Sign Arizona Permission Slip Secure

Document type sign permission slip arizona secure

welcome to the MarkLogic security video series from marklogic university this video is the third part in a series of topics covering important concepts to master when implementing a security model and mark logic in this video we'll be discussing document permissions in this video you'll learn to describe the four types of document permissions how to manage permissions on documents and we'll test this all out within the scope of an application to follow along with this tutorial you'll need to download and install MarkLogic as we progress throughout this tutorial we'll refer to various pieces of code these examples are available through the MarkLogic university github site let's get started by talking about controlling access to content within our database no matter which API or tool that you use to load your data you get to control permission metadata and the end result of loading data into a database will yield documents their indexes and the document metadata which includes permissions managing permission metadata lets you control which roles and therefore which users can read a document can insert new content into a document can update existing content or nodes within a document and that also includes delete and in the case of codes stored in a modules database this will determine which roles can execute that code now we can define this permission metadata when the document gets loaded into the database and we can also update that permission metadata later on as well so let's go ahead and see this in action so the first thing that we're going to do to take a look at document permissions in more detail is open up a browser go to query console on localhost port 8000 and let's import the workspace for this episode now again you can find the workspaces for all of these episodes in this series by going out to the MarkLogic University github site and downloading the samples so here we're choosing to import the workspace for episode 3 now the first thing that we're going to do in order to experiment with permissions is insert a few documents into a database and we're just going to use the documents database that gets created by default when you initialize your host and we're going to use a simple server-side JavaScript bit of code that's going to use the document insert function to place a few documents into the database so when we run this code we can then explore the documents database and we should now see that we have three documents one represents a secret document one represents a top-secret document and one represents an unclassified document just to review the contents here we see the secret document here we see a top-secret document and here we see a unclassified document now that we've inserted a few sample documents the next thing we need to do is test our application so let's go ahead and set up the application server by clicking on the tab titled setup app server in our query console workspace and this is an example of using server-side JavaScript code to build an HTTP POST request to a service in the management REST API called servers and this endpoint will create for us a new application server in our MarkLogic environment based on the configuration that we define and if we study this configuration you'll see that we're giving the server a name we're setting it to a type of HTTP we're setting the port as a t10 and we're associating it with our documents database the other key piece of information is the root directory now I have the root directory set up based on the location on my file system where I have placed the contents of this episode if you have placed the contents at a different location please just update the root variable accordingly so let's go ahead and run this to create our HTTP application server and there we have it our application server has now been created now let's take a quick look at our application code so I'm going to browse out to the location on my file system where I have stored the contents for this episode and in the episode 3 folder I see app dot SJS I'm going to open this up in an editor and what we see is a very simple JavaScript application what we're doing is we're going to return the user name so that we can see who were logged in as we're going to then execute a search where we're looking for any document that contains the word secret and we're going to do that search unfiltered which means it will be resolved from indexes and will not require any secondary document parsing or filtering and then we're going to output the information including the username and the matching documents to our array variable called output and display that on the console now let's test our application so I'm going to open up a new browser window and I'm going to navigate out to my application server which is on localhost port 80 10 and I'm going to run app dot SJS now my application server is gonna make me authenticate and for this first test I'm going to authenticate using the admin credential that we created back in episode 1 and when I run the application I see that yes I am logged in as an admin user and I see the results of all three of the documents why because all all three of those documents contain the word secret which is what I was searching for now let's see what happens if we were to do this test but instead of logging in as an admin let's log in as our bond user so I'm going to run my application again but this time I'm going to log in with my bond user and if you recall from episode 2 that password is very simply the word pass PA SS in all lowercase now when I run my application I see that I am in fact logged in as bond however I do not return any matching documents why here's the key takeaway when we loaded those documents back in the first phase of this example we did not specify any document permissions we simply inserted the documents into the database so we did not manage any permission metadata what MarkLogic will do then in that scenario is err on the side of caution and the only users who will be able to read these documents will be admin users so what would we really want to do in a real-world situation well we would want to specify the permissions that were unique to our environment so instead of inserting these documents with no permissions what we could now do is an update and in this example we're doing an update because we are inserting documents at URIs that already exist but now when we insert these documents we are specifying the permissions that are appropriate and we are giving our secret read role a read permission on the secret document we're going to give our top-secret read