db.revokePrivilegesFromRole()

Definition

• db.revokePrivilegesFromRole(rolename, privileges, writeConcern)
• Removes the specified privileges from the user-defined role on the database where the method runs. TherevokePrivilegesFromRole method has the following syntax:

db.revokePrivilegesFromRole(
    "<rolename>",
    [
        { resource: { <resource> }, actions: [ "<action>", ... ] },
        ...
    ],
    { <writeConcern> }
)

The revokePrivilegesFromRole method takes the following arguments:

ParameterTypeDescriptionrolenamestringThe name of the user-defined role fromwhich to revoke privileges.privilegesarrayAn array of privileges to remove from the role. Seeprivileges for more information on theformat of the privileges.writeConcerndocumentOptional. The level of write concern for themodification. The writeConcern document takes the samefields as the getLastError command.

The db.revokePrivilegesFromRole() method wraps therevokePrivilegesFromRole command.

Behavior

Replica set

If run on a replica set, db.revokePrivilegesFromRole() is executed using majority write concern by default.

Scope

To revoke a privilege, the resource document pattern must match exactly theresource field of that privilege. The actions field can be asubset or match exactly.

For example, given the role accountRole in the productsdatabase with the following privilege that specifies the productsdatabase as the resource:

{
  "resource" : {
      "db" : "products",
      "collection" : ""
  },
  "actions" : [
      "find",
      "update"
  ]
}

You cannot revoke find and/or update from just _one_collection in the products database. The following operationsresult in no change to the role:

use products
db.revokePrivilegesFromRole(
   "accountRole",
   [
     {
       resource : {
          db : "products",
          collection : "gadgets"
       },
       actions : [
          "find",
          "update"
       ]
     }
   ]
)
 
db.revokePrivilegesFromRole(
   "accountRole",
   [
     {
       resource : {
          db : "products",
          collection : "gadgets"
       },
       actions : [
          "find"
       ]
     }
   ]
)

To revoke the "find" and/or the "update" action from the roleaccountRole, you must match the resource document exactly. Forexample, the following operation revokes just the "find" actionfrom the existing privilege.

use products
db.revokePrivilegesFromRole(
   "accountRole",
   [
     {
       resource : {
          db : "products",
          collection : ""
       },
       actions : [
          "find"
       ]
     }
   ]
)

Required Access

You must have the revokeRoleaction on the database a privilege targets in order torevoke that privilege. If the privilege targets multiple databases or thecluster resource, you must have the revokeRole actionon the admin database.

Example

The following operation removes multiple privileges from theassociates role:

db.revokePrivilegesFromRole(
   "associate",
   [
     {
       resource: { db: "products", collection: "" },
       actions: [ "createCollection", "createIndex", "find" ]
     },
     {
       resource: { db: "products", collection: "orders" },
       actions: [ "insert" ]
     }
   ],
   { w: "majority" }
)