"actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ] } ], "inheritedPrivileges" : [ { "resource": { "db" : "products", "collection" : "" }, "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ] }, { "resource" : { "db" : "products", "collection" : "system.js" }, "actions": [ "collStats","dbHash","dbStats","find","killCursors","planCacheRead" ] } ] 

## Modify a User’s Access 

## Overview 

When a user’s responsibilities change, modify the user’s access to include only those roles the user requires. This follows the policy of least privilege . 

To change a user’s access, first determine the privileges the user needs and then determine the roles that grants those privileges. Grant and revoke roles using the db.grantRolesToUser() and db.revokeRolesFromUser() methods. 

For an overview of roles and privileges, see Authorization (page 324). For descriptions of the access each built-in role provides, see the section on built-in roles (page 405). 

## Prerequisites 

You must have the grantRole (page 420) action (page 419) on a database to grant a role on that database. 

You must have the revokeRole (page 420) action (page 419) on a database to revoke a role on that database. 

To view a role’s information, you must be explicitly granted the role or must have the viewRole (page 420) action (page 419) on the role’s database. 

## Procedure 

Step 1: Connect to MongoDB with the appropriate privileges. Connect to mongod or mongos as a user with the privileges specified in the prerequisite section. 

The following procedure uses the siteUserAdmin created in Create a User Administrator (page 384). 

mongo --port 27017 -u siteUserAdmin -p password --authenticationDatabase admin 

Step 2: Identify the user’s roles and privileges. To display the roles and privileges of the user to be modified, use the db.getUser() and db.getRole() methods. 

For example, to view roles for reportsUser created in Add a User to a Database (page 386), issue: 

use reporting db.getUser("reportsUser") 

