grantRolesToRole
Definition
grantRolesToRole
- Grants roles to a user-defined role.
The grantRolesToRole
command affects roles on thedatabase where the command runs. grantRolesToRole
hasthe following syntax:
- { grantRolesToRole: "<role>",
- roles: [
- { role: "<role>", db: "<database>" },
- ...
- ],
- writeConcern: { <write concern> }
- }
The grantRolesToRole
command has the following fields:
FieldTypeDescriptiongrantRolesToRole
stringThe name of a role to add subsidiary roles.roles
arrayAn array of roles from which to inherit.writeConcern
documentOptional. The level of write concern for themodification. The writeConcern
document takes the samefields as the getLastError
command.
In the roles
field, you can specify bothbuilt-in roles and user-definedroles.
To specify a role that exists in the same database wheregrantRolesToRole
runs, you can either specify the role with the name ofthe role:
- "readWrite"
Or you can specify the role with a document, as in:
- { role: "<role>", db: "<database>" }
To specify a role that exists in a different database, specify the rolewith a document.
Behavior
A role can inherit privileges from other roles in its database. A rolecreated on the admin
database can inherit privileges from roles inany database.
Required Access
You must have the grantRole
action on a database to grant a role on that database.
Example
The following grantRolesToRole
command updates theproductsReaderWriter
role in the products
database to inherit the privileges of the productsReader
role in the products
database:
- use products
- db.runCommand(
- { grantRolesToRole: "productsReaderWriter",
- roles: [
- "productsReader"
- ],
- writeConcern: { w: "majority" , wtimeout: 5000 }
- }
- )