MarkLogic Server 11.0 Product Documentation

Administrator's Guide — Chapter 24

Creating a User

Follow these steps to create a user:

1. Click the Security icon in the left tree menu.
2. Click the Users icon.
3. Click the Create tab. The User Configuration page appears:

   

4. Enter a name for the user in the username field.
5. Enter the description for the user (optional).
6. Enter a password for the user.
7. Re-enter the password to confirm it.
8. If the user is to be authorized externally by LDAP or Kerberos, enter one or more Distinguished Names (LDAP) or User Principals (Kerberos) in the External Names section. For details on external authorization, see the External Security chapter in the Security Guide.
9. Under the roles section, check the roles to assign the user.
10. Create default permissions for this user (optional). Select a role and pair the role with the appropriate capability (read, insert, update). If there are more than 3 default permissions you want to add for this user, you can do so on the next screen after you click OK.
11. Create default collections for this user (optional). Type in the collection URI for each collection you want to add to the user's default collection. If there are more than 3 default collections you want to add for this user, you can do so on the next screen after you click OK.
12. Click OK.

The user is now added to the system and the user configuration page appears. If you want to add more default permissions or collections to the user, scroll down to the section for default permissions or collections.

Viewing a User Configuration

Perform the following steps to view a user's configuration:

1. Click the Security icon in the left tree menu.
2. Click the Users icon.
3. Locate the name of the user whose settings you want to view, either on the tree menu or on the summary page.
4. Click the name. The user configuration page appears where you can view the user's configuration:

   

Modifying a User Configuration

Perform the following steps to modify the configuration for a user:

1. For the user to which you want to modify, view that user's configuration as described in Viewing a User Configuration.
2. Perform any modifications needed to the user's configuration. Modifications might include changing any of the user credentials (including password), adding or removing role assignments, adding or removing default permission settings, or adding or removing default collection settings.

   Making changes to the to the user configuration affects the access control policy for that user, which can either increase or decrease the activities authorized for the user. For more details on how the security system works, see Security Guide.

3. Click OK to save the changes.

The new changes are in effect for all transactions beginning after the user changes are committed.

Deleting a User

Perform the following steps to delete a user from the security database:

1. Click the Security icon in the left tree menu.
2. Click the Users icon.
3. Locate the user you want to delete, either on the tree menu or on the summary page.
4. Click the user name.
5. Click on the Delete button.
6. Click OK to confirm deleting the user.

The user is permanently deleted from the security database.

Creating a Role

Perform the following steps to create a role.

1. Click the Security icon in the left tree menu.
2. Click the Roles icon.
3. Click the Create tab. The Role Configuration page appears:

   

4. Type in a name for role in the role name field.
5. Type in a description for the role (optional).
6. If you want to place the role into the named compartment, enter name of the compartment in the Compartment field. If a document has any permissions (role/capability pairs) with roles that have a compartment, then the user must have those roles with each of the compartments (regardless of which permission they are in) to perform any of the capabilities.
7. If the role is to be mapped to an LDAP group, enter one or more group names in the External Names section. For details on external authorization, see the External Security chapter in the Security Guide.
8. Under the roles section, select the roles from which this role will inherit.
9. Under the execute privileges section, select from the available execute privileges to be associated with the role.
10. Under the URI privileges section, select from the available URI privileges to be associated with the role.
11. Create default permissions for this role (optional). Select a role and pair the role with the appropriate capability (read, insert, update). If there are more than 3 default permissions you want to add for this role, you can do so on the next screen after you click OK.
12. Create default collections for this role (optional). Type in the collection URI for each collection you want to add to the role's default collections. If there are more than 3 default permissions you want to add for this user, you can do so on the next screen after you click OK.
13. Click OK.

The role is now added to the system and the Role Configuration page appears. If you want to add more default permissions or collections to the role, scroll down to the section for default permissions or collections.

Viewing a Role

Perform the following steps to create a role.

1. Click the Security icon in the left tree menu.
2. Click the Roles icon.
3. Click the name of the role you want to view, either on the tree menu or on the summary page. The Role Configuration page appears.

