db.grantRolesToRole()¶

On this page

Definition
Behavior
Required Access
Example

Definition¶

db.grantRolesToRole(rolename, roles, writeConcern)¶

The grantRolesToRole method uses the following syntax:

db.grantRolesToRole( "<rolename>", [ <roles> ], { <writeConcern> } )

The grantRolesToRole method takes the following arguments:

Parameter	Type	Description
`rolename`	string	The name of the role to which to grant sub roles.
`roles`	array	An array of roles from which to inherit.
`writeConcern`	document	Optional. The level of write concern for the modification. The `writeConcern` document takes the same fields as the `getLastError` command.

In the roles field, you can specify both built-in roles and user-defined role.

To specify a role that exists in the same database where db.grantRolesToRole() runs, you can either specify the role with the name of the role:

copy

"readWrite"

Or you can specify the role with a document, as in:

copy

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.

The db.grantRolesToRole() method wraps the grantRolesToRole command.

Behavior¶

Replica set¶

If run on a replica set, db.grantRolesToRole() is executed using majority write concern by default.

Scope¶

A role can inherit privileges from other roles in its database. A role created on the admin database can inherit privileges from roles in any database.

Required Access¶

You must have the grantRole action on a database to grant a role on that database.

Example¶

The following grantRolesToRole() operation updates the productsReaderWriter role in the products database to inherit the privileges of productsReader role:

copy

use products
db.grantRolesToRole(
    "productsReaderWriter",
    [ "productsReader" ],
    { w: "majority" , wtimeout: 5000 }
)

← db.revokePrivilegesFromRole() db.revokeRolesFromRole() →