db.revokeRolesFromRole()¶

On this page

Definition
Behavior
Required Access
Example

Definition¶

db.revokeRolesFromRole(rolename, roles, writeConcern)¶

Removes the specified inherited roles from a role.

The revokeRolesFromRole method uses the following syntax:

db.revokeRolesFromRole( "<rolename>", [ <roles> ], { <writeConcern> } )

The revokeRolesFromRole method takes the following arguments:

Parameter	Type	Description
`rolename`	string	The name of the role from which to revoke roles.
`roles`	array	The inherited roles to remove.
`writeConcern`	document	Optional. The level of write concern to apply to this operation. The `writeConcern` document uses the same fields as the `getLastError` command.

In the roles field, you can specify both built-in roles and user-defined roles.

To specify a role that exists in the same database where db.revokeRolesFromRole() runs, you can either specify the role with the name of the role:

copy

"readWrite"

Or you can specify the role with a document, as in:

copy

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.

The db.revokeRolesFromRole() method wraps the revokeRolesFromRole command.

Behavior¶

Replica set¶

If run on a replica set, db.revokeRolesFromRole() is executed using majority write concern by default.

Required Access¶

You must have the revokeRole action on a database to revoke a role on that database.

Example¶

The purchaseAgents role in the emea database inherits privileges from several other roles, as listed in the roles array:

copy

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readOrdersCollection",
         "db" : "emea"
      },
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      },
      {
         "role" : "writeOrdersCollection",
         "db" : "emea"
      }
   ]
}

The following db.revokeRolesFromRole() operation on the emea database removes two roles from the purchaseAgents role:

copy

use emea
db.revokeRolesFromRole( "purchaseAgents",
                        [
                          "writeOrdersCollection",
                          "readOrdersCollection"
                        ],
                        { w: "majority" , wtimeout: 5000 }
                      )

The purchaseAgents role now contains just one role:

copy

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      }
   ]
}

← db.grantRolesToRole() db.updateRole() →