   

View the configuration for the role.

Modifying a Role Configuration

Perform the following steps to modify a role configuration:

1. For the role to which you want to modify, view the role configuration as described in Viewing a Role.
2. Perform any modifications needed to the role configuration. Modifications might include adding or removing role assignments, adding or removing default permission settings, or adding or removing default collection settings.

   Making changes to the to the role configuration affects the access control policy for that role, which can either increase or decrease the activities authorized for any users who have that role (either directly or indirectly). For more details on how the security system works, see Security Guide.

3. Click OK to save the changes.

The new changes are in effect for all transactions beginning after the user changes are committed.

Deleting a Role

You can delete a role from the security database. The system does not check to see if there are any users with that role before deleting it. A deleted role is automatically removed from all users still assigned to that role. Users who were assigned to the deleted role lose the permissions and privileges given by that role.

Perform the following steps to delete a role.

1. Click the Security icon in the left tree menu.
2. Click the Roles icon.
3. Click the name of the role you want to delete, either on the tree menu or on the summary page.
4. Click the Delete button.
5. Click OK to confirm deleting the role.

The role is now deleted from the security database.

Creating an Execute Privilege

Perform the following steps to create an execute privilege:

1. Click the Security icon in the left tree menu.
2. Click on the Execute Privileges icon.
3. Click the Create tab. The Execute Privilege Configuration page appears:

   

4. Enter the name of the execute privilege. Use a name that is descriptive of the action this execute privilege will protect. For example, create-user is the name of an execute privilege that gives a role the authorization to create a user.
5. Enter a protected action, represented as a URI. You can use any URI but we recommend you follow the conventions for your company. For example, the URI for the create-user execute privilege is http://marklogic.com/xdmp/privileges/create-user.
6. Under the roles section, select the roles that are allowed to perform the protected action.
7. Click OK.

The execute privilege is now added to the security database. You can now use the xdmp:security-assert() function in your code to associate this privilege with a protected operation.

Execute Privilege: grant-my-privilege

In MarkLogic 10.0-3 and later, the grant my privilege feature be used as part of Executive Privileges to assign some privileges to roles. In the context of Data Hub Service, non-admin users (users with the manage role but not admin, Security, or manage-admin roles) need to be able to assign some privileges to roles so that they become available to the users in possession of those roles.

A user with the grant-my-privileges privilege can assign privileges that they already possess to roles that they are allowed to modify. This feature works in conjunction with the data roles feature. The grant-my-privileges privilege is useless in isolation, as its only purpose is to assign privileges to roles.

To access the grant-my-privilege feature in the Admin UI:

1. Click the Security icon in the left tree menu.
2. Click on the Execute Privileges icon.
3. Scroll down on this page to find grant-my-privileges and click on the link.

The Execute Privilege: grant-my-privileges screen opens, where you can select the roles assigned this privilege.

1. Select the roles to assign to the privilege.
2. Click ok when you are done to save the changes.

The precise set of privileges that a user can assign is determined by the privileges that they already possess. It is not possible for a user to assign a privilege that they do not possess (admin, for example). If a user attempts to change the privileges associated with a role, the request will succeed if (and only if) the following conditions apply:

• The user has the grant-my-privileges privilege. A user without this privilege cannot make any changes to the privileges associated with a role.
• The user has the create-data-roles privilege and the necessary granular edit privilege for the role that they are modifying. Without these privileges, they cannot modify the role.
• The user possesses all of the privileges that they are attempting to add or remove from the role.

Viewing an Execute Privilege

Perform the following steps to view an execute privilege:

1. Click the Security icon in the left tree menu.
2. Click the Execute Privileges icon. The Execute Privileges Summary page appears:

   

3. Click on the name of the execute privilege that you want to view.
4. View the configuration for the execute privilege.

Modifying an Execute Privilege

Perform the following steps to modify an execute privilege:

1. For the privilege to which you want to modify, view the configuration as described in Viewing an Execute Privilege.
2. Perform any modifications needed to the privilege (for example, add or remove role assignments).

