db.createRole() (mongosh method方法)

Definition定义

db.createRole(role, writeConcern)

Creates a role in a database. You can specify privileges for the role by explicitly listing the privileges or by having the role inherit privileges from other roles or both. The role applies to the database on which you run the method.在数据库中创建角色。您可以通过显式列出权限或让角色继承其他角色的权限或两者兼而有之来指定角色的权限。该角色适用于您运行该方法的数据库。

Important

mongosh Method方法

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.本页记录了一种mongosh方法。这不是数据库命令或特定语言驱动程序（如Node.js）的文档。

For the database command, see the createRole command.关于数据库命令，请参阅createRole命令。

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.有关MongoDB API驱动程序，请参阅特定语言的MongoDB驱动程序文档。

The db.createRole() method accepts the following arguments:db.createRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
role	document文档	A document containing the name of the role and the role definition.包含角色名称和角色定义的文档。
writeConcern	document文档	Optional. 可选。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification.请参阅写入关注规范。

The role document has the following form:role文档的格式如下：

{
  role: "<name>",
  privileges: [
     { resource: { <resource> }, actions: [ "<action>", ... ] },
     ...
  ],
  roles: [
     { role: "<role>", db: "<database>" } | "<role>",
      ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ]
}

The role document has the following fields:role文档包含以下字段：

Field字段	Type类型	Description描述
role	string字符串	The name of the new role.新角色的名称。
privileges	array数组	The privileges to grant the role. A privilege consists of a resource and permitted actions. 授予角色的权限。权限由资源和允许的操作组成。For the syntax of a privilege, see the privileges array.有关权限的语法，请参阅privileges数组。 You must include the privileges field. Use an empty array to specify no privileges.您必须包含privileges字段。使用空数组指定无权限。
roles	array数组	An array of roles from which this role inherits privileges.此角色继承权限的角色数组。 You must include the roles field. Use an empty array to specify no roles to inherit from.您必须包含roles字段。使用空数组不指定要继承的角色。
authenticationRestrictions	array数组	Optional.可选。 The authentication restrictions the server enforces on the role. Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from.服务器对角色实施的身份验证限制。指定允许授予此角色的用户连接和/或可以从中连接的IP地址和CIDR范围的列表。

"readWrite"

{ role: "<role>", db: "<database>" }

Compatibility兼容性

This method is available in deployments hosted in the following environments:此方法在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Behavior行为

privileges: [
     {
     resource: { db: 'products', collection: 'coll1' },
     actions: [ 'bypassDocumentValidation' ]
     },
     {
     resource: { db: 'products', collection: 'coll2' },
     actions: [ 'bypassDocumentValidation' ]
     }
]

privileges: [
     {
     resource: { db: 'products', collection: '' },
     actions: [ 'bypassDocumentValidation' ]
     }
]

Required Access所需访问权限

To create a role in a database, you must have:要在数据库中创建角色，您必须具备：

• the createRole action on that database resource.
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.该数据库上的grantRole操作，用于指定新角色的权限以及指定要继承的角色。

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.

Example示例

The following db.createRole() method creates the myClusterwideAdmin role on the admin database:以下db.createRole()方法在admin数据库上创建myClusterwideAdmin角色：

use admin
db.createRole(
   {
     role: "myClusterwideAdmin",
     privileges: [
       { resource: { cluster: true }, actions: [ "addShard" ] },
       { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
       { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
       { resource: { db: "", collection: "" }, actions: [ "find" ] }
     ],
     roles: [
       { role: "read", db: "admin" }
     ]
   },
   { w: "majority" , wtimeout: 5000 }
)