On this page本页内容
createUser Creates a new user on the database where you run the command. 在运行命令的数据库上创建新用户。The 如果用户存在，createUser command returns a duplicate user error if the user exists. createUser命令将返回重复的用户错误。The createUser command uses the following syntax:createUser命令使用以下语法：
Starting in version 4.2 of the 从mongoshell的4.2版开始，您可以将mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用，以提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the 但是，您仍然可以像使用早期版本的mongo shell.mongoshell那样直接指定密码。
{
createUser: "<name>",
pwd: passwordPrompt(),
// Or "<cleartext password>"
customData: { <any information> },
roles: [
{ role: "<role>", db: "<database>" } | "<role>",
...
],
writeConcern: { <write concern> },
authenticationRestrictions: [
{ clientSource: [ "<IP|CIDR range>", ... ], serverAddress: [ "<IP|CIDR range>", ... ] },
...
],
mechanisms: [ "<scram-mechanism>", ... ], //Available starting in MongoDB 4.0
digestPassword: <boolean>,
comment: <any>
}
createUser has the following fields:具有以下字段：
createUser | string | |
pwd | string |
|
customData | document | |
roles | array | [] to create users without roles. []来创建没有角色的用户。 |
digestPassword | boolean |
true. true。false.false。
|
writeConcern | document |
|
authenticationRestrictions | array | |
mechanisms | array |
|
digestPassword | boolean |
true. true。false.false。
|
comment | any |
|
In the 在roles field, you can specify both built-in roles and user-defined roles.roles字段中，可以指定内置角色和用户定义角色。
To specify a role that exists in the same database where 要指定存在于运行createUser runs, you can either specify the role with the name of the role:createUser的同一数据库中的角色，可以使用角色名称指定角色：
"readWrite"
Or you can specify the role with a document, as in:也可以使用文档指定角色，如：
{ role: "<role>", db: "<database>" }
To specify a role that exists in a different database, specify the role with a document.若要指定存在于其他数据库中的角色，请使用文档指定该角色。
The authenticationRestrictions document can contain only the following fields. authenticationRestrictions文档只能包含以下字段。The server throws an error if the 如果authenticationRestrictions document contains an unrecognized field:authenticationRestrictions文档包含无法识别的字段，服务器将抛出错误：
| Field Name | ||
|---|---|---|
clientSource | Array of IP addresses and/or CIDR ranges | |
serverAddress | Array of IP addresses and/or CIDR ranges |
If a user inherits multiple roles with incompatible authentication restrictions, that user becomes unusable.如果用户继承了具有不兼容身份验证限制的多个角色，则该用户将无法使用。
For example, if a user inherits one role in which the 例如，如果用户继承了clientSource field is ["198.51.100.0"] and another role in which the clientSource field is ["203.0.113.0"] the server is unable to authenticate the user.clientSource字段为["198.51.100.0"]的一个角色和clientSource字段是["203.0.113.0"]的另一个角色，则服务器无法对用户进行身份验证。
For more information on authentication in MongoDB, see Authentication.有关MongoDB中身份验证的更多信息，请参阅身份验证。
Starting in version 4.0.9, MongoDB automatically assigns a unique 从4.0.9版开始，MongoDB在创建时自动为用户分配唯一的userId to the user upon creation.userId。
By default, 默认情况下，createUser sends all specified data to the MongoDB instance in cleartext, even if using passwordPrompt(). createUser将所有指定的数据以明文形式发送到MongoDB实例，即使使用passwordPrompt()也是如此。Use TLS transport encryption to protect communications between clients and the server, including the password sent by 使用TLS传输加密来保护客户端和服务器之间的通信，包括createUser. createUser发送的密码。For instructions on enabling TLS transport encryption, see Configure 有关启用TLS传输加密的说明，请参阅为TLS/SSL配置mongod and mongos for TLS/SSL.mongod和mongos。
MongoDB does not store the password in cleartext. MongoDB不以明文形式存储密码。The password is only vulnerable in transit between the client and the server, and only if TLS transport encryption is not enabled.只有在未启用TLS传输加密的情况下，密码才在客户端和服务器之间传输时易受攻击。
Users created on the 在$external database should have credentials stored externally to MongoDB, as, for example, with MongoDB Enterprise installations that use Kerberos.$external数据库上创建的用户应具有存储在MongoDB外部的凭据，例如，使用Kerberos的MongoDB Enterprise安装。
To use Client Sessions and Causal Consistency Guarantees with 要对$external authentication users (Kerberos, LDAP, or x.509 users), usernames cannot be greater than 10k bytes.$external身份验证用户（Kerberos、LDAP或x.509用户）使用客户端会话和因果一致性保证，用户名不能超过10k字节。
local DatabaseYou cannot create users on the local database.无法在本地数据库上创建用户。
createUser action on that database resource.createUser操作。grantRoleaction on the role's database.grantRole操作。The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.userAdmin和userAdminAnyDatabase内置角色在各自的资源上提供createUser和grantRole操作。
The following 下面的createUser command creates a user accountAdmin01 on the products database. createUser命令在产品数据库上创建一个用户accountAdmin01。The command gives 该命令赋予accountAdmin01 the clusterAdmin and readAnyDatabase roles on the admin database and the readWrite role on the products database:accountAdmin01 admin数据库上的clusterAdmin和readAnyDatabase角色以及products数据库上的readWrite角色：
Starting in version 4.2 of the 从mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. mongoshell的4.2版开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用，以提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the 但是，您仍然可以像使用早期版本的mongo shell.mongoshell那样直接指定密码。
db.getSiblingDB("products").runCommand( { createUser: "accountAdmin01", pwd: passwordPrompt(), customData: { employeeId: 12345 }, roles: [ { role: "clusterAdmin", db: "admin" }, { role: "readAnyDatabase", db: "admin" }, "readWrite" ], writeConcern: { w: "majority" , wtimeout: 5000 } } )