db.createUser() (mongosh method方法)

Definition定义

db.createUser(user, writeConcern)

Creates a new user for the database on which the method is run. db.createUser() returns a duplicate user error if the user already exists on the database.为运行该方法的数据库创建新用户。如果数据库中已经存在该用户，db.createUser()将返回重复用户错误。

Important

mongosh Method方法

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.本页记录了一种mongosh方法。这不是数据库命令或特定语言驱动程序（如Node.js）的文档。

For the database command, see the createUser command.关于数据库命令，请参阅createUser命令。

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.有关MongoDB API驱动程序，请参阅特定语言的MongoDB驱动程序文档。

The db.createUser() method has the following syntax:db.createUser()方法具有以下语法：

Field字段	Type类型	Description描述
user	document文档	The document with authentication and access information about the user to create.要创建的包含用户身份验证和访问信息的文档。
writeConcern	document文档	Optional. 可选。The level of write concern for the operation. See Write Concern Specification.操作的写入关注级别。请参阅写入关注规范。

The user document defines the user and has the following form:user文档定义了用户，并具有以下形式：

Tip

You can use the passwordPrompt() method in conjunction with various user authentication management methods and commands to prompt for the password instead of specifying the password directly in the method or command call. 您可以将passwordPrompt()方法与各种用户身份验证管理方法和命令结合使用，以提示输入密码，而不是直接在方法或命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。

{
  user: "<name>",
  pwd: passwordPrompt(),      // Or  "<cleartext password>"
  customData: { <any information> },
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
     {
       clientSource: ["<IP>" | "<CIDR range>", ...],
       serverAddress: ["<IP>" | "<CIDR range>", ...]
     },
     ...
  ],
  mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
  passwordDigestor: "<server|client>"
}

The user document has the following fields:user文档包含以下字段：

Field字段	Type类型	Description描述
user	string字符串	The name of the new user.新用户的名称。
pwd	string字符串	The user's password. The pwd field is not required if you run db.createUser() on the $external database to create users who have credentials stored externally to MongoDB.用户的密码。如果在$external数据库上运行db.createUser()以创建具有存储在MongoDB外部的凭据的用户，则不需要pwd字段。 The value can be either:该值可以是： the user's password in cleartext string, or明文字符串形式的用户密码，或 passwordPrompt() to prompt for the user's password.提示输入用户密码。 You can use the passwordPrompt() method in conjunction with various user authentication management methods and commands to prompt for the password instead of specifying the password directly in the method or command call. However, you can still specify the password directly as you would with earlier versions of the mongo shell.您可以将passwordPrompt()方法与各种用户身份验证管理方法和命令结合使用，以提示输入密码，而不是直接在方法或命令调用中指定密码。但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。
customData	document文档	Optional. 可选。Any arbitrary information. This field can be used to store any data an admin wishes to associate with this particular user. For example, this could be the user's full name or employee id.任何任意信息。此字段可用于存储管理员希望与此特定用户关联的任何数据。例如，这可能是用户的全名或员工id。
roles	array数组	The roles granted to the user. Can specify an empty array [] to create users without roles.授予用户的角色。可以指定一个空数组[]来创建没有角色的用户。
authenticationRestrictions	array数组	Optional. 可选。The authentication restrictions the server enforces on the created user. Specifies a list of IP addresses and CIDR ranges from which the user is allowed to connect to the server or from which the server can accept users.服务器对创建的用户实施的身份验证限制。指定允许用户连接到服务器或服务器可以接受用户的IP地址和CIDR范围的列表。
mechanisms	array数组	Optional. 可选。Specify the specific SCRAM mechanism or mechanisms for creating SCRAM user credentials. 指定创建SCRAM用户凭据的特定SCRAM机制。If authenticationMechanisms is specified, you can only specify a subset of the authenticationMechanisms.如果指定了authenticationMechanisms，则只能指定authenticationMechanisms的一个子集。 Valid values are:有效值为： "SCRAM-SHA-1" Uses the SHA-1 hashing function.使用SHA-1哈希函数。 "SCRAM-SHA-256" Uses the SHA-256 hashing function.使用SHA-256哈希函数。 Requires passwordDigestor to be server.需要passwordDigestor作为server。 The default is both SCRAM-SHA-1 and SCRAM-SHA-256.默认值为SCRAM-SHA-1和SCRAM-SHA-256。
passwordDigestor	string字符串	Optional. 可选。Indicates whether the server or the client digests the password.指示是服务器还是客户端对密码进行摘要。 Available values are:可用值包括： "server" (Default)（默认） The server receives undigested password from the client and digests the password.服务器从客户端接收未消化的密码，并对密码进行摘要。 "client" (Not compatible with SCRAM-SHA-256)（与SCRAM-SHA-256不兼容） The client digests the password and passes the digested password to the server.客户端对密码进行摘要，并将摘要后的密码传递给服务器。

Compatibility兼容性

This method is available in deployments hosted in the following environments:此方法在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

Required Access所需访问权限

• To create a new user in a database, you must have the createUser action on that database resource.要在数据库中创建新用户，您必须对该数据库资源执行createUser操作。
• To grant roles to a user, you must have the grantRole action on the role's database.若要向用户授予角色，您必须对角色的数据库执行grantRole操作。

The userAdmin and userAdminAnyDatabase built-in roles provide createUser and grantRole actions on their respective resources.userAdmin和userAdminAnyDatabase内置角色在各自的资源上提供createUser和grantRole操作。

Examples示例

The following db.createUser() operation creates the accountAdmin01 user on the products database.以下db.createUser()操作在products数据库上创建accountAdmin01用户。

use products
db.createUser( { user: "accountAdmin01",
                 pwd: passwordPrompt(),  // Or  "<cleartext password>"
                 customData: { employeeId: 12345 },
                 roles: [ { role: "clusterAdmin", db: "admin" },
                          { role: "readAnyDatabase", db: "admin" },
                          "readWrite"] },
               { w: "majority" , wtimeout: 5000 } )

The operation gives accountAdmin01 the following roles:该操作赋予accountAdmin01以下角色：

• the clusterAdmin and readAnyDatabase roles on the admin database管理员数据库上的clusterAdmin和readAnyDatabase角色
• the readWrite role on the products databaseproducts数据库上的readWrite角色

use products
db.createUser(
   {
     user: "accountUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ "readWrite", "dbAdmin" ]
   }
)

use admin
db.createUser(
   {
     user: "reportsUser",
     pwd: passwordPrompt(),  // Or  "<cleartext password>"
     roles: [ ]
   }
)

use admin
db.createUser(
   {
     user: "appAdmin",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles:
       [
         { role: "readWrite", db: "config" },
         "clusterAdmin"
       ]
   }
)

use admin
db.createUser(
   {
     user: "restricted",
     pwd: passwordPrompt(),      // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     authenticationRestrictions: [ {
        clientSource: ["192.0.2.0"],
        serverAddress: ["198.51.100.0"]
     } ]
   }
)

use reporting
db.createUser(
   {
     user: "reportUser256",
     pwd: passwordPrompt(),   // Or  "<cleartext password>"
     roles: [ { role: "readWrite", db: "reporting" } ],
     mechanisms: [ "SCRAM-SHA-256" ]
   }
)