createRole (database command数据库命令)

Definition定义

createRole

Creates a role and specifies its privileges. The role applies to the database on which you run the command. The createRole command returns a duplicate role error if the role already exists in the database.创建角色并指定其权限。该角色适用于您运行命令的数据库。如果数据库中已存在该角色，createRole命令将返回重复角色错误。

Tip

In mongosh, this command can also be run through the db.createRole() helper method.在mongosh中，此命令也可以通过db.createRole()辅助方法运行。

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.助手方法对mongosh用户来说很方便，但它们可能不会返回与数据库命令相同级别的信息。如果不需要便利性或需要额外的返回字段，请使用database命令。

Compatibility兼容性

This command is available in deployments hosted in the following environments:此命令在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Syntax语法

The command has the following syntax:该命令具有以下语法：

db.adminCommand(
   {
     createRole: "<new role>",
     privileges: [
       { resource: { <resource> }, actions: [ "<action>", ... ] },
       ...
     ],
     roles: [
       { role: "<role>", db: "<database>" } | "<role>",
       ...
     ],
     authenticationRestrictions: [
       {
         clientSource: ["<IP>" | "<CIDR range>", ...],
         serverAddress: ["<IP>" | "<CIDR range>", ...]
       },
       ...
     ],
     writeConcern: <write concern document>,
     comment: <any>
   }
)

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

A role's privileges apply to the database where the role is created. The role can inherit privileges from other roles in its database. 角色的权限适用于创建该角色的数据库。该角色可以继承其数据库中其他角色的权限。A role created on the admin database can include privileges that apply to all databases or to the cluster and can inherit privileges from roles in other databases.在admin数据库上创建的角色可以包括应用于所有数据库或集群的权限，并且可以继承其他数据库中角色的权限。

Required Access所需访问权限

To create a role in a database, you must have:要在数据库中创建角色，您必须具备：

• the createRole action on that database resource.该数据库资源上的createRole操作。
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.该数据库上的grantRole操作，用于指定新角色的权限以及指定要继承的角色。

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.若要创建指定了authenticationRestrictions的角色，您必须对创建该角色的数据库资源执行setAuthenticationRestriction操作。

Example示例

The following createRole command creates the myClusterwideAdmin role on the admin database:以下createRole命令在管理数据库上创建myClusterwideAdmin角色：

db.adminCommand({ createRole: "myClusterwideAdmin",
  privileges: [
    { resource: { cluster: true }, actions: [ "addShard" ] },
    { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
    { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
    { resource: { db: "", collection: "" }, actions: [ "find" ] }
  ],
  roles: [
    { role: "read", db: "admin" }
  ],
  writeConcern: { w: "majority" , wtimeout: 5000 }
})