Database Manual / Reference / Database Commands / Role Management

grantRolesToRole (database command数据库命令)

Definition定义

grantRolesToRole

Grants roles to a user-defined role.将角色授予用户定义的角色。

Tip

In mongosh, this command can also be run through the db.grantRolesToRole() helper method.在mongosh中，此命令也可以通过db.grantRolesToRole()辅助方法运行。

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.助手方法对mongosh用户来说很方便，但它们可能不会返回与数据库命令相同级别的信息。如果不需要便利性或需要额外的返回字段，请使用database命令。

The grantRolesToRole command affects roles on the database where the command runs.grantRolesToRole命令会影响运行该命令的数据库上的角色。

The command has the following syntax:该命令具有以下语法：

db.runCommand(
   {
     grantRolesToRole: "<role>",
     roles: [
                { role: "<role>", db: "<database>" },
                ...
            ],
     writeConcern: { <write concern> },
     comment: <any>
   }
)

The command has the following fields:该命令包含以下字段：

Field字段Type类型Description描述
grantRolesToRolestring字符串The name of a role to add subsidiary roles.要添加辅助角色的角色名称。
rolesarray数组An array of roles from which to inherit.要继承的角色数组。
writeConcerndocument文档Optional. 可选。The level of write concern for the operation. See Write Concern Specification.操作的写入关注级别。请参阅写入关注规范。
commentany任意

Optional. 可选。A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations:用户提供了要附加到此命令的注释。设置后，此注释将与此命令的记录一起出现在以下位置：

A comment can be any valid BSON type (string, integer, object, array, etc).注释可以是任何有效的BSON类型（字符串、整数、对象、数组等）。

In the roles field, you can specify both built-in roles and user-defined roles.在角色字段中，您可以指定内置角色和用户定义的角色。

To specify a role that exists in the same database where grantRolesToRole runs, you can either specify the role with the name of the role:要指定存在于运行grantRolesToRole的同一数据库中的角色，您可以使用角色的名称指定角色：

"readWrite"

Or you can specify the role with a document, as in:或者，您可以在文档中指定角色，如：

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.若要指定存在于其他数据库中的角色，请使用文档指定该角色。

Compatibility兼容性

This command is available in deployments hosted in the following environments:此命令在以下环境中托管的部署中可用：

  • MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud：云中MongoDB部署的完全托管服务

Important

This command is not supported in M0 and Flex clusters. For more information, see Unsupported Commands.M0和Flex集群不支持此命令。有关详细信息，请参阅不支持的命令。

  • MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
  • MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Behavior行为

A role can inherit privileges from other roles in its database. A role created on the admin database can inherit privileges from roles in any database.角色可以继承其数据库中其他角色的权限。在admin数据库上创建的角色可以继承任何数据库中角色的权限。

Required Access所需访问权限

You must have the grantRole action on a database to grant a role on that database.您必须对数据库执行grantRole操作，才能在该数据库上授予角色。

Example示例

The following grantRolesToRole command updates the productsReaderWriter role in the products database to inherit the privileges of the productsReader role in the products database:以下grantRolesToRole命令更新products数据库中的productsReaderWriter角色，以继承products数据库中productsReader角色的权限：

use products
db.runCommand(
   { grantRolesToRole: "productsReaderWriter",
     roles: [
              "productsReader"
     ],
     writeConcern: { w: "majority" , wtimeout: 5000 }
   }
)