Skip to main content

Securing MarkLogic Server

Create the Documents and Add Permissions

Using the MarkLogic Server Query Console, add a document for each combination of permissions in the following table:

Document

Permissions (Role, Capability)

Users with Access

doc1.xml

(Executive, read)

(Executive, update)

(US, read)

(US, update)

(top-secret, read)

(top-secret, update)

(can-read, read)

(can-read, update)

Don

doc2.xml

(US, read)

(US, update)

(can-read, read)

(can-read, update)

Don and Ellen

doc3.xml

(can-read, read)

(can-read, update)

All users

doc4.xml

(Canada, read)

(US, read)

(US, update)

(can-read, read)

(can-read, update)

Frank, Don, Ellen

doc5.xml

(unclassified, read)

(unclassified, update)

(can-read, read)

(can-read, update)

Ellen, Hannah

  1. You can use XQuery code similar to the following example to insert the sample documents into a database of your choice. This code adds a document with a URI of doc1.xml, containing one <a> element and a set of five permissions.

    xquery version "1.0-ml";
declare namespace html = "http://www.w3.org/1999/xhtml";
xdmp:document-insert(
         "/doc1.xml", <a>This is document 1.</a>,
            (xdmp:permission("can-read", "read"),
             xdmp:permission("can-read", "update"),
             xdmp:permission("US", "read"),
             xdmp:permission("US", "update"),
             xdmp:permission("Executive", "read"),
             xdmp:permission("Executive", "update"),
             xdmp:permission("top-secret", "read"),
             xdmp:permission("top-secret", "update")))

    The doc1.xml document can only be read by Don because the permissions designate all three compartments and Don is the only user with a role in all three of the necessary compartmented roles Executive, US, and top-secret, plus the basic can-read role.

  2. Create the rest of the sample documents changing the sample code as needed. You need to change the document URI and the text to correspond to doc2.xml, doc3.xml, doc4.xml, and doc5.xml and modify the permissions for each document as suggested in the table in Create the Documents and Add Permissions.

In this section: