User Management

From BaseX Documentation
Revision as of 17:36, 2 August 2016 by CG (talk | contribs)
Jump to navigation Jump to search

This article is part of the Advanced User's Guide. The user management defines which permissions are required by a user to perform a database command or XQuery expression.

Permissions are mostly relevant in the client/server architecture, as the Standalone Mode and the GUI is run with admin permissions. There are a few exceptions such as the xquery:eval function: Its execution scope can also be limited by specifying a permission.

The permission file is located in the database directory; it is called users.xml. This file can be manually edited; it will be parsed when BaseX is started.

Both local and global permissions are stored in the same file. Glob patterns are used for local database permissions. Salted sha256 hashes are used for authentication (the current timestamp will be used as salt). Additionally, digest hashes are used in the client/server architecture and the Language Bindings, and in the HTTP Context if the AUTHMETHOD is set to Digest.

Please take care of usual security measures: ensure that your password will not end up in your bash history, avoid sending passwords via ordinary REST requests, etc.

Rules

In the permission hierarchy below, the existing permissions are illustrated. A higher permission includes all lower permissions. For example, all users who have the write permission assigned will also be able to execute commands requiring read permission.

Local permissions are applied to databases. They have a higher precedence and override global permissions.

Permissions hierarchy

User names must follow the valid names constraints, and the database patterns must follow the Glob Syntax.

Operations

For all operations, admin permissions are required:

Commands

Create user 'test' (password will be entered on command line). By default, the user will have no permissions ('none'):

> CREATE USER test

Change password of user 'test' to '71x343sd#':

> ALTER PASSWORD test 71x343sd#

Grant local write permissions to user 'test':

> GRANT write ON unit* TO test

Note: Local permissions overwrite global permissions. As a consequence, the 'test' user will only be allowed to access (i.e., read and write) database starting with the letters 'unit'. If no local permissions are set, the global rights are inherited.

Show global permissions:

> SHOW USERS

XQuery

Create user 'test' with no permissions:

db:create('test', 'top-secret')

Show detailed information about user 'test':

> XQUERY user:list-details()[@name = 'test']

Drop user 'test':

> XQUERY user:drop('test')

Changelog

Revised in Version 8.0.