
    "updateDate" : ISODate("2019-08-12T21:21:30.569Z"),
    "status" : 0,
    "version" : Long(0),
    "masterKey" : {
        "provider" : "local"
    },
    "keyAltNames" : [
    ]
}

要查看数据加密密钥文档的当前版本，请使用KeyVault.getKey()指定返回文档的_id或KeyVault.getKeyByAltName()指定keyAltNames之一。

提示

KeyVault.createDataKey