role a read permission on the top-secret document and our unclassified document will be able to be read by the project default role let's run this to perform an update of the documents adding that additional metadata now let's go ahead and run our test a second time now when I go out and I log into my application as bond we'll see that bond has one document returned to him and this is the secret document but he is not able to see that top-secret documents because he does not have a role with a read permission on that document now let's think a little bit about what's happening here remember our code our code was executing an unfiltered search that means we're searching based on indexes alone so a key takeaway here is that the MarkLogic indexes are really smart they know what documents you should be able to read and which ones you should not and the indexes are aware of that and so even when we do an unfiltered search security is enforced now in this last example we updated the documents that were in our database and gave them permissions and we perform that update using the xdmp document insert function this requires that we rebuild the entire document and specify the metadata and perform the update another approach to perform this update which would eliminate the need to rebuild the entire document contents in our application would be to simply add the permissions now we could use a function like xdmp document add permissions to achieve this goal the benefit here is that we don't need to rebuild the entire document contents in our application however keep in mind you are still performing an update according to how MarkLogic implements MVCC or multi-version concurrency control now think about this big picture if I have a whole bunch of documents that I wish to load what's going to be the most efficient way to do that the most efficient way would be to eliminate having to do one of these updates at all and think about your security model up front and when you ingest your data originally you could have set those permissions at ingest time now in our last example we ran our application directly from the file system however in the real world you're more likely going to store your modules in a modules database and run that code from the modules database let's see what happens when we implement that approach so next let's take a look at load module and this is going to place this code from our file system and we're going to put it into the modules database now this modules database is one of those default databases that got created when we initialized our host and to place this into the database we're going to use a function called xdmp document load and again i'm referring to the location on my file system where i have stored this if you have a different path reference please update the file variable that you see in this code so let's go ahead and run this and the result then is that we should be able to see in our modules database that we now have that app dot SJS file in the database now remember our application server is still pointing to a root directory on our file system so the next step to implementing a code that runs from the modules database is to change the configuration of our application server and so here what we're going to do is we are going to change the route because it no longer needs to reference a location on our file system and we are going to change the modules database configuration setting to point to our modules database so to run this script which is building a request against the management REST API servers endpoints where we're specifically manipulating our application server named security demo and we're going to change some of its properties ok so let's go ahead and run this to perform the update of our application server now that we've configured our application server to run our code that is stored in the modules database let's go ahead and test our application again so I'm going to open up a new browser session and I'm going to go out to my app server on localhost port 80 10 slash app dot s je s and I'm gonna log in using the Bond user and when I try to run the application what I get back is a 404 not found error why the reason that I'm getting this error is because now our code is in a database it's a document in a database and like any documents in a database I need a permission on that document in order to be able to use it specifically for code a user must have a role with an execute permission on that document in order to run it however when I loaded the code in the modules database I did not set any execute permissions so what we need to do is update that appropriately so let's take a look at the last tab in our workspace called add execute permissions and in this example we're gonna run a server-side JavaScript function called xdmp document add permissions we're gonna run this against our modules database since that is where the code is stored and we're gonna set appropriate permissions on this code specifically we're gonna give our project default secret read and project admin roles in execute permission now remember that the top secret read role inherits the secret read role therefore it will also have in execute permission so let's go ahead and run this to update the permissions on this piece of code in the database and let's run our test again so I launched a new browser I go out to my application server slash app dot SJS and I'm gonna log in as bond and now I'm able to execute that and see the appropriate results let's take a minute to review some of the key takeaways that we saw on these examples first permissions are metadata about a document you can update them but you could avoid that update by setting permissions when you load the document the first time indexes are smart they're aware of your permissions and when you search the database you're only searching the documents that you are able to read and finally you must have an execute permission in order to run code stored in a modules database in this tutorial we had a chance to describe the four types of document permissions to manage permissions on documents and see the effects of those permissions as it relates to an application as a next step go out and get MarkLogic you can download it from developer marklogic com the examples in this episode can be found through the MarkLogic University github site and for more training visit MarkLogic comm slash training and you can also view more on-demand tutorials through the MOU marklogic comm on-demand site or using the MOU mobile app and finally don't forget to add marklogic as a skill on your LinkedIn profile thank you for watching this marklogic university on-demand tutorial