createRole

On this page本页内容

Definition定义

createRole

Creates a role and specifies its privileges. 创建角色并指定其权限。The role applies to the database on which you run the command. 该角色适用于运行该命令的数据库。The createRole command returns a duplicate role error if the role already exists in the database.如果角色已存在于数据库中，则createRole命令将返回重复的角色错误。

The createRole command uses the following syntax:createRole命令使用以下语法：

{ createRole: "<new role>",
  privileges: [
    { resource: { <resource> }, actions: [ "<action>", ... ] },
    ...
  ],
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ],
  writeConcern: <write concern document>,
  comment: <any>
}

The createRole command has the following fields:createRole命令包含以下字段：

Field字段Type类型Description描述
createRolestringThe name of the new role.新角色的名称。
privilegesarray

The privileges to grant the role. 授予角色的权限。A privilege consists of a resource and permitted actions. 权限由资源和允许的操作组成。For the syntax of a privilege, see the privileges array.有关权限的语法，请参阅privileges数组。

You must include the privileges field. 您必须包括privileges字段。Use an empty array to specify no privileges.使用空数组指定无权限。

rolesarray

An array of roles from which this role inherits privileges.此角色从中继承权限的角色数组。

You must include the roles field. 必须包括roles字段。Use an empty array to specify no roles to inherit from.使用空数组指定不可继承的角色。

authenticationRestrictionsarrayOptional.可选。 .. include:: /includes/fact-auth-restrictions-role-desc.rst
writeConcerndocument

Optional. 可选。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification.请参阅写入关注规范。

commentany

Optional. 可选。A user-provided comment to attach to this command. 用户提供了附加到此命令的注释。Once set, this comment appears alongside records of this command in the following locations:设置后，此注释将与此命令的记录一起显示在以下位置：

A comment can be any valid BSON type(string, integer, object, array, etc).注释可以是任何有效的BSON类型（字符串、整数、对象、数组等）。

New in version 4.4.在版本4.4中新增。

Roles角色

In the roles field, you can specify both built-in roles and user-defined roles.在roles字段中，可以指定内置角色和用户定义的角色。

To specify a role that exists in the same database where createRole runs, you can either specify the role with the name of the role:要指定存在于运行createRole的同一数据库中的角色，可以使用角色名称指定角色：

"readWrite"

Or you can specify the role with a document, as in:也可以使用文档指定角色，如：

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.要指定存在于其他数据库中的角色，请使用文档指定该角色。

Authentication Restrictions身份验证限制

The authenticationRestrictions document can contain only the following fields. authenticationRestrictions文档只能包含以下字段。The server throws an error if the authenticationRestrictions document contains an unrecognized field:如果authenticationRestrictions文档包含无法识别的字段，则服务器会引发错误：

Field Name字段名称Value值Description描述
clientSourceArray of IP addresses and/or CIDR rangesIP地址和/或CIDR范围数组If present, when authenticating a user, the server verifies that the client's IP address is either in the given list or belongs to a CIDR range in the list. 如果存在，则在对用户进行身份验证时，服务器会验证客户端的IP地址是否在给定列表中或是否属于列表中的CIDR范围。If the client's IP address is not present, the server does not authenticate the user.如果客户端的IP地址不存在，则服务器不会对用户进行身份验证。
serverAddressArray of IP addresses and/or CIDR rangesIP地址和/或CIDR范围数组A list of IP addresses or CIDR ranges to which the client can connect. 客户端可以连接到的IP地址或CIDR范围的列表。If present, the server will verify that the client's connection was accepted via an IP address in the given list. 如果存在，服务器将验证客户端的连接是否通过给定列表中的IP地址被接受。If the connection was accepted via an unrecognized IP address, the server does not authenticate the user.如果通过无法识别的IP地址接受连接，则服务器不会对用户进行身份验证。
Important重要

If a user inherits multiple roles with incompatible authentication restrictions, that user becomes unusable.如果用户继承了具有不兼容身份验证限制的多个角色，则该用户将不可用。

For example, if a user inherits one role in which the clientSource field is ["198.51.100.0"] and another role in which the clientSource field is ["203.0.113.0"] the server is unable to authenticate the user.例如，如果一个用户继承了clientSource字段为["198.51.100.0"]的一个角色和clientSource字段为["203.0.113.0"]的另一个角色，则服务器无法对该用户进行身份验证。

For more information on authentication in MongoDB, see Authentication.有关MongoDB中身份验证的更多信息，请参阅身份验证。

Behavior行为

A role's privileges apply to the database where the role is created. The role can inherit privileges from other roles in its database. 角色的权限适用于创建角色的数据库。该角色可以从其数据库中的其他角色继承权限。A role created on the admin database can include privileges that apply to all databases or to the cluster and can inherit privileges from roles in other databases.在admin数据库上创建的角色可以包括应用于所有数据库或集群的权限，并且可以从其他数据库中的角色继承权限。

Required Access所需访问权限

To create a role in a database, you must have:要在数据库中创建角色，您必须具备：

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestrictionaction on the database resource which the role is created.要创建指定了authenticationRestrictions的角色，必须对创建角色的数据库资源执行setAuthenticationRestriction操作。

Example示例

The following createRole command creates the myClusterwideAdmin role on the admin database:以下createRole命令在admin数据库上创建myClusterwideAdmin角色：

db.adminCommand({ createRole: "myClusterwideAdmin",
  privileges: [
    { resource: { cluster: true }, actions: [ "addShard" ] },
    { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
    { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
    { resource: { db: "", collection: "" }, actions: [ "find" ] }
  ],
  roles: [
    { role: "read", db: "admin" }
  ],
  writeConcern: { w: "majority" , wtimeout: 5000 }
})
←  Role Management CommandsdropRole →