Skip to main content

Securing MarkLogic Server

Setting Permissions Explicitly

Assume that the following code snippet is executed as user Ron of the engineering role. The code inserts a document with the following permissions:

  • read and insert permissions for the engineering role

  • update, node-update, and read permissions for the engineering-manager role

...
xdmp:document-insert("/widget.com/engineering/features/2017-q1.xml", 
       <new-features>
         <feature> 
           <name>blue whistle</name>
           <assigned-to>Ron</assigned-to>
           ...
          </feature>
         ...
       </new-features>,
       (xdmp:permission("engineering", "read"), 
        xdmp:permission("engineering", "insert"),
        xdmp:permission("engineering-manager", "read"),
        xdmp:permission("engineering-manager", "update"),
        xdmp:permission("engineering-manager", "node-update"))
...

If you specify permissions to the function call explicitly, as shown above, those permissions override any default permission settings associated with the user (through user settings and role inheritance).

In this section: