Role-Based Access Control基于角色的访问控制

Access通道

Roles never limit privileges. 角色从不限制权限。If a user has two roles, the role with the greater access takes precedence.若一个用户有两个角色，那个么具有较大访问权限的角色优先。

For example, if you grant the read role on a database to a user that already has the readWriteAnyDatabase role, the read grant does not revoke write access on the database.例如，如果将数据库上的read角色授予已具有readWriteAnyDatabase角色的用户，则read授予不会撤消对该数据库的写入访问权限。

To revoke a role from a user, use the revokeRolesFromUser command.要撤消用户的角色，请使用revokeRolesFromUser命令。

Authentication Restrictions身份验证限制

Roles can impose authentication restrictions on users, requiring them to connect from specified source and destination IP address ranges.角色可以对用户施加身份验证限制，要求他们从指定的源和目标IP地址范围进行连接。

For more information, see Authentication Restrictions.有关详细信息，请参阅身份验证限制。

Privileges权限

A privilege consists of a specified resource and the actions permitted on the resource.权限由指定的资源和对该资源允许的操作组成。

A resource is a database, collection, set of collections, or the cluster. 资源是数据库、集合、集合集或集群。If the resource is the cluster, the affiliated actions affect the state of the system rather than a specific database or collection. 如果资源是集群，则附属操作会影响系统的状态，而不是特定的数据库或集合。For information on the resource documents, see Resource Document.有关资源文档的信息，请参阅资源文档。

An action specifies the operation allowed on the resource. 操作指定对资源允许的操作。For available actions see Privilege Actions.有关可用操作，请参阅权限操作。

Inherited Privileges继承的权限

A role can include one or more existing roles in its definition, in which case the role inherits all the privileges of the included roles.一个角色可以在其定义中包含一个或多个现有角色，在这种情况下，该角色将继承所包含角色的所有权限。

A role can inherit privileges from other roles in its database. 角色可以从其数据库中的其他角色继承权限。A role created on the admin database can inherit privileges from roles in any database.在管理数据库上创建的角色可以从任何数据库中的角色继承权限。

View Role's Privileges查看角色的权限

You can view the privileges for a role by issuing the rolesInfo command with the showPrivileges and showBuiltinRoles fields both set to true.您可以通过在showPrivileges和showBuiltinRoles字段均设置为true的情况下发出rolesInfo命令来查看角色的权限。