db.createRole()

Definition定义

db.createRole(role, writeConcern)

Creates a role in a database. You can specify privileges for the role by explicitly listing the privileges or by having the role inherit privileges from other roles or both. The role applies to the database on which you run the method.在数据库中创建角色。您可以通过显式列出权限或让角色继承其他角色的权限或同时继承这两种权限来指定角色的权限。该角色应用于运行该方法的数据库。

Important

mongosh Method

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.

For the database command, see the createRole command.

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.

For the legacy mongo shell documentation, refer to the documentation for the corresponding MongoDB Server release:

mongo shell v4.4

The db.createRole() method accepts the following arguments:db.createRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
role	document	A document containing the name of the role and the role definition.包含角色名称和角色定义的文档。
writeConcern	document	Optional.可选的。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification. 请参阅写入关注规范。

The role document has the following form:role文档具有以下形式：

{
  role: "<name>",
  privileges: [
     { resource: { <resource> }, actions: [ "<action>", ... ] },
     ...
  ],
  roles: [
     { role: "<role>", db: "<database>" } | "<role>",
      ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ]
}

The role document has the following fields:role文档包含以下字段：

Field字段	Type类型	Description描述
role	string	The name of the new role.新角色的名称。
privileges	array	The privileges to grant the role. 授予角色的权限。A privilege consists of a resource and permitted actions. 权限由资源和允许的操作组成。For the syntax of a privilege, see the privileges array.有关权限的语法，请参阅privileges数组。 You must include the privileges field. Use an empty array to specify no privileges. 您必须包括privileges字段。使用空数组可以不指定权限。
roles	array	An array of roles from which this role inherits privileges.此角色从中继承权限的角色数组。 You must include the roles field. Use an empty array to specify no roles to inherit from. 您必须包括roles字段。使用空数组可以不指定要继承的角色。
authenticationRestrictions	array	Optional.可选的。 The authentication restrictions the server enforces on the role. 服务器对角色强制执行的身份验证限制。Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from. 指定允许授予此角色的用户连接到和/或可以从中连接的IP地址和CIDR范围的列表。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

Required Access所需访问权限

To create a role in a database, you must have:若要在数据库中创建角色，您必须具有：

• the createRole action on that database resource.该数据库资源上的createRole 操作。
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.该数据库上的grantRole 操作，用于指定新角色的权限以及指定要继承的角色。

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.若要创建指定了authenticationRestrictions的角色，必须对创建该角色的数据库资源执行setAuthenticationRestriction 操作。

Example实例

The following db.createRole() method creates the myClusterwideAdmin role on the admin database:以下db.createRole()方法在admin数据库上创建myClusterwideAdmin角色：

use admin
db.createRole(
   {
     role: "myClusterwideAdmin",
     privileges: [
       { resource: { cluster: true }, actions: [ "addShard" ] },
       { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
       { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
       { resource: { db: "", collection: "" }, actions: [ "find" ] }
     ],
     roles: [
       { role: "read", db: "admin" }
     ]
   },
   { w: "majority" , wtimeout: 5000 }
)