Revoke a role from a user or another role

This topic describes how to revoke a role from a user or another role by using the REVOKE statement.

You can revoke one or more roles from one or more users or roles.

Prerequisites

You have the roles to be revoked and the ADMIN OPTION privilege. For information about how to view the roles of a user or role, see View roles.

Notice

The REVOKE statement does not take immediate effect on the current user.

Examples

Revoke a role from a user

• Revoke the employee role from the test1 user.

  obclient [oceanbase]> REVOKE employee FROM test1;
  

• Revoke the employee role from the test1 and test2 users.

  obclient [oceanbase]> REVOKE employee FROM test1,test2 IGNORE UNKNOWN USER;
  

  In this example, the IGNORE UNKNOWN USER clause is used to check whether the specified users exist. Assuming that the test1 or test2 user does not exist, an error is reported if you do not use the clause, or a warning message is returned if you use the clause.

  If the test1 or test2 user does not exist, the revoke operation fails regardless of whether you use the IGNORE UNKNOWN USER clause.

• Revoke the employee and developer roles from the test1 user.

  obclient [oceanbase]> REVOKE IF EXISTS employee,developer FROM test1 IGNORE UNKNOWN USER;
  

  In this example, the IF EXISTS clause is used to check whether the specified roles exist in the tenant. Assuming that the employee or developer role does not exist, an error is reported if you do not use the clause, or a warning message is returned if you use the clause.

  If the employee or developer role does not exist, the revoke operation fails regardless of whether you use the IF EXISTS clause.

Revoke a role from another role

• Revoke the employee role from the role1 role.

  obclient [oceanbase]> REVOKE employee FROM role1;
  

• Revoke the employee role from the role1 and role2 roles.

  obclient [oceanbase]> REVOKE IF EXISTS employee FROM role1,role2;
  

References

• Revoke privileges

• For more information about the REVOKE statement, see REVOKE.