db.updateUser() (mongosh method方法)

Definition定义

db.updateUser( username, update, writeConcern )

Updates the user's profile on the database on which you run the method. An update to a field completely replaces the previous field's values. This includes updates to the user's roles array.更新运行该方法的数据库上的用户配置文件。字段的更新将完全替换前一个字段的值。这包括对用户roles数组的更新。

Warning

When you update the roles array, you completely replace the previous array's values. 更新roles数组时，将完全替换前一个数组的值。To add or remove roles without replacing all the user's existing roles, use the db.grantRolesToUser() or db.revokeRolesFromUser() methods.要添加或删除角色而不替换用户的所有现有角色，请使用db.grantRolesToUser()或db.revokeRolesFromUser()方法。

The db.updateUser() method uses the following syntax:db.updateUser()方法使用以下语法：

Tip

You can use the passwordPrompt() method in conjunction with various user authentication management methods and commands to prompt for the password instead of specifying the password directly in the method or command call. 您可以将passwordPrompt()方法与各种用户身份验证管理方法和命令结合使用，以提示输入密码，而不是直接在方法或命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。

db.updateUser(
   "<username>",
   {
     customData : { <any information> },
     roles : [
       { role: "<role>", db: "<database>" } | "<role>",
       ...
     ],
     pwd: passwordPrompt(),      // Or  "<cleartext password>"
     authenticationRestrictions: [
        {
          clientSource: ["<IP>" | "<CIDR range>", ...],
          serverAddress: ["<IP>", | "<CIDR range>", ...]
        },
        ...
     ],
     mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
     passwordDigestor: "<server|client>"
   },
   writeConcern: { <write concern> }
)

The db.updateUser() method has the following arguments.db.updateUser()方法有以下参数。

Parameter参数	Type类型	Description描述
username	string字符串	The name of the user to update.要更新的用户名。
update	document文档	A document containing the replacement data for the user. This data completely replaces the corresponding data for the user.包含用户替换数据的文档。此数据完全替换了用户的相应数据。
writeConcern	document文档	Optional. 可选。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification.请参阅写入关注规范。

The update document specifies the fields to update and their new values. All fields in the update document are optional, but must include at least one field.update文档指定了要更新的字段及其新值。update文档中的所有字段都是可选的，但必须至少包含一个字段。

The update document has the following fields:update文档包含以下字段：

Field字段	Type类型	Description描述
customData	document文档	Optional. 可选。Any arbitrary information.任何任意信息。
roles	array数组	Optional. 可选。The roles granted to the user. An update to the roles array overrides the previous array's values.授予用户的角色。对roles数组的更新会覆盖前一个数组的值。
pwd	string字符串	Optional. 可选。The user's password. The value can be either:用户的密码。该值可以是： the user's password in cleartext string, or明文字符串形式的用户密码，或 passwordPrompt() to prompt for the user's password.提示输入用户密码。 You can use the passwordPrompt() method in conjunction with various user authentication management methods and commands to prompt for the password instead of specifying the password directly in the method or command call. 您可以将passwordPrompt()方法与各种用户身份验证管理方法和命令结合使用，以提示输入密码，而不是直接在方法或命令调用中指定密码。However, you can still specify the password directly as you would with earlier versions of the mongo shell.但是，您仍然可以像使用早期版本的mongo shell一样直接指定密码。
authenticationRestrictions	array数组	Optional. 可选。The authentication restrictions the server enforces upon the user. Specifies a list of IP addresses and CIDR ranges from which the user is allowed to connect to the server or from which the server can accept users.服务器对用户实施的身份验证限制。指定允许用户连接到服务器或服务器可以接受用户的IP地址和CIDR范围的列表。
mechanisms	array数组	Optional. 可选。The specific SCRAM mechanism or mechanisms for the user credentials. 用户凭据的特定SCRAM机制。If authenticationMechanisms is specified, you can only specify a subset of the authenticationMechanisms.如果指定了authenticationMechanisms，则只能指定authenticationMechanisms的一个子集。 If updating the mechanisms field without the password, you can only specify a subset of the user's current mechanisms, and only the existing user credentials for the specified mechanism or mechanisms are retained.如果在不使用密码的情况下更新机制字段，则只能指定用户当前机制的子集，并且只保留指定机制的现有用户凭据。 If updating the password along with the mechanisms, new set of credentials are stored for the user.如果将密码与机制一起更新，则会为用户存储一组新的凭据。 Valid values are:有效值为： "SCRAM-SHA-1" Uses the SHA-1 hashing function.使用SHA-1哈希函数。 "SCRAM-SHA-256" Uses the SHA-256 hashing function.使用SHA-256哈希函数。 Requires featureCompatibilityVersion set to 4.0.需要将功能兼容性版本设置为4.0。 Requires passwordDigestor to be server.需要passwordDigestor作为server。
passwordDigestor	string字符串	Optional. 可选。Indicates whether the server or the client digests the password.指示是服务器还是客户端对密码进行摘要。 Available values are:可用值包括： "server" (Default) The server receives undigested password from the client and digests the password.服务器从客户端接收未消化的密码，并对密码进行摘要。 "client" (Not compatible with SCRAM-SHA-256)（与SCRAM-SHA-256不兼容） The client digests the password and passes the digested password to the server.客户端对密码进行摘要，并将摘要后的密码传递给服务器。

