db.revokeRolesFromRole()

Definition

• db.revokeRolesFromRole(rolename, roles, writeConcern)
• Removes the specified inherited roles from a role.

The revokeRolesFromRole method uses the following syntax:

db.revokeRolesFromRole( "<rolename>", [ <roles> ], { <writeConcern> } )

The revokeRolesFromRole method takes the following arguments:

ParameterTypeDescriptionrolenamestringThe name of the role from which to revoke roles.rolesarrayThe inherited roles to remove.writeConcerndocumentOptional. The level of write concern to applyto this operation. The writeConcern document uses the same fieldsas the getLastError command.

In the roles field, you can specify bothbuilt-in roles and user-definedroles.

To specify a role that exists in the same database wheredb.revokeRolesFromRole() runs, you can either specify the role with the name ofthe role:

"readWrite"

Or you can specify the role with a document, as in:

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the rolewith a document.

The db.revokeRolesFromRole() method wraps therevokeRolesFromRole command.

Behavior

Replica set

If run on a replica set, db.revokeRolesFromRole() is executed using majority write concern by default.

Required Access

You must have the revokeRoleaction on a database to revoke a role on that database.

Example

The purchaseAgents role in the emea database inherits privilegesfrom several other roles, as listed in the roles array:

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readOrdersCollection",
         "db" : "emea"
      },
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      },
      {
         "role" : "writeOrdersCollection",
         "db" : "emea"
      }
   ]
}

The following db.revokeRolesFromRole() operation on the emeadatabase removes two roles from the purchaseAgents role:

use emea
db.revokeRolesFromRole( "purchaseAgents",
                        [
                          "writeOrdersCollection",
                          "readOrdersCollection"
                        ],
                        { w: "majority" , wtimeout: 5000 }
                      )

The purchaseAgents role now contains just one role:

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      }
   ]
}