createRole

Definition

createRole

Creates a role and specifies its privileges. The role applies to the database on which you run the command. The createRole command returns a duplicate role error if the role already exists in the database.

Tip

In the mongo Shell, this command can also be run through the db.createRole() helper method.

Helper methods are convenient for mongo users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.

The createRole command uses the following syntax:

{ createRole: "<new role>",
  privileges: [
    { resource: { <resource> }, actions: [ "<action>", ... ] },
    ...
  ],
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  authenticationRestrictions: [
    {
      clientSource: ["<IP>" | "<CIDR range>", ...],
      serverAddress: ["<IP>" | "<CIDR range>", ...]
    },
    ...
  ],
  writeConcern: <write concern document>,
  comment: <any>
}

The createRole command has the following fields:

Field	Type	Description
createRole	string	The name of the new role.
privileges	array	The privileges to grant the role. A privilege consists of a resource and permitted actions. For the syntax of a privilege, see the privileges array. You must include the privileges field. Use an empty array to specify no privileges.
roles	array	An array of roles from which this role inherits privileges. You must include the roles field. Use an empty array to specify no roles to inherit from.
authenticationRestrictions	array	Optional. The authentication restrictions the server enforces on the role. Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from. New in version 3.6.
writeConcern	document	Optional. The level of write concern to apply to this operation. The writeConcern document uses the same fields as the getLastError command.
comment	any	Optional. A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations: mongod log messages, in the attr.command.cursor.comment field. Database profiler output, in the command.comment field. currentOp output, in the command.comment field. A comment can be any valid BSON type (string, integer, object, array, etc). New in version 4.4.

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior

A role's privileges apply to the database where the role is created. The role can inherit privileges from other roles in its database. A role created on the admin database can include privileges that apply to all databases or to the cluster and can inherit privileges from roles in other databases.

Required Access

To create a role in a database, you must have:

• the createRole action on that database resource.

• the grantRole action on that database to specify privileges for the new role as well as to specify roles to inherit from.

Built-in roles userAdmin and userAdminAnyDatabase provide createRole and grantRole actions on their respective resources.

To create a role with authenticationRestrictions specified, you must have the setAuthenticationRestriction action on the database resource which the role is created.

Example

The following createRole command creates the myClusterwideAdmin role on the admin database:

db.adminCommand({ createRole: "myClusterwideAdmin",
  privileges: [
    { resource: { cluster: true }, actions: [ "addShard" ] },
    { resource: { db: "config", collection: "" }, actions: [ "find", "update", "insert", "remove" ] },
    { resource: { db: "users", collection: "usersCollection" }, actions: [ "update", "insert", "remove" ] },
    { resource: { db: "", collection: "" }, actions: [ "find" ] }
  ],
  roles: [
    { role: "read", db: "admin" }
  ],
  writeConcern: { w: "majority" , wtimeout: 5000 }
})