On this page本页内容
db.createUser(user, writeConcern)
Creates a new user for the database on which the method is run. 为运行该方法的数据库创建新用户。db.createUser() returns a duplicate user error if the user already exists on the database.db.createUser()返回重复用户错误。
The db.createUser() method has the following syntax:db.createUser()方法具有以下语法：
user | document | |
writeConcern | document |
|
The user document defines the user and has the following form:user文档定义用户并具有以下形式：
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
{
user: "<name>",
pwd: passwordPrompt(),
// Or "<cleartext password>"
customData: { <any information> },
roles: [
{ role: "<role>", db: "<database>" } | "<role>",
...
],
authenticationRestrictions: [
{
clientSource: ["<IP>" | "<CIDR range>", ...],
serverAddress: ["<IP>" | "<CIDR range>", ...]
},
...
],
mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
passwordDigestor: "<server|client>"
}
The user document has the following fields:user文档包含以下字段：
user | string | The name of the new user. |
pwd | string | The user's password. The
Starting in version 4.2 of the |
customData | document | |
roles | array | [] to create users without roles.[]来创建没有角色的用户。
|
| authenticationRestrictions | array |
|
mechanisms | array |
Valid values are:
|
passwordDigestor | string |
"server". "server"。"client"."client"。
|
In the 在roles field, you can specify both built-in roles and user-defined roles.roles字段中，可以指定内置角色和用户定义的角色。
To specify a role that exists in the same database where 要指定存在于运行db.createUser() runs, you can either specify the role with the name of the role:db.createUser()的同一数据库中的角色，可以使用角色名称指定该角色：
"readWrite"
Or you can specify the role with a document, as in:也可以使用文档指定角色，如：
{ role: "<role>", db: "<database>" }
To specify a role that exists in a different database, specify the role with a document.要指定存在于其他数据库中的角色，请使用文档指定该角色。
The authenticationRestrictions document can contain only the following fields. authenticationRestrictions文档只能包含以下字段。The server throws an error if the 如果authenticationRestrictions document contains an unrecognized field:authenticationRestrictions文档包含无法识别的字段，则服务器会引发错误：
clientSource | ||
serverAddress |
If a user inherits multiple roles with incompatible authentication restrictions, that user becomes unusable.如果用户继承了具有不兼容身份验证限制的多个角色，则该用户将不可用。
For example, if a user inherits one role in which the 例如，如果一个用户继承了clientSource field is ["198.51.100.0"] and another role in which the clientSource field is ["203.0.113.0"] the server is unable to authenticate the user.clientSource字段为["198.51.100.0"]的一个角色和clientSource字段为["203.0.113.0"]的另一个角色，则服务器无法对该用户进行身份验证。
For more information on authentication in MongoDB, see Authentication.有关MongoDB中身份验证的更多信息，请参阅身份验证。
The db.createUser() method wraps the createUser command.db.createUser()方法包装createUser命令。
Starting in version 4.0.9, MongoDB automatically assigns a unique 从4.0.9版开始，MongoDB在创建时自动为用户分配唯一的userId to the user upon creation.userId。
If run on a replica set, 如果在副本集上运行，默认情况下，db.createUser() is executed using "majority" write concern by default.db.createUser()使用"majority"写入关注点执行。
By default, 默认情况下，db.createUser() sends all specified data to the MongoDB instance in cleartext, even if using passwordPrompt(). db.createUser()将所有指定的数据以明文形式发送到MongoDB实例，即使使用passwordPrompt()。Use TLS transport encryption to protect communications between clients and the server, including the password sent by 使用TLS传输加密来保护客户端和服务器之间的通信，包括db.createUser(). db.createUser()发送的密码。For instructions on enabling TLS transport encryption, see Configure 有关启用TLS传输加密的说明，请参阅为TLS/SSL配置mongod and mongos for TLS/SSL.mongod和mongos。
MongoDB does not store the password in cleartext. MongoDB不以明文形式存储密码。The password is only vulnerable in transit between the client and the server, and only if TLS transport encryption is not enabled.只有在客户端和服务器之间的传输过程中，并且只有在未启用TLS传输加密时，密码才会受到攻击。
Users created on the 在$external database should have credentials stored externally to MongoDB, as, for example, with MongoDB Enterprise installations that use Kerberos.$external数据库上创建的用户应该具有存储在MongoDB外部的凭据，例如使用Kerberos的MongoDB Enterprise安装。
