db.createRole()

Definition定义

db.createRole(role, writeConcern)

Creates a role in a database. 在数据库中创建角色。You can specify privileges for the role by explicitly listing the privileges or by having the role inherit privileges from other roles or both. 您可以通过显式列出权限或让角色从其他角色继承权限或两者兼而有之来指定角色的权限。The role applies to the database on which you run the method.该角色适用于运行该方法的数据库。

The db.createRole() method accepts the following arguments:db.createRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
role	document	A document containing the name of the role and the role definition.包含角色名称和角色定义的文档。
writeConcern	document	Optional. 可选。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification.请参阅写入关注规范。

The role document has the following form:role文档的格式如下：

{
  role: "<name>",
  privileges: [
     { resource: { <resource> }, actions: [ "<action>", ... ] },
     ...
  ],
  roles: [
     { role: "<role>", db: "<database>" } | "<role>",
      ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ]
}

The role document has the following fields:role文档包含以下字段：

Field字段	Type类型	Description描述
role	string	The name of the new role.新角色的名称。
privileges	array	The privileges to grant the role. 授予角色的权限。A privilege consists of a resource and permitted actions. 权限由资源和允许的操作组成。For the syntax of a privilege, see the privileges array.有关权限的语法，请参阅privileges数组。 You must include the privileges field. 您必须包括privileges字段。Use an empty array to specify no privileges.使用空数组指定无权限。
roles	array	An array of roles from which this role inherits privileges.此角色从中继承权限的角色数组。 You must include the roles field. 必须包括roles字段。Use an empty array to specify no roles to inherit from.使用空数组指定不可继承的角色。
authenticationRestrictions	array	Optional.可选。 The authentication restrictions the server enforces on the role. 服务器对角色实施的身份验证限制。Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from.指定授予此角色的用户可以连接到和/或可以从中连接的IP地址和CIDR范围的列表。

The db.createRole() method wraps the createRole command.db.createRole()方法包装了createRole命令。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

Required Access所需访问权限

To create a role in a database, you must have:要在数据库中创建角色，您必须具备：

• the createRole action on that database resource.该数据库资源上的createRole操作。
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.对该数据库执行grantRole操作，以指定新角色的权限以及指定要从中继承的角色。

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestrictionaction on the database resource which the role is created.要创建指定了authenticationRestrictions的角色，必须对创建角色的数据库资源执行setAuthenticationRestriction操作。

Example示例

The following db.createRole() method creates the myClusterwideAdmin role on the admin database:以下db.createRole()方法在admin数据库上创建myClusterwideAdmin角色：

use admin
db.createRole(
   {
     role: "myClusterwideAdmin",
     privileges: [
       { resource: { cluster: true }, actions: [ "addShard" ] },
       { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
       { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
       { resource: { db: "", collection: "" }, actions: [ "find" ] }
     ],
     roles: [
       { role: "read", db: "admin" }
     ]
   },
   { w: "majority" , wtimeout: 5000 }
)