revokeRolesFromRole (database command数据库命令)

Definition定义

revokeRolesFromRole

Removes the specified inherited roles from a role.从角色中删除指定的继承角色。

Tip

In mongosh, this command can also be run through the db.revokeRolesFromRole() helper method.在mongosh中，此命令也可以通过db.revokeRolesFromRole()辅助方法运行。

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. 助手方法对mongosh用户来说很方便，但它们可能不会返回与数据库命令相同级别的信息。In cases where the convenience is not needed or the additional return fields are required, use the database command.如果不需要便利性或需要额外的返回字段，请使用database命令。

Compatibility兼容性

This command is available in deployments hosted in the following environments:此命令在以下环境中托管的部署中可用：

• MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud：云中MongoDB部署的完全托管服务

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Syntax语法

The command has the following syntax:该命令具有以下语法：

db.runCommand(
   {
     revokeRolesFromRole: "<role>",
     roles: [
       { role: "<role>", db: "<database>" } | "<role>",
       ...
     ],
     writeConcern: { <write concern> },
     comment: <any>
   }
)

Command Fields命令字段

The command has the following fields:该命令包含以下字段：

In the roles field, you can specify both built-in roles and user-defined roles.在roles字段中，您可以指定内置角色和用户定义的角色。

To specify a role that exists in the same database where revokeRolesFromRole runs, you can either specify the role with the name of the role:要指定存在于运行revokeRolesFromRole的同一数据库中的角色，您可以使用角色的名称指定角色：

"readWrite"

Or you can specify the role with a document, as in:或者，您可以在文档中指定角色，如：

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.若要指定存在于其他数据库中的角色，请使用文档指定该角色。

Required Access所需访问权限

You must have the revokeRole action on a database to revoke a role on that database.您必须对数据库执行revokeRole操作才能撤销该数据库上的角色。

Example示例

The purchaseAgents role in the emea database inherits privileges from several other roles, as listed in the roles array:emea数据库中的purchaseAgents角色继承了其他几个角色的权限，如roles数组中所列：

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readOrdersCollection",
         "db" : "emea"
      },
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      },
      {
         "role" : "writeOrdersCollection",
         "db" : "emea"
      }
   ]
}

The following revokeRolesFromRole operation on the emea database removes two roles from the purchaseAgents role:以下对emea数据库的revokeRolesFromRole操作将从purchaseAgents角色中删除两个角色：

use emea
db.runCommand( { revokeRolesFromRole: "purchaseAgents",
                 roles: [
                          "writeOrdersCollection",
                          "readOrdersCollection"
                        ],
                  writeConcern: { w: "majority" , wtimeout: 5000 }
             } )

The purchaseAgents role now contains just one role:purchaseAgents角色现在只包含一个角色：

{
   "_id" : "emea.purchaseAgents",
   "role" : "purchaseAgents",
   "db" : "emea",
   "privileges" : [],
   "roles" : [
      {
         "role" : "readAccountsCollection",
         "db" : "emea"
      }
   ]
}