To display the privileges granted to the user by the readWrite role on the "accounts" database, issue: 

use accounts db.getRole( "readWrite", { showPrivileges: true } ) 

Step 3: Identify the privileges to grant or revoke. If the user requires additional privileges, grant to the user the role, or roles, with the required set of privileges. If such a role does not exist, create a new role (page 388) with the appropriate set of privileges. 

To revoke a subset of privileges provided by an existing role: revoke the original role and grant a role that contains only the required privileges. You may need to create a new role (page 388) if a role does not exist. 

## Step 4: Modify the user’s access. 

Revoke a Role Revoke a role with the db.revokeRolesFromUser() method. The following example opera- tion removes the readWrite (page 406) role on the accounts database from the reportsUser : 

use reporting db.revokeRolesFromUser( "reportsUser", [ { role: "readWrite", db: "accounts" } ] ) 

Grant a Role Grant a role using the db.grantRolesToUser() method. For example, the following operation grants the reportsUser user the read (page 405) role on the accounts database: 

use reporting db.grantRolesToUser( "reportsUser", [ { role: "read", db: "accounts" } ] ) 

For sharded clusters, the changes to the user are instant on the mongos on which the command runs. How- ever, for other mongos instances in the cluster, the user cache may wait up to 10 minutes to refresh. See userCacheInvalidationIntervalSecs . 

## View Roles 

## Overview 

A role (page 325) grants privileges to the users who are assigned the role. Each role is scoped to a particular database, but MongoDB stores all role information in the admin.system.roles (page 291) collection in the admin database. 

## Prerequisites 

To view a role’s information, you must be explicitly granted the role or must have the viewRole (page 420) action (page 419) on the role’s database. 