   Making changes to the to the execute privilege configuration affects the access control policy for that privilege, which can either increase or decrease the activities authorized for any users who have any of assigned roles (either directly or indirectly). For more details on how the security system works, see Security Guide.

3. Click OK to save the changes.

The new changes are in effect for all transactions beginning after the user changes are committed.

Deleting an Execute Privilege

You can delete an execute privilege from the security database. However, an exception will be thrown when a security-assert() on the protected action specified in the deleted execute privilege is encountered. That is, a deleted execute privilege behaves like an execute privilege for which no role has been given access to the protected action. Follow these steps to delete an execute privilege:

1. Click the Security icon in the left tree menu.
2. Click the Execute Privileges icon. The Execute Privileges Summary page appears:

   

3. Click the name of the execute privilege that you want to delete.
4. On the Execute Privileges page for the given privilege, click the Delete button.
5. Click OK to confirm deleting the execute privilege.

The execute privilege is now deleted from the security database.

Creating a URI Privilege

Perform the following steps to create a URI privilege:

1. Click the Security icon in the left tree menu.
2. Click the URI Privileges icon.
3. Click on the Create tab. The URI Privilege Configuration page appears:
4. Enter the name of the URI privilege. Use a name that is descriptive of the base URI to be protected. For example, to restrict the creation of documents under a base URI reserved for the accounting group, you might use the name accounting_files.
5. In the action field, enter the base URI to be protected. While the base URI does not have to map to an actual directory, it should follow the directory structure convention (for example, /myfiles/accounting_files). In this example, only the user with this URI privilege can create a file with the URI /myfiles/accounting_files/account1.xml.
6. Under the roles section, select the roles that are allowed to create documents under the base URI.
7. Click OK.

The URI privilege is created and added to the security database.

Viewing a URI Privilege

Perform the following steps to view a URI privilege:

1. Click the Security icon in the left tree menu.
2. Click the URI Privileges icon. The URI Privileges Summary Page appears:

   

3. Click the name of the URI privilege you want to view.
4. View the URI privilege.

Modifying a URI Privilege

Perform the following steps to modify an execute privilege:

1. For the privilege to which you want to modify, view the configuration as described in Viewing a URI Privilege.
2. Perform any modifications needed to the privilege (for example, add or remove role assignments).

   Making changes to the to the URI privilege configuration affects the access control policy for that privilege, which can either increase or decrease the activities authorized for any users who have any of assigned roles (either directly or indirectly). For more details on how the security system works, see Security Guide.

3. Click OK to save the changes.

The new changes are in effect for all transactions beginning after the user changes are committed.

Deleting a URI Privilege

You can delete a URI privilege from the security database. Perform the following steps to delete a URI privilege:

1. Click the Security icon in the left tree menu.
2. Click the URI Privileges icon. The URI Privileges Summary Page appears:

   

3. On the URI Privileges page for the given privilege, click the Delete button.
4. Click OK to confirm deleting the URI privilege.

The URI privilege is now deleted from the security database.

Creating an Amp

To create an amp, Perform the following steps:

1. Click the Security icon in the left tree menu.
2. Click the Amps icon.
3. Click on the Create tab. The Amp Configuration page appears:

   

4. Enter the database in which the function is stored. If the function is stored in the Modules directory on the filesystem, set the database to filesystem (which is the default value).
5. Enter the local name of the function (without parentheses) in which the amp takes effect. For example: my-function.
6. Enter the namespace in which the function is defined.
7. Enter the document URI for the document in which the function is defined. This document URI must begin with a forward slash (for example, /amped-functions.xqy). The specified document must be placed in the Modules directory within the installation path. For example, if /mydir/my-amps.xqy is specified in the document uri, my-amps.xqy must be placed in installation-directory/Modules/mydir.
8. Under the roles section, select the additional roles that will be given to the user while the user is executing the function.
9. Click OK.

The amp is now added to the security database.

