revokeRolesFromRole
On this page
Definition
revokeRolesFromRole
Removes the specified inherited roles from a role. The
revokeRolesFromRole
command has the following syntax:{ revokeRolesFromRole: "<role>", roles: [ { role: "<role>", db: "<database>" } | "<role>", ... ], writeConcern: { <write concern> }, comment: <any> } The command has the following fields:
FieldTypeDescriptionrevokeRolesFromRole
stringThe role from which to remove inherited roles.roles
arrayThe inherited roles to remove.writeConcern
documentOptional. The level of write concern for the operation. See Write Concern Specification.
comment
anyOptional. A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations:
mongod log messages, in the
attr.command.cursor.comment
field.Database profiler output, in the
command.comment
field.currentOp
output, in thecommand.comment
field.
A comment can be any valid BSON type (string, integer, object, array, etc).
New in version 4.4.
In the
roles
field, you can specify both built-in roles and user-defined roles.To specify a role that exists in the same database where
revokeRolesFromRole
runs, you can either specify the role with the name of the role:"readWrite" Or you can specify the role with a document, as in:
{ role: "<role>", db: "<database>" } To specify a role that exists in a different database, specify the role with a document.
Required Access
You must have the revokeRole
action on a database to revoke a role on that database.
Example
The purchaseAgents
role in the emea
database inherits privileges
from several other roles, as listed in the roles
array:
{ "_id" : "emea.purchaseAgents", "role" : "purchaseAgents", "db" : "emea", "privileges" : [], "roles" : [ { "role" : "readOrdersCollection", "db" : "emea" }, { "role" : "readAccountsCollection", "db" : "emea" }, { "role" : "writeOrdersCollection", "db" : "emea" } ] }
The following revokeRolesFromRole
operation on the emea
database removes two roles from the purchaseAgents
role:
use emea db.runCommand( { revokeRolesFromRole: "purchaseAgents", roles: [ "writeOrdersCollection", "readOrdersCollection" ], writeConcern: { w: "majority" , wtimeout: 5000 } } )
The purchaseAgents
role now contains just one role:
{ "_id" : "emea.purchaseAgents", "role" : "purchaseAgents", "db" : "emea", "privileges" : [], "roles" : [ { "role" : "readAccountsCollection", "db" : "emea" } ] }