Skip to main content

Securing MarkLogic Server

Using Pseudo-functions with Granular Privileges

When you have a payload that creates a database and a granular privilege for that database, you need to substitute a variable of some sort for the ID of the database because the database has yet to be created. MarkLogic Server has the following pseudo-functions that can be used when creating and assigning granular privileges:

Pseudo-Function and Parameters

Replaced By...

$$group-id(group-name)

The group ID of the named group.

$$database-id(database-name)

The database ID of the named database.

$$host-id()

The host ID of the host running the query.

$$host-id(host-name)

The host ID of the named host.

$$forest-id(forest-name)

The forest ID of the named forest.

$$cluster-id()

The cluster ID of the cluster to which the host running the query belongs.

$$cluster-id(cluster-name)

The cluster ID of the named cluster.

$$role-id(role-name)

The role ID of the named role.

$$user-id(user-name)

The user ID of the named user.

$$server-id(server-name)

The server ID of the named server in the group to which the host running the query belongs.

$$server-id("server-name", group-id)

The server ID of the named server in the specified group. Note that group-id is an unsigned long. To refer to the group by name as well, nest the calls:

$$server-id(server-name, $$group-id(group-name))

$$privilege-id("privilege-name")

The privilege ID of the named /execute/ privilege.

$$privilege-id("privilege-name", "execute")

The privilege ID of the named execute privilege.

$$privilege-id("privilege-name", "uri")

The privilege ID of the named URI privilege.

For example, to create the privilege finalDbName-index-editor for a not-yet-created database represented by the variable FinalDbName, execute the following code:

{
    "privilege-name": "finalDbName-index-editor",
    "action": "http://marklogic.com/xdmp/privileges/admin/database/index/$$database-id(FinalDbName)",
    "role": ["firstEditorRole","secondEditorRole"],
    "kind": "execute"
  }
In this section: