Permissions on Non-default Column Families

The following diagram shows a JSON document where fields b and c are in a column family cf1 that is defined at field b with the path a.b.

Granting Read and Write Permissions on Field c

To perform both read and write operations on field c, when it is in column family cf1, you must have both readperm and writeperm access on field c:

• If you have readperm and writeperm permissions on cf1, then you have access to field c.
• If you have readperm and writeperm permissions on field b, then you have access to field c. You do not need any further permissions. Field c inherits your readperm and writeperm permissions from field b.
• If you have readperm and writeperm permissions on cf1 but either field a or b denied you permissions:
  • You must have traverseperm permission granted to you on the field that denied you access (field a or b).
  • You must have readperm and writeperm permissions explicitly granted to you on field c.
• If you do not have readperm and writeperm permissions on cf1:
  • You must have traverseperm permission granted to you on either cf1 or field b.
  • You must have readperm and writeperm permissions explicitly granted to you on field c.

The following are examples of commands that grant these permissions:

/opt/mapr/bin/maprcli table cf colperm set 
  -path <path to JSON table > 
  -cfname cf1 
  -name a.b 
  -traverseperm u:<user ID> | <existing ACE for this field>             

/opt/mapr/bin/maprcli table cf colperm set 
  -path <path to JSON table > 
  -cfname cf1 
  -name a.b.c 
  -readperm u:<user ID> | <existing ACE for this field> 
  -writeperm u:<user ID> | <existing ACE for this field>

/opt/mapr/bin/maprcli table cf edit 
  -path <path to JSON table > 
  -cfname cf1 
  -traverseperm u:<user ID> | <existing ACE for this field>        

/opt/mapr/bin/maprcli table cf colperm set 
  -path <path to JSON table > 
  -cfname cf1 
  -name a.b.c 
  -readperm u:<user ID> | <existing ACE for this field> 
  -writeperm u:<user ID> | <existing ACE for this field> 

Granting Read or Write Permission on Field c

To perform either read or write operations on field c, when it is in column family cf1, you must have either readperm or writeperm access on field c:

• If you have the same permission (readperm or writeperm) on cf1, then you have access to field c.
• If you have the same permission (readperm or writeperm) on field b, then you have access to field c. You do not need any further permissions. Field c inherits your readperm or writeperm permission from field b.
• If you have the same permission (readperm or writeperm) on cf1 but either field a or b denied you permission:
  • You must have traverseperm permission granted to you on the field that denied you access (field a or b).
  • You must have readperm or writeperm permission explicitly granted to you on field c.
• If you do not have the same permission (readperm or writeperm) on cf1:
  • You must have the traverseperm permission granted to you on either cf1 or field b.
  • You must have readperm or writeperm permission explicitly granted to you on field c.

The following example grants traverseperm permission:

/opt/mapr/bin/maprcli table cf colperm set 
  -path <path to JSON table> 
  -cfname cf1 
  -name a.b 
  -traverseperm u:<user ID> | <existing ACE for this field>            

The following example grants readperm permission:

/opt/mapr/bin/maprcli table cf colperm set 
  -path <path to JSON table> 
  -cfname cf1 
  -name a.b.c 
  -readperm u:<user ID> | <existing ACE for this field>