Docs Home → MongoDB Manual

db.grantPrivilegesToRole()

On this page本页内容

Definition定义

db.grantPrivilegesToRole(rolename, privileges, writeConcern)

Grants additional privileges to a user-defined role.向用户定义的角色授予额外权限。

Important

mongosh Method

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.

For the database command, see the grantPrivilegesToRole command.

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.

For the legacy mongo shell documentation, refer to the documentation for the corresponding MongoDB Server release:

mongo shell v4.4

The db.grantPrivilegesToRole() method uses the following syntax:db.grantPrivilegesToRole()方法使用以下语法：

db.grantPrivilegesToRole(
    "< rolename >",
    [
        { resource: { <resource> }, actions: [ "<action>", ... ] },
        ...
    ],
    { < writeConcern > }
)

The db.grantPrivilegesToRole() method takes the following arguments:db.grantPrivilegesToRole()方法采用以下参数：

Parameter参数Type类型Description描述
rolenamestringThe name of the role to grant privileges to.要授予权限的角色的名称。
privilegesarrayThe privileges to add to the role. 要添加到角色的权限。For the format of a privilege, see privileges.有关权限的格式，请参阅privileges。
writeConcerndocumentOptional.可选的。The level of write concern for the operation. See Write Concern Specification. 操作的写入关注级别。请参阅写入关注规范。

The db.grantPrivilegesToRole() method can grant one or more privileges. Each <privilege> has the following syntax:db.grantPrivilegesToRole()方法可以授予一个或多个权限。每个<privilege>都有以下语法：

{ resource: { <resource> }, actions: [ "<action>", ... ] }

Behavior行为

Replica set副本集

If run on a replica set, db.grantPrivilegesToRole() is executed using "majority" write concern by default.如果在副本集上运行，db.grantPrivilegesToRole()默认情况下使用"majority"写入关注执行。

Scope范围

Except for roles created in the admin database, a role can only include privileges that apply to its database除了在admin数据库中创建的角色外，角色只能包括应用于其数据库的权限

A role created in the admin database can include privileges that apply to the admin database, other databases or to the cluster resource.在admin数据库中创建的角色可以包括应用于admin数据库、其他数据库或集群资源的权限。

Required Access所需访问权限

You must have the grantRole action on the database a privilege targets in order to grant the privilege. 必须对权限目标数据库执行grantRole 操作才能授予权限。To grant a privilege on multiple databases or on the cluster resource, you must have the grantRole action on the admin database.要在多个数据库或cluster资源上授予权限，必须对admin数据库执行grantRole操作。

Example实例

The following db.grantPrivilegesToRole() operation grants two additional privileges to the role inventoryCntrl01, which exists on the products database. 以下db.grantPrivilegesToRole()操作为角色inventoryCntrl01授予两个额外的权限，该角色存在于products数据库中。The operation is run on that database:操作在该数据库上运行：

use products
db.grantPrivilegesToRole(
  "inventoryCntrl01",
  [
    {
      resource: { db: "products", collection: "" },
      actions: [ "insert" ]
    },
    {
      resource: { db: "products", collection: "system.js" },
      actions: [ "find" ]
    }
  ],
  { w: "majority" }
)

The first privilege permits users with this role to perform the insert action on all collections of the products database, except the system collections. 第一个权限允许具有此角色的用户对products数据库的所有集合（系统集合除外）执行insert 操作。To access a system collection, a privilege must explicitly specify the system collection in the resource document, as in the second privilege.要访问系统集合，权限必须在资源文档中显式指定系统集合，就像第二个权限一样。

The second privilege permits users with this role to perform the find action on the product database's system collection named system.js.第二个权限允许具有此角色的用户对名为system.js的product数据库的系统集合执行find 操作。