updateRole (database command数据库命令)

Definition定义

updateRole

Updates a user-defined role. The updateRole command must run on the role's database.更新用户定义的角色。updateRole命令必须在角色的数据库上运行。

Tip

In mongosh, this command can also be run through the db.updateRole() helper method.在mongosh中，此命令也可以通过db.updateRole()辅助方法运行。

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.助手方法对mongosh用户来说很方便，但它们可能不会返回与数据库命令相同级别的信息。如果不需要便利性或需要额外的返回字段，请使用database命令。

An update to a field completely replaces the previous field's values. To grant or remove roles or privileges without replacing all values, use one or more of the following commands:字段的更新将完全替换前一个字段的值。要授予或删除角色或权限而不替换所有值，请使用以下一个或多个命令：

• grantRolesToRole
• grantPrivilegesToRole
• revokeRolesFromRole
• revokePrivilegesFromRole

Warning

An update to the privileges or roles array completely replaces the previous array's values.privileges或roles数组的更新将完全替换前一个数组的值。

Compatibility兼容性

This command is available in deployments hosted in the following environments:此命令在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Syntax语法

To update a role, you must provide the privileges array, roles array, or both.要更新角色，您必须提供privileges数组、roles数组或两者都提供。

The command uses the following syntax:该命令使用以下语法：

db.runCommand(
   {
     updateRole: "<role>",
     privileges:
         [
           { resource: { <resource> }, actions: [ "<action>", ... ] },
           ...
         ],
     roles:
         [
           { role: "<role>", db: "<database>" } | "<role>",
           ...
         ],
     authenticationRestrictions:
         [
           {
             clientSource: ["<IP>" | "<CIDR range>", ...],
             serverAddress: ["<IP>", ...]
           },
           ...
         ]
     writeConcern: <write concern document>,
     comment: <any>
   }
 )

Command Fields命令字段

The command takes the following fields:该命令包含以下字段：

"readWrite"

{ role: "<role>", db: "<database>" }

Behavior行为

A role's privileges apply to the database where the role is created. The role can inherit privileges from other roles in its database. 角色的权限适用于创建该角色的数据库。该角色可以继承其数据库中其他角色的权限。A role created on the admin database can include privileges that apply to all databases or to the cluster and can inherit privileges from roles in other databases.在admin数据库上创建的角色可以包括应用于所有数据库或集群的权限，并且可以继承其他数据库中角色的权限。

Required Access所需访问权限

You must have the revokeRole action on all databases in order to update a role.您必须对所有数据库执行revokeRole操作才能更新角色。

You must have the grantRole action on the database of each role in the roles array to update the array.您必须对角色数组中每个角色的数据库执行grantRole操作才能更新数组。

You must have the grantRole action on the database of each privilege in the privileges array to update the array. 您必须对privileges数组中每个权限的数据库执行grantRole操作才能更新数组。If a privilege's resource spans databases, you must have grantRole on the admin database. A privilege spans databases if the privilege is any of the following:如果权限的资源跨越数据库，则必须在admin数据库上具有grantRole。如果权限是以下任何一种，则该权限跨越数据库：

• a collection in all databases所有数据库中的集合
• all collections and all database所有集合和所有数据库
• the cluster resourcecluster资源

You must have the setAuthenticationRestriction action on the database of the target role to update a role's authenticationRestrictions document.您必须对目标角色的数据库执行setAuthenticationRestriction操作，才能更新角色的authenticationRestrictions文档。

Example示例

The following is an example of the updateRole command that updates the myClusterwideAdmin role on the admin database. 以下是updateRole命令的示例，该命令更新管理数据库上的myClusterwideAdmin角色。While the privileges and the roles arrays are both optional, at least one of the two is required:虽然privileges和roles数组都是可选的，但至少需要其中之一：

db.adminCommand(
   {
     updateRole: "myClusterwideAdmin",
     privileges:
         [
           {
             resource: { db: "", collection: "" },
             actions: [ "find" , "update", "insert", "remove" ]
           }
         ],
     roles:
         [
           { role: "dbAdminAnyDatabase", db: "admin" }
         ],
     writeConcern: { w: "majority" }
   }
)

To view a role's privileges, use the rolesInfo command.要查看角色的权限，请使用rolesInfo命令。