4

I am making a call to sec:role-exists(). I am trying to figure out what permissions are needed to grant this ability to someone other than admin. The error I am getting back implies that I need the http://marklogic.com/xdmp/privileges/get-role privilege.

SEC-PRIVDNE: xdmp:security-assert("http://marklogic.com/xdmp/privileges/get-role", "execute") -- Privilege does not exist: action(http://marklogic.com/xdmp/privileges/get-role), kind(execute)

However, when I try to grant this role using the admin account via sec:privilege-add-roles, it tells me that the privilege does not exist.

[1.0-ml] SEC-PRIVDNE: (err:FOER0000) Privilege does not exist: action(http://marklogic.com/xdmp/privileges/get-role), kind(execute)

Any ideas?

Here is a snippet of the code I am using to grant, which I am running as admin.

(: grant the needed privileges to the role :)
let $grant_privs :=
xdmp:invoke-function(
  function() {
    let $required_roles := (
      "http://marklogic.com/xdmp/privileges/create-role",
      "http://marklogic.com/xdmp/privileges/remove-role",
      "http://marklogic.com/xdmp/privileges/get-role-ids",
      "http://marklogic.com/xdmp/privileges/get-role-names",
      "http://marklogic.com/xdmp/privileges/get-role",
      "http://marklogic.com/xdmp/privileges/xdmp-invoke-in",
      "http://marklogic.com/xdmp/privileges/xdmp-invoke"
    )

    return
      for $r in $required_roles
        return
          sec:privilege-add-roles(
            $r,
            "execute",
            "auth-lib"
          )
  },
  <options xmlns="xdmp:eval">
    <database>{ xdmp:security-database() }</database>
    <transaction-mode>update-auto-commit</transaction-mode>
    <isolation>different-transaction</isolation>
  </options>
)
TJ Tang
  • 921
  • 6
  • 17

1 Answers1

7

It's actually a bug that the privilege wasn't created at installation. This will be remedied in the next release, but in the interim you can create it in your security database manually.

sec:create-privilege(
  "role-exists",
  "http://marklogic.com/xdmp/privileges/get-role",
  "execute",
  "security")
Wayne Feick
  • 555
  • 2
  • 4
  • I executed this against the security database, and I granted the execute permission on this privilege to the user account in question. Now the call no longer fails to actually grant the permission. But the call to sec:role-exists() always returns false, even though the role does exist. Any ideas? – TJ Tang Feb 18 '16 at 17:20