revokeRolesFromRole

Definition

• revokeRolesFromRole
• Removes the specified inherited roles from a role. TherevokeRolesFromRole command has the following syntax:

{ revokeRolesFromRole: "<role>",
  roles: [
    { role: "<role>", db: "<database>" } | "<role>",
    ...
  ],
  writeConcern: { <write concern> }
}

The command has the following fields:

FieldTypeDescriptionrevokeRolesFromRolestringThe role from which to remove inherited roles.rolesarrayThe inherited roles to remove.writeConcerndocumentOptional. The level of write concern to applyto this operation. The writeConcern document uses the same fieldsas the getLastError command.

In the roles field, you can specify bothbuilt-in roles and user-definedroles.

To specify a role that exists in the same database whererevokeRolesFromRole runs, you can either specify the role with the name ofthe role:

"readWrite"

Or you can specify the role with a document, as in:

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the rolewith a document.

Required Access

You must have the revokeRoleaction on a database to revoke a role on that database.

Example

The purchaseAgents role in the emea database inherits privilegesfrom several other roles, as listed in the roles array:

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readOrdersCollection",
         "db" : "emea"
      },
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      },
      {
         "role" : "writeOrdersCollection",
         "db" : "emea"
      }
   ]
}

The following revokeRolesFromRole operation on the emeadatabase removes two roles from the purchaseAgents role:

use emea
db.runCommand( { revokeRolesFromRole: "purchaseAgents",
                 roles: [
                          "writeOrdersCollection",
                          "readOrdersCollection"
                        ],
                  writeConcern: { w: "majority" , wtimeout: 5000 }
             } )

The purchaseAgents role now contains just one role:

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      }
   ]
}