db.createUser()

Definition定义

db.createUser(user, writeConcern)

Creates a new user for the database on which the method is run. 为运行该方法的数据库创建一个新用户。db.createUser() returns a duplicate user error if the user already exists on the database.如果数据库中已经存在用户，则db.createUser()返回一个重复的用户错误。

Important

mongosh Method

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.

For the database command, see the createUser command.

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.

For the legacy mongo shell documentation, refer to the documentation for the corresponding MongoDB Server release:对于遗留的mongoshell文档，请参阅相应MongoDB Server版本的文档：

mongo shell v4.4

The db.createUser() method has the following syntax:db.createUser()方法具有以下语法：

Field字段	Type类型	Description描述
user	document	The document with authentication and access information about the user to create.具有要创建的用户的身份验证和访问信息的文档。
writeConcern	document	Optional.可选的。The level of write concern for the operation. See Write Concern Specification. 操作的写入关注级别。请参阅写入关注规范。

The user document defines the user and has the following form:user文档定义用户，并具有以下形式：

Tip

Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.从mongoshell的4.2版本开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用来提示输入密码，而不是直接在方法/命令调用中指定密码。但是，您仍然可以像使用早期版本的mongoshell一样直接指定密码。

{
  user: "<name>",
  pwd: passwordPrompt(),      // Or  "<cleartext password>"
  customData: { <any information> },
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
     {
       clientSource: ["<IP>" | "<CIDR range>", ...],
       serverAddress: ["<IP>" | "<CIDR range>", ...]
     },
     ...
  ],
  mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
  passwordDigestor: "<server|client>"
}

The user document has the following fields:user文档包含以下字段：

Field字段	Type类型	Description描述
user	string	The name of the new user.新用户的名称。
pwd	string	The user's password. 用户的密码。The pwd field is not required if you run db.createUser() on the $external database to create users who have credentials stored externally to MongoDB.如果您在$external数据库上运行db.createUser()来创建具有存储在MongoDB外部的凭据的用户，则不需要pwd字段。 The value can be either: 该值可以是： the user's password in cleartext string, or明文字符串中的用户密码，或 passwordPrompt() to prompt for the user's password.以提示输入用户的密码。 Tip Starting in version 4.2 of the mongo shell, you can use the passwordPrompt() method in conjunction with various user authentication/management methods/commands to prompt for the password instead of specifying the password directly in the method/command call. 从mongoshell的4.2版本开始，您可以将passwordPrompt()方法与各种用户身份验证/管理方法/命令结合使用来提示输入密码，而不是直接在方法/命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell. 但是，您仍然可以像使用早期版本的mongoshell一样直接指定密码。
customData	document	Optional.可选的。Any arbitrary information. This field can be used to store any data an admin wishes to associate with this particular user. 任何任意信息。该字段可用于存储管理员希望与该特定用户关联的任何数据。For example, this could be the user's full name or employee id.例如，这可能是用户的全名或员工id。
roles	array	The roles granted to the user. Can specify an empty array [] to create users without roles.授予用户的角色。可以指定一个空数组[]来创建没有角色的用户。
authenticationRestrictions	array	Optional.可选的。The authentication restrictions the server enforces on the created user. 服务器对创建的用户强制执行的身份验证限制。Specifies a list of IP addresses and CIDR ranges from which the user is allowed to connect to the server or from which the server can accept users. 指定允许用户连接到服务器或服务器可以接受用户的IP地址和CIDR范围的列表。
mechanisms	array	Optional.可选的。Specify the specific SCRAM mechanism or mechanisms for creating SCRAM user credentials. 指定用于创建SCRAM用户凭据的特定SCRAM机制。If authenticationMechanisms is specified, you can only specify a subset of the authenticationMechanisms.如果指定了authenticationMechanisms，则只能指定authenticationMechanisms的子集。 Valid values are: 有效值为： "SCRAM-SHA-1" Uses the SHA-1 hashing function.使用SHA-1哈希函数。 "SCRAM-SHA-256" Uses the SHA-256 hashing function.使用SHA-256哈希函数。 Requires passwordDigestor to be server.要求密码Digestor为server。 The default is both SCRAM-SHA-1 and SCRAM-SHA-256. 默认值为SCRAM-SHA-1和SCRAM-SHA-256。
passwordDigestor	string	Optional.可选的。Indicates whether the server or the client digests the password.指示服务器还是客户端对密码进行摘要处理。 Available values are: 可用值为： "server" (Default) The server receives undigested password from the client and digests the password.服务器从客户端接收未消化的密码，并对密码进行消化。 "client" (Not compatible with SCRAM-SHA-256) The client digests the password and passes the digested password to the server.客户端对密码进行摘要处理，并将摘要处理后的密码传递给服务器。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

Required Access所需访问权限

• To create a new user in a database, you must have the createUser action on that database resource.要在数据库中创建新用户，必须对该数据库资源执行createUser操作。
• To grant roles to a user, you must have the grantRole action on the role's database.要向用户授予角色，必须对角色的数据库执行grantRole操作。

The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.userAdmin和userAdminAnyDatabase内置角色在各自的资源上提供createUser和grantRole操作。

Examples实例

The following db.createUser() operation creates the accountAdmin01 user on the products database.以下db.createUser()操作在产品数据库上创建accountAdmin01用户。

use products
db.createUser( { user: "accountAdmin01",
                 pwd: passwordPrompt(),  // Or  "<cleartext password>"
                 customData: { employeeId: 12345 },
                 roles: [ { role: "clusterAdmin", db: "admin" },
                          { role: "readAnyDatabase", db: "admin" },
                          "readWrite"] },
               { w: "majority" , wtimeout: 5000 } )

The operation gives accountAdmin01 the following roles:该操作赋予accountAdmin01以下角色：

• the clusterAdmin and readAnyDatabase roles on the admin databaseadmin数据库上的clusterAdmin和readAnyDatabase角色
• the readWrite role on the products databaseproducts数据库上的readWrite角色

use products
db.createUser(
   {
     user: "accountUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ "readWrite", "dbAdmin" ]
   }
)

use admin
db.createUser(
   {
     user: "reportsUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ ]
   }
)

use admin
db.createUser(
   {
     user: "appAdmin",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles:
       [
         { role: "readWrite", db: "config" },
         "clusterAdmin"
       ]
   }
)

use admin
db.createUser(
   {
     user: "restricted",
     pwd: passwordPrompt(),      // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     authenticationRestrictions: [ {
        clientSource: ["192.0.2.0"],
        serverAddress: ["198.51.100.0"]
     } ]
   }
)

use reporting
db.createUser(
   {
     user: "reportUser256",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     mechanisms: [ "SCRAM-SHA-256" ]
   }
)