Database Manual / Self-Managed Deployments / Security / Reference

system.roles Collection in Self-Managed Deployments自我管理部署中的system.roles集合

The system.roles collection in the admin database stores the user-defined roles. To create and manage these user-defined roles, MongoDB provides role management commands.admin数据库中的system.roles集合存储用户定义的角色。为了创建和管理这些用户定义的角色，MongoDB提供了角色管理命令。

system.roles Schema模式

The documents in the system.roles collection have the following schema:system.roles集合中的文档具有以下架构：

{
  _id: <system-defined id>,
  role: "<role name>",
  db: "<database>",
  privileges:
      [
          {
              resource: { <resource> },
              actions: [ "<action>", ... ]
          },
          ...
      ],
  roles:
      [
          { role: "<role name>", db: "<database>" },
          ...
      ]
}

A system.roles document has the following fields:system.roles文档包含以下字段：

admin.system.roles.role
The role field is a string that specifies the name of the role.role字段是一个指定角色名称的字符串。
admin.system.roles.db
The db field is a string that specifies the database to which the role belongs. db字段是一个字符串，指定角色所属的数据库。MongoDB uniquely identifies each role by the pairing of its name (i.e. role) and its database.MongoDB通过其名称（即role）和数据库的配对来唯一标识每个角色。
admin.system.roles.privileges

The privileges array contains the privilege documents that define the privileges for the role.privileges数组包含定义角色权限的权限文档。

A privilege document has the following syntax:权限文档具有以下语法：

{
  resource: { <resource> },
  actions: [ "<action>", ... ]
}

Each privilege document has the following fields:每个权限文档都有以下字段：

admin.system.roles.privileges[n].resource

A document that specifies the resources upon which the privilege actions apply. The document has one of the following form:指定权限actions所应用的资源的文档。该文件具有以下形式之一：

{ db: <database>, collection: <collection> }

or或

{ cluster : true }

See Resource Document on Self-Managed Deployments for more details.有关更多详细信息，请参阅关于自我管理部署的资源文档。

admin.system.roles.privileges[n].actions
An array of actions permitted on the resource. For a list of actions, see Privilege Actions.资源上允许的一系列操作。有关操作列表，请参阅权限操作。
admin.system.roles.roles

The roles array contains role documents that specify the roles from which this role inherits privileges.roles数组包含角色文档，这些文档指定了此角色继承权限的角色。

A role document has the following syntax:角色文档具有以下语法：

{ role: "<role name>", db: "<database>" }

A role document has the following fields:角色文档包含以下字段：

admin.system.roles.roles[n].role
The name of the role. A role can be a built-in role provided by MongoDB or a user-defined role.角色的名称。角色可以是MongoDB提供的内置角色，也可以是用户定义的角色。
admin.system.roles.roles[n].db
The name of the database where the role is defined.定义角色的数据库的名称。

Examples示例

Consider the following sample documents found in system.roles collection of the admin database.考虑在admin数据库的system.roles集合中找到的以下示例文档。

A User-Defined Role Specifies Privileges用户定义的角色指定权限

The following is a sample document for a user-defined role appUser defined for the myApp database:以下是为myApp数据库定义的用户定义角色appUser的示例文档：

{
  _id: "myApp.appUser",
  role: "appUser",
  db: "myApp",
  privileges: [
       { resource: { db: "myApp" , collection: "" },
         actions: [ "find", "createCollection", "dbStats", "collStats" ] },
       { resource: { db: "myApp", collection: "logs" },
         actions: [ "insert" ] },
       { resource: { db: "myApp", collection: "data" },
         actions: [ "insert", "update", "remove", "compact" ] },
       { resource: { db: "myApp", collection: "system.js" },
         actions: [ "find" ] },
  ],
  roles: []
}

The privileges array lists the five privileges that the appUser role specifies:privileges数组列出了appUser角色指定的五个权限：

  • The first privilege permits its actions ( "find", "createCollection", "dbStats", "collStats") on all the collections in the myApp database excluding its system collections. 第一个权限允许它对myApp数据库中的所有集合（不包括其系统集合）执行操作（"find"、"createCollection"、"dbStats"、"collStats"）。See Specify a Database as Resource.请参见将数据库指定为资源。
  • The next two privileges permits additional actions on specific collections, logs and data, in the myApp database. 接下来的两个权限允许对myApp数据库中的特定集合、logs和data执行其他操作。See Specify a Collection of a Database as Resource.请参见将数据库集合指定为资源。
  • The last privilege permits actions on one system collections in the myApp database. 最后一个权限允许对myApp数据库中的一个系统集合执行操作。While the first privilege gives database-wide permission for the find action, the action does not apply to myApp's system collections. 虽然第一个权限为find操作提供了数据库范围内的权限，但该操作不适用于myApp的系统集合。To give access to a system collection, a privilege must explicitly specify the collection. See Resource Document on Self-Managed Deployments.要授予对系统集合的访问权限，必须明确指定该集合的权限。请参阅关于自我管理部署的资源文档。

As indicated by the empty roles array, appUser inherits no additional privileges from other roles.如空roles数组所示，appUser不继承其他角色的额外权限。

User-Defined Role Inherits from Other Roles用户定义的角色继承自其他角色

The following is a sample document for a user-defined role appAdmin defined for the myApp database: The document shows that the appAdmin role specifies privileges as well as inherits privileges from other roles:以下是为myApp数据库定义的用户定义角色appAdmin的示例文档：该文档显示appAdmin角色指定了权限，并继承了其他角色的权限：

{
  _id: "myApp.appAdmin",
  role: "appAdmin",
  db: "myApp",
  privileges: [
      {
         resource: { db: "myApp", collection: "" },
         actions: [ "insert", "dbStats", "collStats", "compact" ]
      }
  ],
  roles: [
      { role: "appUser", db: "myApp" }
  ]
}

The privileges array lists the privileges that the appAdmin role specifies. privileges数组列出了appAdmin角色指定的权限。This role has a single privilege that permits its actions ( "insert", "dbStats", "collStats", "compact") on all the collections in the myApp database excluding its system collections. 此角色具有一个权限，允许其对myApp数据库中的所有集合（不包括其系统集合）执行操作（"insert"、"dbStats""collStats"和"compact"）。See Specify a Database as Resource.请参见将数据库指定为资源。

The roles array lists the roles, identified by the role names and databases, from which the role appAdmin inherits privileges.roles数组列出了由角色名称和数据库标识的角色，角色appAdmin从中继承权限。