Role-Based Access Control

Overview

Role-Based Access Control (RBAC) allows you to manage users, roles, and permissions to control access to your database.

Key Concepts

• Users: Individual accounts that can connect to the database. Authentication is either by a local password (CREATE USER … PASSWORD) or, optionally, by binding against an external LDAP / Active Directory.
• Roles: Named groups of permissions that can be assigned to users. Ultipa GQLDB ships with 10 system roles.
• Permissions: Fine-grained operations on resources at the database, graph, node-label, edge-label, or procedure level.

Quick Start

GQL
-- Create a role
CREATE ROLE data_analyst

-- Create a user
CREATE USER alice PASSWORD 'secure_password_123'

-- Grant a permission to the role
GRANT READ ON GRAPH production TO ROLE data_analyst

-- Assign the role to the user
GRANT ROLE data_analyst TO USER alice

See the following pages for detailed information:

• User Management
• Role Management
• Grant & Revoke Permissions
• LDAP / Active Directory
• Best Practices

Error Codes

RBAC and authentication errors use codes in the 7000–7999 range: