Manage Users and Roles管理用户和角色

On this page本页内容

Overview概览

This tutorial provides examples for user and role management under the MongoDB’s authorization model.本教程提供了MongoDB授权模型下的用户和角色管理示例。Add Users describes how to add a new user to MongoDB.添加用户描述如何向MongoDB添加新用户。

Prerequisites先决条件

Important

If you have enabled access control for your deployment, you must authenticate as a user with the required privileges specified in each section.如果已为部署启用访问控制，则必须以具有每个节中指定的所需权限的用户身份进行身份验证。A user administrator with the userAdminAnyDatabase role, or userAdmin role in the specific databases, provides the required privileges to perform the operations listed in this tutorial.具有userAdminAnyDatabase角色或特定数据库中的userAdmin角色的用户管理员提供执行本教程中列出的操作所需的权限。See Enable Access Control for details on adding user administrator as the first user.有关将用户管理员添加为第一个用户的详细信息，请参阅启用访问控制。

Create a User-Defined Role创建用户定义的角色

Roles grant users access to MongoDB resources.角色授予用户访问MongoDB资源的权限。MongoDB provides a number of built-in roles that administrators can use to control access to a MongoDB system.MongoDB提供了许多内置角色，管理员可以使用这些角色来控制对MongoDB系统的访问。However, if these roles cannot describe the desired set of privileges, you can create new roles in a particular database.但是，如果这些角色无法描述所需的权限集，则可以在特定数据库中创建新角色。

Except for roles created in the admin database, a role can only include privileges that apply to its database and can only inherit from other roles in its database.除了在admin数据库中创建的角色外，角色只能包含应用于其数据库的权限，并且只能从其数据库中的其他角色继承。

A role created in the admin database can include privileges that apply to the admin database, other databases or to the cluster resource, and can inherit from roles in other databases as well as the admin database.在admin数据库中创建的角色可以包括应用于admin数据库、其他数据库或群集资源的权限，并且可以从其他数据库以及管理数据库中的角色继承。

To create a new role, use the db.createRole() method, specifying the privileges in the privileges array and the inherited roles in the roles array.要创建新角色，请使用db.createRole()方法，指定privileges数组中的权限和roles数组中继承的角色。

MongoDB uses the combination of the database name and the role name to uniquely define a role.MongoDB使用数据库名称和角色名称的组合来唯一地定义角色。Each role is scoped to the database in which you create the role, but MongoDB stores all role information in the admin.system.roles collection in the admin database.每个角色的作用域都是您在其中创建角色的数据库，但是MongoDB将所有角色信息存储在admin数据库中的admin.system.roles集合中。

Prerequisites先决条件

To create a role in a database, you must have:要在数据库中创建角色，必须具有：

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.内置角色userAdmin和userAdminAnyDatabase在各自的资源上提供createRole和grantRole操作。

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.若要创建指定了authenticationRestrictions的角色，必须对创建该角色的数据库资源执行SetAuthenticationRestrictions操作。

Create a Role to Manage Current Operations创建一个角色来管理当前操作

The following example creates a role named manageOpRole which provides only the privileges to run both db.currentOp() and db.killOp().下面的示例创建了一个名为manageOpRole的角色，该角色只提供运行db.currentOp()和db.killOp()这两个角色的权限。[1]

Note

Changed in version 3.2.9:在版本3.2.9中更改：On mongod instances, users do not need any specific privileges to view or kill their own operations.在mongod实例上，用户不需要任何特定的权限来查看或终止自己的操作。See db.currentOp() and db.killOp() for details.有关详细内容，请参阅db.currentOp()和db.killOp()。

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin拥有在admin数据库和其他数据库中创建角色的权限。

2

Create a new role to manage current operations.创建新角色以管理当前操作。

manageOpRole has privileges that act on multiple databases as well as the cluster resource.manageOpRole具有作用于多个数据库和群集资源的权限。As such, you must create the role in the admin database.因此，必须在admin数据库中创建角色。

use admin
db.createRole(
   {
     role: "manageOpRole",
     privileges: [
       { resource: { cluster: true }, actions: [ "killop", "inprog" ] },
       { resource: { db: "", collection: "" }, actions: [ "killCursors" ] }
     ],
     roles: []
   }
)

The new role grants permissions to kill any operations.新角色授予终止任何操作的权限。

Warning

Terminate running operations with extreme caution.终止运行操作时要格外小心。Only use the db.killOp() method or killOp command to terminate operations initiated by clients and do not terminate internal database operations.只使用db.killOp()方法或killOp命令终止客户端启动的操作，但不终止内部数据库操作。

[1]The built-in role clusterMonitor also provides the privilege to run db.currentOp() along with other privileges, and the built-in role hostManager provides the privilege to run db.killOp() along with other privileges.内置的角色clusterMonitor还提供运行db.currentOp()的权限以及其他权限，并且内置角色hostManager提供运行db.killOp()的权限以及其他权限。

Create a Role to Run创建角色以运行mongostat

The following example creates a role named mongostatRole that provides only the privileges to run mongostat.下面的示例创建了一个名为mongostatRole的角色，该角色只提供运行mongostat的权限。[2]

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin拥有在admin数据库和其他数据库中创建角色的权限。

2

Create a new role to manage current operations.创建新角色以管理当前操作。

mongostatRole has privileges that act on the cluster resource.mongostatRole具有作用于群集资源的权限。As such, you must create the role in the admin database.因此，必须在admin数据库中创建角色。

use admin
db.createRole(
   {
     role: "mongostatRole",
     privileges: [
       { resource: { cluster: true }, actions: [ "serverStatus" ] }
     ],
     roles: []
   }
)
[2]The built-in role clusterMonitor also provides the privilege to run mongostat along with other privileges.内置的角色clusterMonitor还提供运行mongostat的权限和其他权限。

Create a Role to Drop system.views Collection across Databases创建角色以跨数据库丢弃system.views集合

The following example creates a role named dropSystemViewsAnyDatabase that provides the privileges to drop the system.views collection in any database.下面的示例创建一个名为dropSystemViewsAnyDatabase的角色，该角色提供删除任何数据库中的system.views集合。

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'

The myUserAdmin has privileges to create roles in the admin as well as other databases.myUserAdmin拥有在admin数据库和其他数据库中创建角色的权限。

2

Create a new role to drop the system.views collection in any database.创建一个新角色以丢弃任何数据库中的system.views集合

For the role, specify a privilege that consists of:对于角色，请指定一个特权，该特权包括：

use admin
db.createRole(
   {
     role: "dropSystemViewsAnyDatabase",
     privileges: [
       {
         actions: [ "dropCollection" ],
         resource: { db: "", collection: "system.views" }
       }
     ],
     roles: []
   }
)

Modify Access for an Existing User修改现有用户的访问权限

Prerequisites先决条件

  • You must have the grantRole action on a database to grant a role on that database.必须对数据库执行grantRole操作才能授予该数据库上的角色。
  • You must have the revokeRole action on a database to revoke a role on that database.您必须对数据库执行revokeRole操作才能吊销该数据库上的角色。
  • To view a role’s information, you must be either explicitly granted the role or must have the viewRole action on the role’s database.要查看角色的信息，必须显式授予该角色，或者必须对该角色的数据库执行viewRole操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.以用户身份连接到mongod或mongos，并具有先决条件部分中指定的权限。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the user’s roles and privileges.标识用户的角色和权限。

To display the roles and privileges of the user to be modified, use the db.getUser() and db.getRole() methods.要显示要修改的用户的角色和权限，请使用db.getUser()方法和db.gerRole()方法。

For example, to view roles for reportsUser created in Examples, issue:例如，要查看在示例中创建的reportsUser的角色，请发出：

use reporting
db.getUser("reportsUser")

To display the privileges granted to the user by the readWrite role on the "accounts" database, issue:要在accounts数据库上显示readWrite角色授予用户的权限，请发出：

use accounts
db.getRole( "readWrite", { showPrivileges: true } )
3

Identify the privileges to grant or revoke.标识要授予或撤消的权限。

If the user requires additional privileges, grant to the user the role, or roles, with the required set of privileges.如果用户需要其他权限，请向用户授予一个或多个具有所需权限集的角色。If such a role does not exist, create a new role with the appropriate set of privileges.如果这样的角色不存在，请创建一个具有适当权限集的新角色。

To revoke a subset of privileges provided by an existing role: revoke the original role and grant a role that contains only the required privileges.要撤消现有角色提供的权限子集：撤消原始角色并授予仅包含所需权限的角色。You may need to create a new role if a role does not exist.如果角色不存在，则可能需要创建新角色。

4

Modify the user’s access.修改用户的访问权限。

Revoke a Role撤消角色

Revoke a role with the db.revokeRolesFromUser() method.利用db.revokeRolesFromUser()方法撤销角色。The following example operation removes the readWrite role on the accounts database from the reportsUser:以下示例操作从reportsUser中删除accounts数据库上的readWrite角色：

use reporting
db.revokeRolesFromUser(
    "reportsUser",
    [
      { role: "readWrite", db: "accounts" }
    ]
)
Grant a Role授予角色

Grant a role using the db.grantRolesToUser() method.利用db.grantRolesToUser()方法授予角色。For example, the following operation grants the reportsUser user the read role on the accounts database:例如，以下操作授予reportsUser用户accounts数据库上的read角色：

use reporting
db.grantRolesToUser(
    "reportsUser",
    [
      { role: "read", db: "accounts" }
    ]
)

For sharded clusters, the changes to the user are instant on the mongos on which the command runs.对于分片集群，对用户的更改在运行命令的mongos上是即时的。However, for other mongos instances in the cluster, the user cache may wait up to 10 minutes to refresh.但是，对于集群中的其他 mongos实例，用户缓存可能要等待10分钟才能刷新。See userCacheInvalidationIntervalSecs.请参阅userCacheInvalidationIntervalSecs。

Modify the Password for an Existing User修改现有用户的密码

Prerequisites先决条件

To modify the password of another user on a database, you must have the changeAnyPassword action on that database.要修改数据库中其他用户的密码，必须对该数据库执行changeAnyPassword操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to the mongod or mongos with the privileges specified in the Prerequisites section.使用先决条件部分中指定的权限连接到mongod或mongos。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Change the password.更改密码。

Pass the user’s username and the new password to the db.changeUserPassword() method.将用户的用户名和新密码传递给db.changeUserPassword()方法。

The following operation changes the reporting user’s password to SOh3TbYhxuLiW8ypJPxmt1oOfL:以下操作将reporting用户的密码更改为SOh3TbYhxuLiW8ypJPxmt1oOfL：

db.changeUserPassword("reporting", "SOh3TbYhxuLiW8ypJPxmt1oOfL")

See also另请参阅

Change Your Password and Custom Data更改密码和自定义数据

View a User’s Roles查看用户的角色

Prerequisites先决条件

To view another user’s information, you must have the viewUser action on the other user’s database.要查看其他用户的信息，必须对其他用户的数据库执行viewUser操作。

Users can view their own information.用户可以查看自己的信息。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.以用户身份连接到mongod或mongos，并具有先决条件部分中指定的权限。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the user’s roles.确定用户的角色。

Use the usersInfo command or db.getUser() method to display user information.使用usersInfo命令或db.getUser()方法来显示用户信息。

For example, to view roles for reportsUser created in Examples, issue:例如，要查看在示例中创建的reportsUser的角色，请发出：

use reporting
db.getUser("reportsUser")

In the returned document, the roles field displays all roles for reportsUser:在返回的文档中，roles字段显示reportsUser的所有角色：

...
"roles" : [
   { "role" : "readWrite", "db" : "accounts" },
   { "role" : "read", "db" : "reporting" },
   { "role" : "read", "db" : "products" },
   { "role" : "read", "db" : "sales" }
]

View a Role’s Privileges查看角色的权限

Prerequisites先决条件

To view a role’s information, you must be either explicitly granted the role or must have the viewRole action on the role’s database.要查看角色的信息，必须显式授予该角色，或者必须对该角色的数据库执行viewRole操作。

Procedure过程

1

Connect to MongoDB with the appropriate privileges.以适当的权限连接到MongoDB。

Connect to mongod or mongos as a user with the privileges specified in the prerequisite section.以用户身份连接到mongod或mongos，并具有先决条件部分中指定的权限。

The following procedure uses the myUserAdmin created in Enable Access Control.下面的过程使用在启用访问控制中创建的myUserAdmin。

mongo --port 27017 -u myUserAdmin -p 'abc123' --authenticationDatabase 'admin'
2

Identify the privileges granted by a role.标识角色授予的权限。

For a given role, use the db.getRole() method, or the rolesInfo command, with the showPrivileges option:对于给定的角色，请使用db.getRole()方法或rolesInfo命令，具有showPrivileges选项：

For example, to view the privileges granted by read role on the products database, use the following operation, issue:例如，要查看read角色在products数据库上授予的权限，请使用以下操作，发出：

use products
db.getRole( "read", { showPrivileges: true } )

In the returned document, the privileges and inheritedPrivileges arrays.在返回的文档中，privileges数组和inheritedPrivileges数组。The privileges lists the privileges directly specified by the role and excludes those privileges inherited from other roles.privileges列出由角色直接指定的特权，并排除从其他角色继承的特权。The inheritedPrivileges lists all privileges granted by this role, both directly specified and inherited.inheritedPrivileges列出此角色授予的所有特权，包括直接指定的和继承的。If the role does not inherit from other roles, the two fields are the same.如果角色没有从其他角色继承，则这两个字段是相同的。

...
"privileges" : [
  {
    "resource": { "db" : "products", "collection" : "" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  },
  {
    "resource" : { "db" : "products", "collection" : "system.js" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  }
],
"inheritedPrivileges" : [
  {
    "resource": { "db" : "products", "collection" : "" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  },
  {
    "resource" : { "db" : "products", "collection" : "system.js" },
    "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ]
  }
]