To use Client Sessions and Causal Consistency Guarantees with 要对$external authentication users (Kerberos, LDAP, or x.509 users), usernames cannot be greater than 10k bytes.$external身份验证用户（Kerberos、LDAP或x.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。
localYou cannot create users on the local database.无法在本地数据库上创建用户。
createUser action on that database resource.createUser操作。grantRoleaction on the role's database.grantRole操作。The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.userAdmin和userAdminAnyDatabase内置角色在各自的资源上提供createUser和grantRole操作。
The following 以下db.createUser() operation creates the accountAdmin01 user on the products database.db.createUser()操作在products数据库上创建accountAdmin01用户。
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
use products
db.createUser( { user: "accountAdmin01",
pwd: passwordPrompt(), // Or "<cleartext password>"
customData: { employeeId: 12345 },
roles: [ { role: "clusterAdmin", db: "admin" },
{ role: "readAnyDatabase", db: "admin" },
"readWrite"] },
{ w: "majority" , wtimeout: 5000 } )
The operation gives 该操作赋予accountAdmin01 the following roles:accountAdmin01以下角色：
clusterAdmin and readAnyDatabase roles on the admin databaseclusterAdmin和readAnyDatabase角色readWrite role on the products databaseproducts数据库上的readWrite角色The following operation creates 以下操作在产品数据库中创建accountUser in the products database and gives the user the readWrite and dbAdmin roles.accountUser，并为用户提供readWrite和dbAdmin角色。
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
use products
db.createUser(
{
user: "accountUser",
pwd: passwordPrompt(), // Or "<cleartext password>"
roles: [ "readWrite", "dbAdmin" ]
}
)
The following operation creates a user named 以下操作在reportsUser in the admin database but does not yet assign roles:admin数据库中创建名为reportsUser的用户，但尚未分配角色：
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
use admin
db.createUser(
{
user: "reportsUser",
pwd: passwordPrompt(), // Or "<cleartext password>"
roles: [ ]
}
)
The following operation creates a user named 以下操作在appAdmin in the admin database and gives the user readWrite access to the config database, which lets the user change certain settings for sharded clusters, such as to the balancer setting.admin数据库中创建一个名为appAdmin的用户，并向用户提供对配置数据库的readWrite访问权限，这允许用户更改分片集群的某些设置，例如均衡器设置。
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
use admin
db.createUser(
{
user: "appAdmin",
pwd: passwordPrompt(), // Or "<cleartext password>"
roles:
[
{ role: "readWrite", db: "config" },
"clusterAdmin"
]
}
)
The following operation creates a user named 以下操作将在restricted in the admin database. admin数据库中创建名为restricted的用户。This user may only authenticate if connecting from IP address 此用户只能在从IP地址192.0.2.0 to IP address 198.51.100.0.192.0.2.0连接到IP地址198.51.100.0时进行身份验证。
Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.
use admin
db.createUser(
{
user: "restricted",
pwd: passwordPrompt(),
// Or "<cleartext password>"
roles: [ { role: "readWrite", db: "reporting" } ],
authenticationRestrictions: [ {
clientSource: ["192.0.2.0"],
serverAddress: ["198.51.100.0"]
} ]
}
)
SCRAM-SHA-256 Credentials OnlySCRAM-SHA-256凭据创建用户To use SCRAM-SHA-256, the 要使用SCRAM-SHA-256，featureCompatibilityVersion must be set to 4.0. featureCompatibilityVersion必须设置为4.0。For more information on featureCompatibilityVersion, see View FeatureCompatibilityVersion and 有关setFeatureCompatibilityVersion.featureCompatibilityVersion的更多信息，请参阅查看FeatureCompaatibilityversion和setFeatureCompatibilityVersion版本。
The following operation creates a user with only 以下操作将创建仅具有SCRAM-SHA-256 credentials.SCRAM-SHA-256凭据的用户。
Starting in version 4.2 of the 从mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. mongoshell的4.2版开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用，提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the 但是，您仍然可以像使用早期版本的mongo shell.mongoshell那样直接指定密码。
use reporting
db.createUser(
{
user: "reportUser256",
pwd: passwordPrompt(), // Or "<cleartext password>"
roles: [ { role: "readWrite", db: "reporting" } ],
mechanisms: [ "SCRAM-SHA-256" ]
}
)
If the 如果设置了authenticationMechanisms parameter is set, the mechanisms field can only include values specified in the authenticationMechanisms parameter.authenticationMechanisms参数，则mechanises字段只能包含authenticationMechanisms参数中指定的值。