Skip to content

MLE-31877 revert xdmp-login changes#1966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jonmille wants to merge 3 commits into
base:develop
Choose a base branch
from
Open

MLE-31877 revert xdmp-login changes #1966

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6f05d62
MLE-31877 Removal of xdmp-login
jonmille Aug 11, 2026
710d9b9
MLE-31877 Privilege Update
jonmille Aug 11, 2026
f887514
MLE-31877 Privilege Update
jonmille Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...st/java/com/marklogic/client/datamovement/functionaltests/StringQueryHostBatcherTest.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -92,7 +92,7 @@ public static void setUpBeforeClass() throws Exception {
};
addRangePathIndex(dbName, rangePaths);

createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:eval-in", "any-uri", "xdbc:invoke", "xdmp-login");
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:eval-in", "any-uri", "xdbc:invoke");
createRESTUser("eval-user", "x", "test-eval", "rest-admin", "rest-writer", "rest-reader", "rest-extension-user", "manage-user");
}

Expand Down
2 changes: 1 addition & 1 deletion ...sts/src/test/java/com/marklogic/client/fastfunctest/TestBulkWriteWithTransformations.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -54,7 +54,7 @@ public static void tearDownAfterClass() throws Exception {
@BeforeEach
public void setUp() throws Exception {
// create new connection for each test below
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:eval-in", "any-uri", "xdbc:invoke", "xdmp-login");
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:eval-in", "any-uri", "xdbc:invoke");
createRESTUser("eval-user", "x", "test-eval", "rest-admin", "rest-writer", "rest-reader");
client = newClientAsUser("eval-user", "x");
}
Expand Down
2 changes: 1 addition & 1 deletion ...tionaltests/src/test/java/com/marklogic/client/fastfunctest/TestJSResourceExtensions.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ public String deleteJSON(String docUri) {

@BeforeAll
public static void setUpBeforeClass() throws Exception {
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:value", "xdmp:eval", "xdmp:eval-in", "any-uri", "xdbc:invoke", "xdmp-login");
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:value", "xdmp:eval", "xdmp:eval-in", "any-uri", "xdbc:invoke");
createRESTUser("eval-user", "x", "test-eval", "rest-admin", "rest-writer", "rest-reader", "rest-extension-user");
}

Expand Down
2 changes: 1 addition & 1 deletion ...api-functionaltests/src/test/java/com/marklogic/client/functionaltest/TestBiTemporal.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -121,7 +121,7 @@ public static void tearDownAfterClass() throws Exception {
@BeforeEach
public void setUp() throws Exception {
createUserRolesWithPrevilages("test-eval", "xdbc:eval", "xdbc:eval-in", "xdmp:eval-in", "any-uri",
"xdbc:invoke", "temporal:statement-set-system-time", "xdmp-login");
"xdbc:invoke", "temporal:statement-set-system-time");
createRESTUser("eval-user", "x", "test-eval", "rest-admin", "rest-writer", "rest-reader", "temporal-admin");

adminClient = getDatabaseClient("rest-admin", "x", getConnType());
Expand Down
10 changes: 10 additions & 0 deletions test-app/src/main/ml-config/security/roles/java-test-delete-graph.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,16 @@
"privilege-name": "term-query",
"action": "http://marklogic.com/xdmp/privileges/term-query",
"kind": "execute"
},
{
"privilege-name": "unprotected-uri",
"action": "http://marklogic.com/xdmp/privileges/unprotected-uri",
"kind": "execute"
},
{
"privilege-name": "unprotected-collections",
"action": "http://marklogic.com/xdmp/privileges/unprotected-collections",
"kind": "execute"
}
]
}
10 changes: 10 additions & 0 deletions test-app/src/main/ml-config/security/roles/java-test-evaluator.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,16 @@
"privilege-name": "xdbc:eval-in",
"action": "http://marklogic.com/xdmp/privileges/xdbc-eval-in",
"kind": "execute"
},
{
"privilege-name": "unprotected-uri",
"action": "http://marklogic.com/xdmp/privileges/unprotected-uri",
"kind": "execute"
},
{
"privilege-name": "unprotected-collections",
"action": "http://marklogic.com/xdmp/privileges/unprotected-collections",
"kind": "execute"
}
]
}
46 changes: 0 additions & 46 deletions test-app/src/main/ml-config/security/roles/java-test-xdmp-login.json
View file
Open in desktop

This file was deleted.

