Create a User on Self-Managed Deployments在自我管理部署中创建用户

Username/Password Authentication用户名/密码验证

The following operation creates a user in the reporting database with the specified name, password, and roles.以下操作将在reporting数据库中创建具有指定名称、密码和角色的用户。

use reporting
db.createUser(
  {
    user: "reportsUser",
    pwd: passwordPrompt(),  // or cleartext password
    roles: [
       { role: "read", db: "reporting" },
       { role: "read", db: "products" },
       { role: "read", db: "sales" },
       { role: "readWrite", db: "accounts" }
    ]
  }
)

Kerberos AuthenticationKerberos认证

Users that authenticate to MongoDB using an external authentication mechanism, such as Kerberos, must be created in the $external database, which allows mongos or mongod to consult an external source for authentication.使用外部身份验证机制（如Kerberos）向MongoDB进行身份验证的用户必须在$external数据库中创建，这允许mongos或mongod查询外部源进行身份验证。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

For Kerberos authentication, you must add the Kerberos principal as the username. You do not need to specify a password.对于Kerberos身份验证，必须将Kerberos主体添加为用户名。您不需要指定密码。

The following operation adds the Kerberos principal reportingapp@EXAMPLE.NET with read-only access to the records database:以下操作将添加Kerberos主体reportingapp@EXAMPLE.NET具有对records数据库的只读访问权限：

use $external
db.createUser(
    {
      user: "reportingapp@EXAMPLE.NET",
      roles: [
         { role: "read", db: "records" }
      ]
    }
)

LDAP AuthenticationLDAP身份验证

Users that authenticate to MongoDB using an external authentication mechanism, such as LDAP, must be created in the $external database, which allows mongos or mongod to consult an external source for authentication.使用外部身份验证机制（如LDAP）向MongoDB进行身份验证的用户必须在$external数据库中创建，这允许mongos或mongod查询外部来源进行身份验证。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

For LDAP authentication, you must specify a username. You do not need to specify the password, as that is handled by the LDAP service.对于LDAP身份验证，您必须指定一个用户名。您不需要指定密码，因为这是由LDAP服务处理的。

The following operation adds the reporting user with read-only access to the records database:以下操作将为reporting用户添加对记录数据库的只读访问权限：

use $external
db.createUser(
    {
      user: "reporting",
      roles: [
         { role: "read", db: "records" }
      ]
    }
)

X.509 Client Certificate AuthenticationX.509客户端证书身份验证

Users that authenticate to MongoDB using an external authentication mechanism, such as X.509 Client Certificate Authentication, must be created in the $external database, which allows mongos or mongod to consult an external source for authentication.必须在$external数据库中创建使用外部身份验证机制（如X.509客户端证书身份验证）向MongoDB进行身份验证的用户，这允许mongos或mongod查询外部源进行身份验证。

To use Client Sessions and Causal Consistency Guarantees with $external authentication users (Kerberos, LDAP, or X.509 users), usernames cannot be greater than 10k bytes.要对$external身份验证用户（Kerberos、LDAP或X.509用户）使用客户端会话和因果一致性保证，用户名不能大于10k字节。

For X.509 Client Certificate authentication, you must add the value of the subject from the client certificate as a MongoDB user. Each unique X.509 client certificate corresponds to a single MongoDB user. You do not need to specify a password.对于X.509客户端证书身份验证，您必须将客户端证书中的主题值添加为MongoDB用户。每个唯一的X.509客户端证书对应一个MongoDB用户。您不需要指定密码。

The following operation adds the client certificate subject CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry user with read-only access to the records database.以下操作将添加客户端证书主题CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry用户，该用户对records数据库具有只读访问权限。

use $external
db.createUser(
    {
      user: "CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry",
      roles: [
         { role: "read", db: "records" }
      ]
    }
)