REVOKE ROLE¶
REVOKE ROLE removes one or more role assignments from a user in the current service group.
Prerequisites¶
First connect to the Graph service. Run the command in a GQL client.
To revoke roles from a user, you must have ADMIN in the current service group.
Limitations¶
The ADMIN role is exclusive to the service group owner and cannot be revoked by using REVOKE ROLE.
Syntax¶
- revoke_role_command
revoke_role_command ::=
'REVOKE' 'ROLE' role_name (',' role_name)* 'FROM' 'USER' user_name
Parameters¶
role_name¶
The name of the role to be revoked.
user_name¶
The username whose role assignments are removed.
Examples¶
The example uses the existing role role1 and user user1, who has joined the service group.
REVOKE ROLE role1 FROM USER user1
Check user1's roles with SHOW ROLES FOR USER. The list should no longer include role1. Privileges from other roles or direct grants remain effective.