db.createUser()¶

Definition定义¶

db.createUser(user, writeConcern)¶

Creates a new user for the database on which the method is run. 为运行该方法的数据库创建新用户。db.createUser() returns a duplicate user error if the user already exists on the database.如果数据库中已存在用户，则返回重复的用户错误。

The db.createUser() method has the following syntax:db.createUser()方法语法如下所示：

Field字段	Type类型	Description描述
user	document	The document with authentication and access information about the user to create.包含要创建的用户的身份验证和访问信息的文档。
writeConcern	document	Optional.可选。The level of write concern for the creation operation. 创建操作的写入关注级别。The writeConcern document takes the same fields as the getLastError command.writeConcern文档采用与getLastError命令相同的字段。

The user document defines the user and has the following form:user文档定义了用户，并具有以下形式：

Tip

Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. 从mongo shell的4.2版开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用，以提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。

{
  user: "<name>",
  pwd: passwordPrompt(),      // Or  "<cleartext password>"
  customData: { <any information> },
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
     {
       clientSource: ["<IP>" | "<CIDR range>", ...],
       serverAddress: ["<IP>" | "<CIDR range>", ...]
     },
     ...
  ],
  mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
  passwordDigestor: "<server|client>"
}

The user document has the following fields:user文档包含以下字段：

Field字段	Type类型	Description描述
user	string	The name of the new user.新用户的名称。
pwd	string	The user’s password. 用户的密码。The pwd field is not required if you run db.createUser() on the $external database to create users who have credentials stored externally to MongoDB.如果在$external数据库上运行db.createUser()，以创建具有存储在MongoDB外部的凭据的用户，则不需要pwd字段。 The value can be either:该值可以是： the user’s password in cleartext string, or明文字符串形式的用户密码，或 passwordPrompt() to prompt for the user’s password.以提示输入用户密码。 Tip Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. 从mongo shell的4.2版开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用，以提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。
customData	document	Optional.可选。Any arbitrary information. 任何武断的信息。This field can be used to store any data an admin wishes to associate with this particular user. 此字段可用于存储管理员希望与此特定用户关联的任何数据。For example, this could be the user’s full name or employee id.例如，这可能是用户的全名或员工id。
roles	array	The roles granted to the user. 授予用户的角色。Can specify an empty array [] to create users without roles.可以指定空数组[]来创建没有角色的用户。
authenticationRestrictions	array	Optional. 可选。The authentication restrictions the server enforces on the created user. 服务器对创建的用户实施的身份验证限制。Specifies a list of IP addresses and CIDR ranges from which the user is allowed to connect to the server or from which the server can accept users.指定允许用户连接到服务器或服务器可以接受用户的IP地址和CIDR范围的列表。 New in version 3.6.版本3.6中的新功能。
mechanisms	array	Optional.可选。Specify the specific SCRAM mechanism or mechanisms for creating SCRAM user credentials. 指定用于创建紧急停堆用户凭据的特定紧急停堆机制。If authenticationMechanisms is specified, you can only specify a subset of the authenticationMechanisms.如果指定了authenticationMechanisms，则只能指定authenticationMechanisms的子集。 Valid values are:有效值为： "SCRAM-SHA-1" Uses the SHA-1 hashing function.使用SHA-1哈希函数。 "SCRAM-SHA-256" Uses the SHA-256 hashing function.使用SHA-256哈希函数。 Requires featureCompatibilityVersion set to 4.0.需要将featureCompatibilityVersion设置为4.0。 Requires passwordDigestor to be server.需要将passwordDigestory设置为server。 The default for featureCompatibilityVersion is 4.0 is both SCRAM-SHA-1 and SCRAM-SHA-256.featureCompatibilityVersion的默认值为4.0，即SCRAM-SHA-1和SCRAM-SHA-256。 The default for featureCompatibilityVersion is 3.6 is SCRAM-SHA-1.featureCompatibilityVersion的默认值为3.6，即SCRAM-SHA-1。 New in version 4.0.版本4.0中的新功能。
passwordDigestor	string	Optional.可选。Indicates whether the server or the client digests the password.指示服务器或客户端是解析密码。 Available values are:可用值包括： "server" (Default) The server receives undigested password from the client and digests the password.服务器从客户端接收未消化的密码，并消化密码。 "client" (Not compatible with SCRAM-SHA-256) The client digests the password and passes the digested password to the server.客户端解析密码并将解析后的密码传递给服务器。 Changed in version 4.0.在版本4.0中更改。The default value is "server". 默认值为"server"。In earlier versions, the default value is "client".在早期版本中，默认值为"client"。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为¶

Required Access所需访问权限¶

• To create a new user in a database, you must have the createUser action on that database resource.要在数据库中创建新用户，必须对该数据库资源执行createUser操作。
• To grant roles to a user, you must have the grantRole action on the role’s database.要向用户授予角色，必须对角色的数据库执行grantRole操作。

The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.userAdmin和userAdminAnyDatabase内置角色在各自的资源上提供createUser和grantRole操作。

Examples示例¶

The following db.createUser() operation creates the accountAdmin01 user on the products database.以下db.createUser()操作在products数据库上创建accountAdmin01用户。

use products
db.createUser( { user: "accountAdmin01",
                 pwd: passwordPrompt(),  // Or  "<cleartext password>"
                 customData: { employeeId: 12345 },
                 roles: [ { role: "clusterAdmin", db: "admin" },
                          { role: "readAnyDatabase", db: "admin" },
                          "readWrite"] },
               { w: "majority" , wtimeout: 5000 } )

The operation gives accountAdmin01 the following roles:该操作赋予accountAdmin01以下角色：

• the clusterAdmin and readAnyDatabase roles on the admin database管理员数据库上的clusterAdmin和readAnyDatabase角色
• the readWrite role on the products databaseproducts数据库上的readWrite角色

use products
db.createUser(
   {
     user: "accountUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ "readWrite", "dbAdmin" ]
   }
)

use admin
db.createUser(
   {
     user: "reportsUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ ]
   }
)

use admin
db.createUser(
   {
     user: "appAdmin",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles:
       [
         { role: "readWrite", db: "config" },
         "clusterAdmin"
       ]
   }
)

use admin
db.createUser(
   {
     user: "restricted",
     pwd: passwordPrompt(),      // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     authenticationRestrictions: [ {
        clientSource: ["192.0.2.0"],
        serverAddress: ["198.51.100.0"]
     } ]
   }
)

use reporting
db.createUser(
   {
     user: "reportUser256",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     mechanisms: [ "SCRAM-SHA-256" ]
   }
)