db.updateRole()

Definition定义

db.updateRole( rolename, update, writeConcern )

Updates a user-defined role. 更新用户定义的角色。The db.updateRole() method must run on the role's database.db.updateRole()方法必须在角色的数据库上运行。

Important

mongosh Method

This page documents a mongosh method. This is not the documentation for database commands or language-specific drivers, such as Node.js.

For the database command, see the updateRole command.

For MongoDB API drivers, refer to the language-specific MongoDB driver documentation.

For the legacy mongo shell documentation, refer to the documentation for the corresponding MongoDB Server release:

mongo shell v4.4

An update to a field completely replaces the previous field's values. 字段的更新将完全替换上一个字段的值。To grant or remove roles or privileges without replacing all values, use one or more of the following methods:要在不替换所有值的情况下授予或删除角色或权限，请使用以下一种或多种方法：

• db.grantRolesToRole()
• db.grantPrivilegesToRole()
• db.revokeRolesFromRole()
• db.revokePrivilegesFromRole()

Warning

An update to the privileges or roles array completely replaces the previous array's values.privileges或roles数组的更新将完全替换以前数组的值。

The db.updateRole() method uses the following syntax:db.updateRole()方法使用以下语法：

db.updateRole(
    "<rolename>",
    {
      privileges:
          [
            { resource: { <resource> }, actions: [ "<action>", ... ] },
            ...
          ],
      roles:
          [
            { role: "<role>", db: "<database>" } | "<role>",
            ...
          ],
      authenticationRestrictions:
          [
            {
              clientSource: ["<IP>" | "<CIDR range>", ...],
              serverAddress: ["<IP>", | "<CIDR range>", ...]
            },
            ...
          ]
    },
    { <writeConcern> }
)

The db.updateRole() method accepts the following arguments:db.updateRole()方法接受以下参数：

Parameter参数	Type类型	Description描述
rolename	string	The name of the user-defined role to update.要更新的用户定义角色的名称。
update	document	A document containing the replacement data for the role. 包含角色的替换数据的文档。This data completely replaces the corresponding data for the role.此数据完全替换角色的相应数据。
writeConcern	document	Optional.可选的。The level of write concern for the operation. 操作的写入关注级别。See Write Concern Specification.请参阅写入关注规范。

The update document specifies the fields to update and the new values. update文档指定要更新的字段和新值。Each field in the update document is optional, but the document must include at least one field. The update document has the following fields:更新文档中的每个字段都是可选的，但文档必须至少包含一个字段。update文档包含以下字段：

Field字段	Type类型	Description描述
privileges	array	Optional.可选的。Required if you do not specify roles array. 如果未指定roles数组，则为必需。The privileges to grant the role. 授予角色的权限。An update to the privileges array overrides the previous array's values. 权限数组的更新将覆盖上一个数组的值。For the syntax for specifying a privilege, see the privileges array.有关指定权限的语法，请参阅privileges数组。
roles	array	Optional.可选的。Required if you do not specify privileges array. 如果未指定privileges数组，则为必需。The roles from which this role inherits privileges. 此角色从中继承权限的角色。An update to the roles array overrides the previous array's values.对角色数组的更新将覆盖上一个数组的值。
authenticationRestrictions	array	Optional.可选的。 The authentication restrictions the server enforces on the role. 服务器对角色强制执行的身份验证限制。Specifies a list of IP addresses and CIDR ranges users granted this role are allowed to connect to and/or which they can connect from. 指定允许授予此角色的用户连接到和/或可以从中连接的IP地址和CIDR范围的列表。

The db.updateRole() method wraps the updateRole command.db.updateRole()方法包装updateRole命令。

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

Required Access所需访问权限

You must have the revokeRole action on all databases in order to update a role.必须对所有数据库执行revokeRole 操作才能更新角色。

You must have the grantRole action on the database of each role in the roles array to update the array.必须对roles数组中每个角色的数据库执行grantRole 操作才能更新数组。

You must have the grantRole action on the database of each privilege in the privileges array to update the array. 必须对权限数组中每个权限的数据库执行grantRole 操作才能更新数组。If a privilege's resource spans databases, you must have grantRole on the admin database. 如果权限的资源跨越数据库，则必须在admin数据库上具有grantRole。A privilege spans databases if the privilege is any of the following:如果权限是以下任意一种，则该权限将跨越数据库：

• a collection in all databases所有数据库中的集合
• all collections and all database所有集合和所有数据库
• the cluster resourcecluster资源

You must have the setAuthenticationRestriction action on the database of the target role to update a role's authenticationRestrictions document.必须对目标角色的数据库执行setAuthenticationRestriction 操作，才能更新角色的authenticationRestrictions文档。

Example实例

The following db.updateRole() method replaces the privileges and the roles for the inventoryControl role that exists in the products database. The method runs on the database that contains inventoryControl:以下db.updateRole()方法将替换products数据库中存在的inventoryControl角色的privileges和roles。该方法在包含inventoryControl的数据库上运行：

use products
db.updateRole(
    "inventoryControl",
    {
      privileges:
          [
            {
              resource: { db:"products", collection:"clothing" },
              actions: [ "update", "createCollection", "createIndex"]
            }
          ],
      roles:
          [
            {
              role: "read",
              db: "products"
            }
          ]
    },
    { w:"majority" }
)

To view a role's privileges, use the rolesInfo command.要查看角色的权限，请使用rolesInfo命令。