Roles
MarkLogic Server implements a role-base security model. Therefore, the Role is a central security concept in MarkLogic Server. A role gives a user privileges (both Execute and URI) to perform certain actions in a system. An Execute Privilege allows a user to perform a protected action. A URI Privilege allows a user to create a document under a protected URI. A role also gives a user the permissions to access protected documents.
A role may inherit from multiple roles. The inheritance relationship for roles is an “is-a” relationship. Therefore, a role gets the privileges and permissions of the roles from which they inherit.
MarkLogic Server is installed with the following pre-defined roles:
Role |
Description |
|---|---|
admin |
This role has the privileges and permissions needed to perform administrative tasks. This role has the highest level of access in the system. |
admin-builtins |
This role has the privileges needed to call the admin-builtins functions. |
filesystem-access |
This role has the privileges to access the filesystem. |
merge |
This role has the privileges needed to force a merge in the system. |
security |
This role has the privileges to perform all the security-related administrative functions. |
While you are able to change the configuration settings of these pre-defined roles (except for the admin role) or delete any of them, we strongly recommend that you proceed with caution.
A role has default collections. When a user of a role creates a document but does not explicitly associate the document with a set of collections, the document is automatically added to a set of default collections. This set of default collections is the union of the default collections defined for the user, the roles the user has, and the roles from which the user’s directly assigned roles inherit.
A role has default permissions. When a user of a role creates a document but does not explicitly set the permissions for the document, the document will be given a set of default permissions. This set of default permissions is the union of the default permissions defined for the user, the roles the user has, and the roles from which the user’s directly assigned roles inherit.
For more details about the role-based security model in MarkLogic Server, see Securing MarkLogic Server.