Viewing an Amp

Perform the following steps to view an amp:

1. Click the Security icon in the left tree menu.
2. Click the Amps icon. The Amps Summary page appears:

   

3. Click on the name of the amp you want to view.
4. View the amp.

Modifying an Amp

Perform the following steps to modify an amp:

1. For the amp to which you want to modify, view the configuration as described in Viewing an Amp.
2. Perform any modifications needed to the amp (for example, add or remove role assignments).

   Making changes to the to the amp configuration affects the access control policy for that amp, which can either increase or decrease the activities authorized for any users who have any of assigned roles (either directly or indirectly). For more details on how the security system works, see Security Guide.

3. Click OK to save the changes.

The new changes are in effect for all transactions beginning after the user changes are committed.

Deleting an Amp

You can delete an amp from the security database. Perform the following steps to delete an amp:

1. Click the Security icon in the left tree menu.
2. Click the Amps icon. The Amps Summary page appears:

   

3. Click on the name of the amp you want to delete.
4. On the Amp page for the given amp, click the Delete button.
5. Click OK to confirm deleting the amp.

The amp is now deleted from the security database.

Creating a Protected Collection

Perform the following steps to create a protected collection:

1. Click the Security icon in the left tree menu.
2. Click the Collections icon.
3. Click the Create tab, The Collection Configuration page appears:

   

4. Enter the URI for the collection.
5. In the permissions section, add permissions (role-capability pair) to the collection. Select from the available roles and pick a capability for the role. You should usually select the update capability as this is the only one that affects how users interact with the collection. Only users with a role with the update capability can add documents to the collection; for details, see Protected Collections.
6. Click OK.

The protected collection is added to the database.

Viewing a Protected Collection

Perform the following steps to view a protected collection:

1. Click the Security icon in the left tree menu.
2. Click the Collections icon. The Collection Summary page appears.
3. Click the name of the collection you want to view, either on the tree menu or on the summary page. The Collection Configuration page appears.
4. View the collection.

Removing a Permission from a Protected Collection

Perform the following steps to remove a permission from a protected collection:

1. Click the Security icon in the left tree menu.
2. Click the Collections icon. The Collection Summary page appears.
3. Click the name of the collection from which you want to remove a permission, either on the tree menu or on the summary page. The Collection Configuration page appears.

   

4. In the permissions section, uncheck the box next to the permission you want to remove.
5. Click OK.

The permission is removed from the collection.

Deleting a Protected Collection

Perform the following steps to remove delete a protected collection:

1. Click the Security icon in the left tree menu.
2. Click the Collections icon.
3. Click the name of the collection you want to delete, either on the tree menu or on the summary page. The Collection Configuration page appears.

   

4. Click on the Delete button near the top right.
5. Click OK to confirm deleting the collection.

The protected collection is deleted from the security database.

Setting the Realm

The realm is stored in the security database to which the Admin Interface is connected, and is set at installation time:

Changing the Realm

Changing the realm in the security database invalidates all user digest passwords. This only affects application servers whose authentication setting is digest or digestbasic mode.

In digest mode, you need to re-enter all user passwords in the security database. Changing the passwords in the security database will cause the server to recalculate the digest passwords. In digestbasic mode, the first time a user logs into the server after the realm is changed, the user will be prompted to enter their passwords multiple times before they are logged into the system. However, the server will automatically recalculate their digest password with the new realm at that time, and they will have a normal login process for future access.

If you change the realm, any App Servers that uses digest authentication will no longer accept the existing passwords. This includes the Admin Interface, and includes passwords for users with the admin role. Therefore, changing the realm will make it so you can no longer log into the Admin Interface.

If you are sure you want to change the realm after installation despite the warning, perform the following steps:

1. Click Security in the left tree menu.
2. Click the Configure tab. The Security Configuration page appears.

   

3. Change the realm to the desired value.
4. Click OK.
5. Click OK again on the confirmation page. Note that this will invalidate all digest passwords, including the password for the current user running the Admin Interface if the Admin Interface App Server is set to digest authentication (which is the default setting).