MongoDB用户及权限管理(一):角色说明
内容导读
互联网集市收集整理的这篇技术教程文章主要介绍了MongoDB用户及权限管理(一):角色说明，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含5857字，纯文字阅读大概需要9分钟。
内容图文
auth模块的，普通用户和超级管理员均不通过认证就可操作。当然裸奔有风险，安全起见还是开启auth模块。首先需要了解下面几点：
1、mongodb是没有默认管理员账号，所以要先添加管理员账号，然后开启权限认证。
2、切换到admin数据库，添加的账号才是管理员账号。
3、用户只能在用户所在数据库登录，包括管理员账号。
4、管理员可以管理所有数据库，但是不能直接管理其他数据库，要先在admin数据库认证后才可以。这一点比较怪。
1.用户权限角色说明
1.1 Database User Roles
read
允许用户读取指定数据库
Provides the ability to read data on allnon-system collections and on the following system collections: system.indexes,system.js, and system.namespaces collections.
拥有如下权限：
aggregate,checkShardingIndex,cloneCollectionAsCapped,collStats count,dataSize,dbHash,dbStats,distinct,filemd5 geoNear,geoSearch,geoWalk,group mapReduce (inline output only.),text (beta feature.) |
readWrite
允许用户读写指定数据库
Provides all the privileges of the readrole and the ability to modify data on all non-system collections and thesystem.js collection.
除了具有read权限，还拥有以下权限：
cloneCollection (as the target database.),convertToCapped create (and to create collections implicitly.) drop(),dropIndexes,emptycapped,ensureIndex() findAndModify,mapReduce (output to a collection.) renameCollection (within the same database.) read和readWrite只要就是对库中表的操作权限 |
1.2 Database Administration Roles
dbAdmin
允许用户在指定数据库中执行管理函数，如索引创建、删除，查看统计或访问system.profile
Provides the ability to performadministrative tasks such as schema-related tasks, indexing, gatheringstatistics. This role does not grant privileges for user and role management.
拥有如下权限：
clean,collMod,collStats,compact,convertToCapped create,db.createCollection(),dbStats,drop(),dropIndexes,ensureIndex() indexStats,profile,reIndex,renameCollection (within a single database.),validate |
dbOwner
Provides the ability to perform anyadministrative action on the database. This role combines the privilegesgranted by the readWrite, dbAdmin and userAdmin roles.
userAdmin
允许用户向system.users集合写入，可以找指定数据库里创建、删除和管理用户
Provides the ability to create and modifyroles and users on the current database. Since the userAdmin role allows usersto grant any privilege to any user, including themselves, the role alsoindirectly provides superuser access to either the database or, if scoped tothe admin database, the cluster.
1.3 Cluster Administration Roles
clusterAdmin
只在admin数据库中可用，赋予用户所有分片和复制集相关函数的管理权限。
Provides the greatest cluster-managementaccess. This role combines the privileges granted by the clusterManager,clusterMonitor, and hostManager roles. Additionally, the role provides thedropDatabase action.
拥有如下权限：
addShard,closeAllDatabases,connPoolStats,connPoolSync,_cpuProfilerStart _cpuProfilerStop,cursorInfo,diagLogging,dropDatabase enableSharding,flushRouterConfig,fsync,db.fsyncUnlock() getCmdLineOpts,getLog,getParameter,getShardMap,getShardVersion hostInfo,db.currentOp(),db.killOp(),listDatabases,listShards logRotate,moveChunk,movePrimary,netstat,removeShard,unsetSharding repairDatabase,replSetFreeze,replSetGetStatus,replSetInitiate replSetMaintenance,replSetReconfig,replSetStepDown,replSetSyncFrom resync,serverStatus,setParameter,setShardVersion,shardCollection shardingState,shutdown,splitChunk,splitVector,split,top,touch |
clusterManager
Provides management and monitoring actionson the cluster. A user with this role can access the config and localdatabases, which are used in sharding and replication, respectively.
clusterMonitor
Provides read-only access to monitoringtools, such as the MongoDB Cloud Manager and Ops Manager monitoring agent.
hostManager
Provides the ability to monitor and manageservers.
1.4 Backup and Restoration Roles
backup
Provides privileges needed to back up data.This role provides sufficient privileges to use the MongoDB Cloud Managerbackup agent, Ops Manager backup agent, or to use mongodump.
restore
Provides privileges needed to restore datawith mongorestore without the --oplogReplay option or without system.profilecollection data.
1.5 All-Database Roles
readAnyDatabase
只在admin数据库中可用，赋予用户所有数据库的读权限
Provides the same read-only permissions asread, except it applies to all but the local and config databases in thecluster. The role also provides the listDatabases action on the cluster as awhole.
readWriteAnyDatabase
只在admin数据库中可用，赋予用户所有数据库的读写权限
Provides the same read and writepermissions as readWrite, except it applies to all but the local and configdatabases in the cluster. The role also provides the listDatabases action onthe cluster as a whole.
userAdminAnyDatabase
只在admin数据库中可用，赋予用户所有数据库的userAdmin权限
Provides the same access to useradministration operations as userAdmin, except it applies to all but the localand config databases in the cluster.
Since the userAdminAnyDatabase role allowsusers to grant any privilege to any user, including themselves, the role alsoindirectly provides superuser access.
dbAdminAnyDatabase
只在admin数据库中可用，赋予用户所有数据库的dbAdmin权限。
Provides the same access to databaseadministration operations as dbAdmin, except it applies to all but the localand config databases in the cluster. The role also provides the listDatabasesaction on the cluster as a whole.
1.6 Superuser Roles
root
只在admin数据库中可用。超级账号，超级权限
Provides access to the operations and allthe resources of the readWriteAnyDatabase, dbAdminAnyDatabase,userAdminAnyDatabase, clusterAdmin, restore, and backup combined.
具体权限可参见：
https://docs.mongodb.com/manual/reference/built-in-roles/#read
本文出自 “老书生” 博客，请务必保留此出处http://showing.blog.51cto.com/11976328/1905159
MongoDB用户及权限管理(一):角色说明
标签：mongodb
本文系统来源：http://showing.blog.51cto.com/11976328/1905159
内容总结
以上是互联网集市为您收集整理的MongoDB用户及权限管理(一):角色说明全部内容，希望文章能够帮你解决MongoDB用户及权限管理(一):角色说明所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。
内容备注
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。
内容手机端
扫描二维码推送至手机访问。