Overview

Privileges are a key access control mechanism that determine the operations a user can perform on the graph database. They enforce security by restricting access to specific operations, such as querying, updating, or administering the database. A set of privileges can be granted to a policy, which can then be assigned to users. Alternatively, individual privileges can be directly assigned to users.

Types of Privileges in Ultipa:

• Graph privileges: Includes operations for manipulating and reading data and structure of specific graphsets, as well as managing their indexes, jobs, HDC graphs, etc.
• System privileges: Includes operations for managing graphsets, processes, privileges, policies, users, servers, etc., within the database.
• Property privileges: Includes read, write, and deny, applied specifically to certain custom properties.

For details of each privilege, please refer to All Privileges.

Showing Privileges

To list all privileges of the database:

show().privilege()

This will return a table _privilege, as shown below:

Granting Privileges

You can grant graph, system, property privileges and policies to a user or policy using the grant().user().params() or grant().policy().params() statement.

Syntax

grant().user("<userName>").params({
  graph_privileges: {
    "<graph>": ["<graphPriv>", "<graphPriv>", ...],
    ...
  }, 
  system_privileges: ["<systemPriv>", "<systemPriv>", ...], 
  property_privileges: {
    "node": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    },
    "edge": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    }
  },
  policies: ["<policyName>", "<policyName>", ...]
})

grant().policy("<policyName>").params({
  graph_privileges: {
    "<graph>": ["<graphPriv>", "<graphPriv>", ...],
    ...
  }, 
  system_privileges: ["<systemPriv>", "<systemPriv>", ...],
  property_privileges: {
    "node": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    },
    "edge": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    }
  },
  policies: ["<policyName>", "<policyName>", ...]
})

Examples

To grant privileges to the user ultipaUsr, including:

• Graph privileges: UPDATE for all graphsets
• System privileges: SHOW_POLICY, ALTER_GRAPH
• Property privileges:
  • read all node properties for all schemas in all graphsets
  • write edge properties value and time for all schemas in the graphset Tax
  • deny (Do not allow read and write) edge property score for the schema rate in the graphset miniCircle
• Policies: manager

grant().user("ultipaUsr").params({
  graph_privileges: {"*": ["UPDATE"]}, 
  system_privileges: ["SHOW_POLICY", "ALTER_GRAPH"],
  property_privileges: {
    "node": {
      "read": [
        ["*", "*", "*"]
      ]
    },
    "edge": {
      "write": [
        ["Tax", "*", "value"],
        ["Tax", "*", "time"]
      ],
      "deny": [
        ["miniCircle", "rates", "score"]
      ]
    }
  },
  policies: ["manager"]
})

To grant graph privileges CREATE_SCHEMA and DROP_SCHEMA for the graphset Tax, and system privilege ADD_HDC_SERVER to the policy manager:

grant().policy("manager").params({
  graph_privileges: {"Tax": ["CREATE_SCHEMA", "DROP_SCHEMA"]}, 
  system_privileges: ["ADD_HDC_SERVER"]
})

Revoking Privileges

You can revoke graph, system, property privileges and policies from a user or policy using the revoke().user().params() or revoke().policy().params() statement.

Syntax

revoke().user("<userName>").params({
  graph_privileges: {
    "<graph>": ["<graphPriv>", "<graphPriv>", ...],
    ...
  }, 
  system_privileges: ["<systemPriv>", "<systemPriv>", ...], 
  property_privileges: {
    "node": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    },
    "edge": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    }
  },
  policies: ["<policyName>", "<policyName>", ...]
})

revoke().policy("<policyName>").params({
  graph_privileges: {
    "<graph>": ["<graphPriv>", "<graphPriv>", ...],
    ...
  }, 
  system_privileges: ["<systemPriv>", "<systemPriv>", ...], 
  property_privileges: {
    "node": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    },
    "edge": {
      "<propertyPriv>": [
        ["<graph>", "<schema>", "<property>"],
        ...
      ],
      ...
    }
  },
  policies: ["<policyName>", "<policyName>", ...]
})

Examples

To revoke privileges from the user ultipaUsr, including:

• Graph privileges: UPDATE for all graphsets
• System privileges: SHOW_POLICY, ALTER_GRAPH
• Property privileges:
  • read all node properties for all schemas in all graphsets
  • write edge properties value and time for all schemas in the graphset Tax
  • deny (Do not allow read and write) edge property score for the schema rate in the graphset miniCircle
• Policies: manager

revoke().user("ultipaUsr").params({
  graph_privileges: {"*": ["UPDATE"]}, 
  system_privileges: ["SHOW_POLICY", "ALTER_GRAPH"],
  property_privileges: {
    "node": {
      "read": [
        ["*", "*", "*"]
      ]
    },
    "edge": {
      "write": [
        ["Tax", "*", "value"],
        ["Tax", "*", "time"]
      ],
      "deny": [
        ["miniCircle", "rates", "score"]
      ]
    }
  },
  policies: ["manager"]
})

To revoke graph privileges CREATE_SCHEMA and DROP_SCHEMA for the graphset Tax, and system privilege ADD_HDC_SERVER from the policy manager:

revoke().policy("manager").params({
  graph_privileges: {"Tax": ["CREATE_SCHEMA", "DROP_SCHEMA"]}, 
  system_privileges: ["ADD_HDC_SERVER"]
})

All Privileges

Graph Privileges

System Privileges

Property Privileges

read

If the read privilege for the @user.name property is not granted:

write

If the write privilege for the @user.name property is not granted: