createRole¶

Definition定义¶

createRole¶

Creates a role and specifies its privileges. The role applies to the database on which you run the command. The createRole command returns a duplicate role error if the role already exists in the database.

The createRole command uses the following syntax:

{ createRole: "<new role>",
  privileges: [
    { resource: { <resource> }, actions: [ "<action>", ... ] },
    ...
  ],
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ],
  writeConcern: <write concern document>,
  comment: <any>
}

The createRole command has the following fields:

Field字段	Type类型	Description描述
createRole	string	The name of the new role.
privileges	array	The privileges to grant the role. A privilege consists of a resource and permitted actions. For the syntax of a privilege, see the privileges array. You must include the privileges field. Use an empty array to specify no privileges.
roles	array	An array of roles from which this role inherits privileges. You must include the roles field. Use an empty array to specify no roles to inherit from.
authenticationRestrictions	array	Optional. The authentication restrictions the server enforces on the role. Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from. New in version 3.6.版本3.6中的新功能。
writeConcern	document	Optional.可选。The level of write concern to apply to this operation. The writeConcern document uses the same fields as the getLastError command.
comment	any	Optional.可选。A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations: mongod log messages, in the attr.command.cursor.comment field. Database profiler output, in the command.comment field. currentOp output, in the command.comment field. A comment can be any valid BSON type (string, integer, object, array, etc). New in version 4.4.版本4.4中的新功能。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为¶

A role’s privileges apply to the database where the role is created. The role can inherit privileges from other roles in its database. A role created on the admin database can include privileges that apply to all databases or to the cluster and can inherit privileges from roles in other databases.

Required Access¶

To create a role in a database, you must have:

• the createRole action on that database resource.
• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.

Example示例¶

The following createRole command creates the myClusterwideAdmin role on the admin database:

db.adminCommand({ createRole: "myClusterwideAdmin",
  privileges: [
    { resource: { cluster: true }, actions: [ "addShard" ] },
    { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
    { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
    { resource: { db: "", collection: "" }, actions: [ "find" ] }
  ],
  roles: [
    { role: "read", db: "admin" }
  ],
  writeConcern: { w: "majority" , wtimeout: 5000 }
})