Database Manual / Self-Managed Deployments / Security / Role-Based Access Control

Manage Users and Roles on Self-Managed Deployments在自我管理部署中管理用户和角色

This tutorial provides examples for user and role management under MongoDB's authorization model for self-managed deployments. To create a new user, see Create a User on Self-Managed Deployments.本教程提供了MongoDB自我管理部署授权模型下的用户和角色管理示例。要创建新用户，请参阅在自我管理部署上创建用户。

Prerequisites先决条件

If you have enabled access control for your deployment, you must authenticate as a user with the required privileges specified in each section. 如果您已为部署启用了访问控制，则必须以具有每个部分中指定的所需权限的用户身份进行身份验证。To perform the operations listed in this tutorial, user administrators require the userAdminAnyDatabase role, or userAdmin role in the specific databases. 要执行本教程中列出的操作，用户管理员需要特定数据库中的userAdminAnyDatabase角色或userAdmin角色。For details on adding a user administrator as the first user, see Enable Access Control on Self-Managed Deployments有关将用户管理员添加为第一个用户的详细信息，请参阅在自我管理部署上启用访问控制

Create a User-Defined Role创建用户定义的角色

Note

To create user-defined roles in MongoDB Atlas, see Add Custom Roles in the MongoDB Atlas documentation.要在MongoDB Atlas中创建用户定义的角色，请参阅MongoDB Atlas文档中的添加自定义角色。

Roles grant users access to MongoDB resources. MongoDB provides a number of built-in roles that administrators can use to control access to a MongoDB system. 角色授予用户访问MongoDB资源的权限。MongoDB提供了许多内置角色，管理员可以使用这些角色来控制对MongoDB系统的访问。However, if these roles cannot describe the desired set of privileges, you can create new roles in a particular database.但是，如果这些角色无法描述所需的权限集，则可以在特定数据库中创建新角色。

Except for roles created in the admin database, a role can only include privileges that apply to its database and can only inherit from other roles in its database.除了在admin数据库中创建的角色外，角色只能包含适用于其数据库的权限，并且只能继承其数据库中的其他角色。

A role created in the admin database can include privileges that apply to the admin database, other databases or to the cluster resource, and can inherit from roles in other databases as well as the admin database.在admin数据库中创建的角色可以包括应用于admin数据库、其他数据库或集群资源的权限，并且可以继承其他数据库以及admin数据库中的角色。

To create a new role, use the db.createRole() method, specifying the privileges in the privileges array and the inherited roles in the roles array.要创建新角色，请使用db.createRole()方法，在privileges数组中指定权限，在roles数组中指定继承的角色。

MongoDB uses the combination of the database name and the role name to uniquely define a role. MongoDB使用数据库名称和角色名称的组合来唯一定义角色。Each role is scoped to the database in which you create the role, but MongoDB stores all role information in the admin.system.roles collection in the admin database.每个角色的作用域都在您创建角色的数据库中，但MongoDB将所有角色信息存储在admin数据库的admin.system.roles集合中。

Prerequisites先决条件

To create a role in a database, you must have:要在数据库中创建角色，您必须具备：

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.若要创建指定了authenticationRestrictions的角色，您必须对创建该角色的数据库资源执行setAuthenticationRestriction操作。

To add custom user-defined roles with mongosh, see the following examples:要使用mongosh添加自定义用户定义的角色，请参阅以下示例：

Create a Role to Manage Current Operations创建一个角色来管理当前操作

The following example creates a role named manageOpRole which provides only the privileges to run both db.currentOp() and db.killOp(). 以下示例创建了一个名为manageOpRole的角色，该角色仅提供运行db.currentOp()和db.killOp()的权限。[1]

Note

Users do not need any specific privileges to view or kill their own operations on mongod instances. 用户不需要任何特定的权限来查看或终止他们在mongod实例上的操作。See db.currentOp() and db.killOp() for details.有关详细信息，请参阅db.currentOp()和db.killOp()。

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在对自我管理部署启用访问控制中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin有权在admin和其他数据库中创建角色。

2

Create a new role to manage current operations.创建一个新角色来管理当前操作。

manageOpRole has privileges that act on multiple databases as well as the cluster resource. manageOpRole具有作用于多个数据库以及集群资源的权限。As such, you must create the role in the admin database.因此，您必须在admin数据库中创建角色。

use admin
db.createRole(
   {
     role: "manageOpRole", 
     privileges: [
       { resource: { cluster: true }, actions: [ "killop", "inprog" ] },
       { resource: { db: "", collection: "" }, actions: [ "killCursors" ] }
     ],
     roles: []
   }
)

The new role grants permissions to kill any operations.新角色授予终止任何操作的权限。

Warning

Terminate running operations with extreme caution. Only use the db.killOp() method or killOp command to terminate operations initiated by clients and do not terminate internal database operations.极其小心地终止正在运行的操作。仅使用db.killOp()方法或killOp命令终止客户端启动的操作，而不终止内部数据库操作。

[1] The built-in role clusterMonitor also provides the privilege to run db.currentOp() along with other privileges, and the built-in role hostManager provides the privilege to run db.killOp() along with other privileges.内置的角色clusterMonitor还提供了运行db.currentOp()和其他权限的权限，内置的角色hostManager提供了运行db.killOp()和其它权限的权限。

Create a Role to Run mongostat创建运行mongostat的角色

The following example creates a role named mongostatRole that provides only the privileges to run mongostat. 以下示例创建了一个名为mongostatRole的角色，该角色仅提供运行mongostat的权限。[2]

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在“对自我管理部署启用访问控制”中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin有权在admin和其他数据库中创建角色。

2

Create a new role to manage current operations.创建一个新角色来管理当前操作。

mongostatRole has privileges that act on the cluster resource. As such, you must create the role in the admin database.mongostatRole具有作用于集群资源的权限。因此，您必须在管理员数据库中创建角色。

use admin
db.createRole(
   {
     role: "mongostatRole", 
     privileges: [
       { resource: { cluster: true }, actions: [ "serverStatus" ] }
     ],
     roles: []
   }
)
[2] The built-in role clusterMonitor also provides the privilege to run mongostat along with other privileges.内置的角色clusterMonitor还提供了运行mongostat的权限以及其他权限。

Create a Role to Drop system.views Collection across Databases创建角色以跨数据库删除system.views集合

The following example creates a role named dropSystemViewsAnyDatabase that provides the privileges to drop the system.views collection in any database.以下示例创建了一个名为dropSystemViewsAnyDatabase的角色，该角色提供在任何数据库中删除system.views集合的权限。

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在“对自我管理部署启用访问控制”中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin有权在admin和其他数据库中创建角色。

2

Create a new role to drop the system.views collection in any database.创建一个新角色，将system.views集合放入任何数据库中。

For the role, specify a privilege that consists of:为该角色指定一个权限，该权限包括：

use admin
db.createRole(
   {
     role: "dropSystemViewsAnyDatabase", 
     privileges: [
       {
         actions: [ "dropCollection" ],
         resource: { db: "", collection: "system.views" }
       }
     ],
     roles: []
   }
)

Modify Access for an Existing User修改现有用户的访问权限

Note

To modify an existing database user's roles in MongoDB Atlas, see Modify Database Users in the MongoDB Atlas documentation.要修改MongoDB Atlas中现有数据库用户的角色，请参阅MongoDB Atlas文档中的修改数据库用户。

Prerequisites先决条件

  • You must have the grantRole action on a database to grant a role on that database.您必须对数据库执行grantRole操作，才能在该数据库上授予角色。
  • You must have the revokeRole action on a database to revoke a role on that database.您必须对数据库执行revokeRole操作才能撤销该数据库上的角色。
  • To view a role's information, you must be either explicitly granted the role or must have the viewRole action on the role's database.要查看角色的信息，您必须被明确授予该角色，或者必须对该角色的数据库执行viewRole操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.使用先决条件部分中指定的权限以用户身份连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在对自我管理部署启用访问控制中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the user's roles and privileges.确定用户的角色和权限。

To display the roles and privileges of the user to be modified, use the db.getUser() and db.getRole() methods.要显示要修改的用户的角色和权限，请使用db.getUser()和db.getRole()方法。

For example, to view roles for reportsUser created in Additional Examples, issue:例如，要查看reportsUser在其他示例中创建的角色，请发出：

use reporting
db.getUser("reportsUser")

To display the privileges granted to the user by the readWrite role on the "accounts" database, issue:要显示readWrite角色在"accounts"数据库上授予用户的权限，请发出：

use accounts
db.getRole( "readWrite", { showPrivileges: true } )
3

Identify the privileges to grant or revoke.确定要授予或撤销的权限。

If the user requires additional privileges, grant to the user the role, or roles, with the required set of privileges. If such a role does not exist, create a new role with the appropriate set of privileges.如果用户需要额外的权限，请向用户授予具有所需权限集的一个或多个角色。如果不存在这样的角色，请创建一个具有适当权限集的新角色。

To revoke a subset of privileges provided by an existing role: revoke the original role and grant a role that contains only the required privileges. You may need to create a new role if a role does not exist.要撤销现有角色提供的权限子集：撤销原始角色并授予仅包含所需权限的角色。如果角色不存在，您可能需要创建一个新角色。

4

Modify the user's access.修改用户的访问权限。

Revoke a Role撤销角色

Revoke a role with the db.revokeRolesFromUser() method. The following example operation removes the readWrite role on the accounts database from the reportsUser:使用db.revokeRolesFromUser()方法撤销角色。以下示例操作从reportsUser中删除accounts数据库上的readWrite角色：

use reporting
db.revokeRolesFromUser(
    "reportsUser",
    [
      { role: "readWrite", db: "accounts" }
    ]
)
Grant a Role授予角色

Grant a role using the db.grantRolesToUser() method. For example, the following operation grants the reportsUser user the read role on the accounts database:使用db.grantRolesToUser()方法授予角色。例如，以下操作授予reportsUser用户在accounts数据库上的read角色：

use reporting
db.grantRolesToUser(
    "reportsUser",
    [
      { role: "read", db: "accounts" }
    ]
)

For sharded clusters, the changes to the user are instant on the mongos on which the command runs. 对于分片集群，用户的更改在运行命令的mongos上是即时的。However, for other mongos instances in the cluster, the user cache may wait up to 10 minutes to refresh. 然而，对于集群中的其他mongos实例，用户缓存可能需要等待长达10分钟才能刷新。See userCacheInvalidationIntervalSecs.请参阅userCacheInvalidationIntervalSecs。

Modify the Password for an Existing User修改现有用户的密码

Note

To modify an existing MongoDB Atlas user's password, see Modify Database Users in the MongoDB Atlas documentation.要修改现有MongoDB Atlas用户的密码，请参阅MongoDB Atlas文档中的修改数据库用户。

Prerequisites先决条件

To modify the password of another user on a database, you must have the changePassword action on that database.要修改数据库上其他用户的密码，您必须对该数据库执行changePassword操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to the mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在“对自我管理部署启用访问控制”中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Change the password.更改密码。

Pass the user's username and the new password to the db.changeUserPassword() method.将用户的用户名和新密码传递给db.changeUserPassword()方法。

The following operation changes the reporting user's password to SOh3TbYhxuLiW8ypJPxmt1oOfL:以下操作将reporting用户的密码更改为SOh3TbYhxuLiW8ypJPxmt1oOfL：

db.changeUserPassword("reporting", "SOh3TbYhxuLiW8ypJPxmt1oOfL")

Tip

Change Your Password and Custom Data on Self-Managed Deployments在自我管理部署中更改密码和自定义数据

View a User's Roles查看用户的角色

Note

To view a user's roles in MongoDB Atlas, see View Database Users and Certificates in the MongoDB Atlas documentation.要查看用户在MongoDB Atlas中的角色，请参阅MongoDB Atlas文档中的查看数据库用户和证书。

Prerequisites先决条件

To view another user's information, you must have the viewUser action on the other user's database.要查看其他用户的信息，您必须对其他用户的数据库执行viewUser操作。

Users can view their own information.用户可以查看自己的信息。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.使用先决条件部分中指定的权限以用户身份连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在“对自我管理部署启用访问控制”中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the user's roles.确定用户的角色。

Use the usersInfo command or db.getUser() method to display user information.使用usersInfo命令或db.getUser()方法显示用户信息。

For example, to view roles for reportsUser created in Additional Examples, issue:例如，要查看reportsUser在“其他示例”中创建的角色，请发出：

use reporting
db.getUser("reportsUser")

In the returned document, the roles field displays all roles for reportsUser:在返回的文档中，roles字段显示了reportsUser的所有角色：

...
"roles" : [
   { "role" : "readWrite", "db" : "accounts" },
   { "role" : "read", "db" : "reporting" },
   { "role" : "read", "db" : "products" },
   { "role" : "read", "db" : "sales" }
]

View a Role's Privileges查看角色的权限

Note

To view a role's privileges in MongoDB Atlas, see View Custom Roles in the MongoDB Atlas documentation.要在MongoDB Atlas中查看角色的权限，请参阅MongoDB Atlas文档中的查看自定义角色。

Prerequisites先决条件

To view a role's information, you must be either explicitly granted the role or must have the viewRole action on the role's database.要查看角色的信息，您必须被明确授予该角色，或者必须对该角色的数据库执行viewRole操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.使用先决条件部分中指定的权限以用户身份连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control on Self-Managed Deployments.以下过程使用在对自我管理部署启用访问控制中创建的myUserAdmin。

mongosh --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the privileges granted by a role.确定角色授予的权限。

For a given role, use the db.getRole() method, or the rolesInfo command, with the showPrivileges option:对于给定的角色，使用db.getRole()方法或rolesInfo命令，并使用showPrivileges选项：

For example, to view the privileges granted by read role on the products database, use the following operation, issue:例如，要查看products数据库上read角色授予的权限，请使用以下操作：

use products
db.getRole( "read", { showPrivileges: true } )

In the returned document, the privileges and inheritedPrivileges arrays. 在返回的文档中，privileges和inheritedPrivileges数组。The privileges lists the privileges directly specified by the role and excludes those privileges inherited from other roles. privileges列出了角色直接指定的权限，不包括从其他角色继承的权限。The inheritedPrivileges lists all privileges granted by this role, both directly specified and inherited. If the role does not inherit from other roles, the two fields are the same.inheritedPrivileges列出了此角色授予的所有权限，包括直接指定和继承的权限。如果该角色没有从其他角色继承，则这两个字段是相同的。

...
"privileges" : [
  {
    "resource": { "db" : "products", "collection" : "" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  },
  {
    "resource" : { "db" : "products", "collection" : "system.js" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  }
],
"inheritedPrivileges" : [
  {
    "resource": { "db" : "products", "collection" : "" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  },
  {
    "resource" : { "db" : "products", "collection" : "system.js" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  }
]