"readWrite"

{ role: "<role>", db: "<database>" }

Compatibility兼容性

This method is available in deployments hosted in the following environments:此方法在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Behavior行为

Required Access所需访问权限

You must have access that includes the revokeRole action on all databases in order to update a user's roles array.为了更新用户的roles数组，您必须对所有数据库具有包括revokeRole操作的访问权限。

You must have the grantRole action on a role's database to add a role to a user.您必须对角色的数据库执行grantRole操作，才能向用户添加角色。

To change another user's pwd or customData field, you must have the changePassword and changeCustomData actions respectively on that user's database.要更改其他用户的pwd或customData字段，您必须在该用户的数据库上分别执行changePassword和changeCustomData操作。

To modify your own password and custom data, you must have privileges that grant changeOwnPassword and changeOwnCustomData actions respectively on the user's database.要修改自己的密码和自定义数据，您必须具有在用户数据库上分别授予changeOwnPassword和changeOwnCustomData操作的权限。

Example示例

Given a user appClient01 in the products database with the following user info:给定products数据库中具有以下用户信息的用户appClient01：

{
   _id : "products.appClient01",
   userId : UUID("c5d88855-3f1e-46cb-9c8b-269bef957986"),
   user : "appClient01",
   db : "products",
   customData : { empID : "12345", badge : "9156" },
   roles : [
       {
         role : "readWrite",
         db : "products"
       },
       {
         role : "read",
         db : "inventory"
       }
   ],
   mechanisms : [
      "SCRAM-SHA-1",
      "SCRAM-SHA-256"
   ],
   authenticationRestrictions : [ {
      clientSource: ["69.89.31.226"],
      serverAddress: ["172.16.254.1"]
   } ]
}

The following db.updateUser() method completely replaces the user's customData and roles data:以下db.updateUser()方法完全替换了用户的customData和roles数据：

use products
db.updateUser( "appClient01",
{
   customData : { employeeId : "0x3039" },
   roles : [
      { role : "read", db : "assets"  }
   ]
} )

The user appClient01 in the products database now has the following user information:products数据库中的用户appClient01现在具有以下用户信息：

{
   _id : "products.appClient01",
   userId : UUID("c5d88855-3f1e-46cb-9c8b-269bef957986"),
   user : "appClient01",
   db : "products",
   customData : { employeeId : "0x3039" },
   roles : [
       {
         role : "read",
         db : "assets"
       }
   ],
   mechanisms : [
      "SCRAM-SHA-1",
      "SCRAM-SHA-256"
   ],
   authenticationRestrictions : [ {
      clientSource: ["69.89.31.226"],
      serverAddress: ["172.16.254.1"]
   } ]
}

use reporting
db.updateUser(
   "reportUser256",
   {
     mechanisms: [ "SCRAM-SHA-256" ]
   }
)