Securing MarkLogic Server

/foo/bar

(role1, read)

Element “bar” is readable by “role1” but concealed for all other roles. No mention of other permissions means that others can update or insert content for this element.

/foo/bar

(role1, read)

(role2, read)

Element “bar” is readable by “role1” or “role2” but concealed for all other roles. No mention of other permissions means that others can update or insert content for this element.

/foo/bar

(role1, read)

(role1, update)

Element “bar” is readable by “role1” but concealed for all other roles. “Role1” can update the element. No mention of insert permissions means that others can insert content for this element.

/foo/bar[@attr= “test”]

(role1, read)

(role1, update)

Same as above except that it only applies to a bar element if the element has an attribute “attr” with the value “test”. No mention of insert permissions means that others can insert content for this element.

bar

(role1, read)

This is the simplest path. Element “bar” is readable by “role 1” but concealed for all other roles. This applies to all “bar” elements. No mention of other permissions means that others can update or insert content for this element.

/root/reg[fn:matches(@expr, 'is')]

(role1, read)

(role1, update)

Elements that match the regular express for ‘is” will be readable by “role 1” but concealed for all other roles. “Role 1” can update the element. No mention of insert permissions means that others can insert content for this element.