db.updateRole()¶

Definition定义¶

db.updateRole(rolename, update, writeConcern)¶

Updates a user-defined role. 更新用户定义的角色。The db.updateRole() method must run on the role’s database.db.updateRole()方法必须在角色的数据库上运行。

An update to a field completely replaces the previous field’s values. 对字段的更新会完全替换上一个字段的值。To grant or remove roles or privileges without replacing all values, use one or more of the following methods:要在不替换所有值的情况下授予或删除角色或权限，请使用以下一种或多种方法：

• db.grantRolesToRole()
• db.grantPrivilegesToRole()
• db.revokeRolesFromRole()
• db.revokePrivilegesFromRole()

Warning

An update to the privileges or roles array completely replaces the previous array’s values.对privileges或roles数组的更新将完全替换上一个数组的值。

The updateRole() method uses the following syntax:updateRole()方法使用以下语法：

db.updateRole(
    "<rolename>",
    {
      privileges:
          [
            { resource: { <resource> }, actions: [ "<action>", ... ] },
            ...
          ],
      roles:
          [
            { role: "<role>", db: "<database>" } | "<role>",
            ...
          ],
      authenticationRestrictions:
          [
            {
              clientSource: ["<IP>" | "<CIDR range>", ...],
              serverAddress: ["<IP>", | "<CIDR range>", ...]
            },
            ...
          ]
    },
    { <writeConcern> }
)

The db.updateRole() method accepts the following arguments:db.updateRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
rolename	string	The name of the user-defined role to update.要更新的用户定义角色的名称。
update	document	A document containing the replacement data for the role. 包含角色替换数据的文档。This data completely replaces the corresponding data for the role.此数据完全替换角色的相应数据。
writeConcern	document	Optional.可选。The level of write concern for the update operation. 更新操作的写入关注级别。The writeConcern document takes the same fields as the getLastError command.writeConcern文档采用与getLastError命令相同的字段。

The update document specifies the fields to update and the new values. update文档指定要更新的字段和新值。Each field in the update document is optional, but the document must include at least one field. update文档中的每个字段都是可选的，但文档必须至少包含一个字段。The update document has the following fields:update文档包含以下字段：

Field字段	Type类型	Description描述
privileges	array	Optional.可选。Required if you do not specify roles array. 如果未指定roles数组，则为必填项。The privileges to grant the role. 授予角色的权限。An update to the privileges array overrides the previous array’s values. 对privileges数组的更新会覆盖上一个数组的值。For the syntax for specifying a privilege, see the privileges array.有关指定权限的语法，请参阅privileges数组。
roles	array	Optional.可选。Required if you do not specify privileges array. 如果未指定privileges数组，则为必填项。The roles from which this role inherits privileges. 此角色从中继承权限的角色。An update to the roles array overrides the previous array’s values.对roles数组的更新会覆盖上一个数组的值。
authenticationRestrictions	array	Optional.可选。 The authentication restrictions the server enforces on the role. 服务器对角色实施的身份验证限制。Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from.指定授予此角色的用户可以连接和/或可以连接的IP地址和CIDR范围的列表。 New in version 3.6.版本3.6中的新功能。

The db.updateRole() method wraps the updateRole command.db.updateRole()方法包装updateRole命令。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为¶

Required Access所需访问权限¶

You must have the revokeRole action on all databases in order to update a role.要更新角色，必须对所有数据库执行revokeRole操作。

You must have the grantRole action on the database of each role in the roles array to update the array.必须对角色数组中每个角色的数据库执行grantRole操作才能更新数组。

You must have the grantRole action on the database of each privilege in the privileges array to update the array. 必须对权限数组中每个权限的数据库执行grantRole操作才能更新该数组。If a privilege’s resource spans databases, you must have grantRole on the admin database. 如果权限的资源跨越数据库，则必须在admin数据库上具有grantRole。A privilege spans databases if the privilege is any of the following:如果权限是以下任一项，则权限跨越数据库：

• a collection in all databases所有数据库中的集合
• all collections and all database所有集合和所有数据库
• the cluster resourcecluster资源

You must have the setAuthenticationRestriction action on the database of the target role to update a role’s authenticationRestrictions document.必须对目标角色的数据库执行setAuthenticationRestriction操作，才能更新角色的authenticationRestrictions文档。

Example示例¶

The following db.updateRole() method replaces the privileges and the roles for the inventoryControl role that exists in the products database. 以下db.updateRole()方法替换产品数据库中存在的inventoryControl角色的privileges和roles。The method runs on the database that contains inventoryControl:该方法在包含inventoryControl的数据库上运行：

use products
db.updateRole(
    "inventoryControl",
    {
      privileges:
          [
            {
              resource: { db:"products", collection:"clothing" },
              actions: [ "update", "createCollection", "createIndex"]
            }
          ],
      roles:
          [
            {
              role: "read",
              db: "products"
            }
          ]
    },
    { w:"majority" }
)

To view a role’s privileges, use the rolesInfo command.要查看角色的权限，请使用rolesInfo命令。