db.createRole()¶

Definition定义¶

db.createRole(role, writeConcern)¶

Creates a role in a database. 在数据库中创建角色。You can specify privileges for the role by explicitly listing the privileges or by having the role inherit privileges from other roles or both. 您可以通过显式列出权限或让角色从其他角色继承权限或同时从其他角色继承权限来指定角色的权限。The role applies to the database on which you run the method.该角色应用于运行该方法的数据库。

The db.createRole() method accepts the following arguments:db.createRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
role	document	A document containing the name of the role and the role definition.包含角色名称和角色定义的文档。
writeConcern	document	Optional.可选。The level of write concern to apply to this operation. 要应用于此操作的写入关注级别。The writeConcern document uses the same fields as the getLastError command.writeConcern文档使用与getLastError命令相同的字段。

The role document has the following form:role文档的格式如下：

{
  role: "<name>",
  privileges: [
     { resource: { <resource> }, actions: [ "<action>", ... ] },
     ...
  ],
  roles: [
     { role: "<role>", db: "<database>" } | "<role>",
      ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ]
}

The role document has the following fields:role文档包含以下字段：

Field字段	Type类型	Description描述
role	string	The name of the new role.新角色的名称。
privileges	array	The privileges to grant the role. 授予角色的权限。A privilege consists of a resource and permitted actions. 权限由资源和允许的操作组成。For the syntax of a privilege, see the privileges array.有关权限的语法，请参阅privileges数组。 You must include the privileges field. 必须包括privileges字段。Use an empty array to specify no privileges.使用空数组不指定任何权限。
roles	array	An array of roles from which this role inherits privileges.此角色从中继承权限的角色数组。 You must include the roles field. 必须包括roles字段。Use an empty array to specify no roles to inherit from.使用空数组不指定要从中继承的角色。
authenticationRestrictions	array	Optional.可选。 The authentication restrictions the server enforces on the role. 服务器对角色实施的身份验证限制。Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from.指定授予此角色的用户可以连接和/或可以连接的IP地址和CIDR范围的列表。 New in version 3.6.版本3.6中的新功能。

The db.createRole() method wraps the createRole command.db.createRole()方法包装createRole命令。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为¶

Required Access所需访问权限¶

To create a role in a database, you must have:要在数据库中创建角色，您必须具有：

• the createRole action on that database resource.该数据库资源上的createRole操作。
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.对该数据库执行grantRole操作，以指定新角色的权限以及要从中继承的角色。

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.要创建指定了authenticationRestrictions的角色，必须对创建该角色的数据库资源执行setAuthenticationRestriction操作。

Example示例¶

The following db.createRole() method creates the myClusterwideAdmin role on the admin database:以下db.createRole()方法在admin数据库上创建myClusterwideAdmin角色：

use admin
db.createRole(
   {
     role: "myClusterwideAdmin",
     privileges: [
       { resource: { cluster: true }, actions: [ "addShard" ] },
       { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
       { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
       { resource: { db: "", collection: "" }, actions: [ "find" ] }
     ],
     roles: [
       { role: "read", db: "admin" }
     ]
   },
   { w: "majority" , wtimeout: 5000 }
)