18 changes: 14 additions & 4 deletions test-app/src/main/ml-config/security/roles/test-rest-writer.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -18,13 +18,23 @@
"kind": "execute"
},
{
"privilege-name": "xdmp-login",
"action": "http://marklogic.com/xdmp/privileges/xdmp-login",
"privilege-name": "xdmp:invoke",

@rjrudinrjrudinAug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine for this PR, but I think it'd be good to next try a PR where this is removed from this role and see what fails. And then create an additional role - e.g. "test-invoke" - that only grants this privilege and give it a user that is only used for tests where we know this privilege is required. It should be granted for a "rest writer" who typically does not need invoke (or eval) privileges.

"action": "http://marklogic.com/xdmp/privileges/xdmp-invoke",
"kind": "execute"
},
{
"privilege-name": "xdmp:invoke",
"action": "http://marklogic.com/xdmp/privileges/xdmp-invoke",
"privilege-name": "xdmp:xslt-invoke",

@rjrudinrjrudinAug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for these privileges - I would do a follow up PR where I remove these and see what breaks.

@jonmillejonmilleAug 12, 2026•
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the removal of xdmp:xslt-invoke, xdmp:xslt-eval, and xdmp:value the 3 test failures from the first Jenkins run are shown: https://ml-clt-jenkins.progress.com/blue/organizations/jenkins/devexp%2FJava-Client%2Fjava-client-api/detail/PR-1966/1/tests

xsltTransformWithoutParam() – com.marklogic.client.test.rows.TransformDocTest

  • com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

xsltTransformWithParam() – com.marklogic.client.test.rows.TransformDocTest

  • com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

testUsingFromParamAndSchematron() – com.marklogic.client.test.rows.ValidateDocTest

  • com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

@jonmillejonmilleAug 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • TransformDocTest#xsltTransformWithoutParam — XSLT stylesheet invoked by URI; needs xdmp:xslt-invoke
  • TransformDocTest#xsltTransformWithParam — XSLT stylesheet invoked by URI; needs xdmp:xslt-invoke
  • ValidateDocTest#testUsingFromParamAndSchematron — schematron compiled to XSLT (xdmp:xslt-invoke + xdmp:xslt-eval) then written via fromParam (xdmp:value)

@rjrudinrjrudinAug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's great - I wouldn't address those in this PR, but I would do a follow up where I make a new test user that has those additional privileges. That way, the other tests run as a rest-writer user that doesn't have those privileges. That provides a better regression suite that can catch a bug where a server change ends up requiring a new privilege.

"action": "http://marklogic.com/xdmp/privileges/xslt-invoke",
"kind": "execute"
},
{
"privilege-name": "xdmp:xslt-eval",
"action": "http://marklogic.com/xdmp/privileges/xslt-eval",
"kind": "execute"
},
{
"privilege-name": "xdmp:value",
"action": "http://marklogic.com/xdmp/privileges/xdmp-value",
"kind": "execute"
},
{
Expand Down
2 changes: 1 addition & 1 deletion test-app/src/main/ml-config/security/users/rest-admin.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
{
"user-name": "rest-admin",
"description": "rest-admin user",
"role": ["rest-admin", "java-test-delete-temporal", "java-test-xdmp-login"],
"role": ["rest-admin", "java-test-delete-temporal"],
"password": "x"
}
2 changes: 1 addition & 1 deletion test-app/src/main/ml-config/security/users/rest-evaluator.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
{
"user-name": "rest-evaluator",
"description": "Test user for the java-client-api-project",
"role": ["java-test-evaluator", "java-test-xdmp-login"],
"role": ["java-test-evaluator"],
"password": "x"
}
15 changes: 0 additions & 15 deletions test-app/src/main/ml-config/security/users/rest-transform-user.json
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion test-app/src/main/ml-config/security/users/rest-writer.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
{
"user-name": "rest-writer",
"description": "rest-writer user",
"role": ["rest-writer", "java-test-delete-graph", "java-test-xdmp-login"],
"role": ["rest-writer", "java-test-delete-graph"],
"password": "x"
}
3 changes: 1 addition & 2 deletions test-app/src/main/ml-config/security/users/writer-no-default-permissions.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,8 +5,7 @@
"test-rest-writer",
"java-test-delete-graph",
"rest-extension-user",
"rest-reader",
"java-test-xdmp-login"
"rest-reader"
],
"password": "x"
}
Loading