Skip to content

Commit f00061f

Browse files
phil198HannesSandbergHunternessrenetapopova
authored
Relationship PBAC (#2255)
This PR handles the Deprecations, additions, and compatibility page. neo4j/docs-cypher#1239 --------- Co-authored-by: Hannes Sandberg <[email protected]> Co-authored-by: Therese Magnusson <[email protected]> Co-authored-by: Reneta Popova <[email protected]>
1 parent 3621c68 commit f00061f

File tree

2 files changed

+37
-20
lines changed

2 files changed

+37
-20
lines changed

‎modules/ROOT/pages/authentication-authorization/limitations.adoc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -390,8 +390,10 @@ So due to the additional data access required by the security checks, this opera
390390

391391
[[property-based-access-control-limitations]]
392392
=== Property-based access control limitations
393-
Extra node-level security checks are necessary when adding security rules based on property rules, and these can have a significant performance impact.
394-
The following example shows how the database behaves when adding security rules to roles `restricted` and `unrestricted`:
393+
Extra node or relationship-level security checks are necessary when adding security rules based on property rules, and these can have a significant performance impact.
394+
395+
The following example shows how the database behaves when adding security rules for nodes to roles `restricted` and `unrestricted`.
396+
The same limitations apply to relationships.
395397

396398
[source, cypher]
397399
----

‎modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ CREATE ROLE regularUsers;
1212
[[property-based-access-control]]
1313
= Property-based access control
1414

15-
Property-based access control grants permissions to users to read node properties based on property/value conditions.
15+
Property-based access control grants or denies permission to read or traverse nodes or relationships based on property/value conditions.
1616
Each property-based privilege can only be restricted by a single property.
17-
For information about read privileges and their syntax, see xref:authentication-authorization/privileges-reads.adoc[Read privileges].
17+
For information about and syntax for these privileges, see xref:authentication-authorization/privileges-reads.adoc[Read privileges].
1818

1919
[IMPORTANT]
2020
====
@@ -25,7 +25,7 @@ Users who can change this property can affect the granted property-based privile
2525

2626
== Syntax
2727

28-
To specify the property/value conditions of the read privilege, you can use the following syntax:
28+
To specify the property/value conditions of the privilege, you can use the following syntax:
2929

3030
[source, syntax, role="noheader"]
3131
----
@@ -38,14 +38,18 @@ To specify the property/value conditions of the read privilege, you can use the
3838
| NODE[S] { * | label[, ...] }
3939
| RELATIONSHIP[S] { * | rel-type[, ...] }
4040
| FOR {
41-
42-
([var][:label["|" ...]] "{" property: value "}")
43-
| (var[:label["|" ...]])
44-
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
45-
| (var[:label["|" ...]]
46-
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } )
47-
}
48-
41+
([var][:label["|" ...]] "{" property: value "}")
42+
| (var[:label["|" ...]])
43+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
44+
| (var[:label["|" ...]]
45+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } )
46+
| ()[<]-"["[var][:type["|" ...]] "{" property: value "}" "]"-[>]()
47+
| ()[<]-"["var[:type["|" ...]]"]"-[>]()
48+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
49+
| ()[<]-"["var[:type["|" ...]]
50+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } "]"-[>]()
51+
}
52+
]
4953
{TO | FROM} role[, ...]
5054
----
5155

@@ -57,7 +61,7 @@ See xref:authentication-authorization/limitations.adoc#property-based-access-con
5761

5862
When having property rules, the following factors can worsen the impact on performance:
5963

60-
* The number of properties on the nodes concerned (more properties = greater performance impact).
64+
* The number of properties on the nodes and relationships concerned (more properties = greater performance impact).
6165
* The number of property-based privileges (more property-based privileges = greater performance impact).
6266
* The type of the privilege: `TRAVERSE` property-based privileges have greater performance impact than `READ` property-based privileges.
6367
* The type of storage medium in operation. The impact of the property-based privileges on performance is considerably amplified by accessing disc storage.
@@ -81,7 +85,7 @@ GRANT privilege-name ON GRAPH graph-name FOR pattern TO role-name
8185
The user role does not need to have `READ` privilege for the property used by the property-based privilege.
8286
====
8387

84-
=== Grant a property-based privilege on a specific property using its value
88+
=== Grant a property-based privilege on a specific property using the value of another property
8589

8690
The following example shows how to grant permission to `READ` the `address` property on `Email` or `Website` nodes with domain `exampledomain.com` to role `regularUsers`:
8791

@@ -97,6 +101,12 @@ Alternatively, you can use the following syntax:
97101
GRANT READ { address } ON GRAPH * FOR (:Email|Website {domain: 'exampledomain.com'}) TO regularUsers
98102
----
99103

104+
The following example shows how to grant permission to `READ` the `since` property on `OWNS` relationships having `classification` equal to `UNCLASSIFIED` to role `regularUsers`:
105+
106+
[source, syntax, role="noheader"]
107+
----
108+
GRANT READ { since } ON GRAPH * FOR ()-[o:OWNS]-() WHERE o.classification = 'UNCLASSIFIED' TO regularUsers
109+
----
100110

101111
=== Grant a property-based privilege using `NULL`
102112

@@ -109,20 +119,22 @@ GRANT TRAVERSE ON GRAPH * FOR (n:Email) WHERE n.classification IS NULL TO regula
109119

110120
=== Deny a property-based privilege using a comparison operator
111121

112-
The following example shows how to deny permission to `READ` and `TRAVERSE` nodes where the property `classification` is different from `UNCLASSIFIED` to role `regularUsers`:
122+
The following example shows how to deny permission to `READ` and `TRAVERSE` nodes and relationships where the property `classification` is different from `UNCLASSIFIED` to role `regularUsers`:
113123

114124
[source, syntax, role="noheader"]
115125
----
116126
DENY MATCH {*} ON GRAPH * FOR (n) WHERE n.classification <> 'UNCLASSIFIED' TO regularUsers
127+
DENY MATCH {*} ON GRAPH * FOR ()-[r]-() WHERE r.classification <> 'UNCLASSIFIED' TO regularUsers
117128
----
118129

119130
=== Grant a property-based privilege on all properties using a property value
120131

121-
The following example shows how to grant permission to `READ` all properties on nodes where the property `securityLevel` is higher than `3` to role `regularUsers`:
132+
The following example shows how to grant permission to `READ` all properties on nodes and relationships where the property `securityLevel` is higher than `3` to role `regularUsers`:
122133

123134
[source, syntax, role="noheader"]
124135
----
125136
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.securityLevel > 3 TO regularUsers
137+
GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.securityLevel > 3 TO regularUsers
126138
----
127139

128140
[NOTE]
@@ -132,22 +144,24 @@ The role `regularUsers` does not need to have `READ` privilege for the property
132144

133145
=== Deny a property-based privilege using a list of values
134146

135-
The following example shows how to deny permission to `READ` all properties on nodes where the property `classification` is not included in the list of `[UNCLASSIFIED, PUBLIC]`:
147+
The following example shows how to deny permission to `READ` all properties on nodes and relationships where the property `classification` is not included in the list of `[UNCLASSIFIED, PUBLIC]`:
136148

137149
[source, syntax, role="noheader"]
138150
----
139151
DENY READ {*} ON GRAPH * FOR (n) WHERE NOT n.classification IN ['UNCLASSIFIED', 'PUBLIC'] TO regularUsers
152+
DENY READ {*} ON GRAPH * FOR ()-[r]-() WHERE NOT r.classification IN ['UNCLASSIFIED', 'PUBLIC'] TO regularUsers
140153
----
141154

142155
// The last two examples were added in 5.26.
143156

144157
=== Grant a property-based privilege using temporal value
145158

146-
The following example shows how to grant permission to `READ` all properties on nodes where the property `createdAt` is later than the current date:
159+
The following example shows how to grant permission to `READ` all properties on nodes and relationships where the property `createdAt` is later than the current date:
147160

148161
[source, syntax, role="noheader"]
149162
----
150163
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date() TO regularUsers
164+
GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.createdAt > date() TO regularUsers
151165
----
152166

153167
[NOTE]
@@ -174,6 +188,7 @@ SHOW ROLE regularUsers PRIVILEGES AS REVOKE COMMANDS
174188
|===
175189
|command
176190
|"REVOKE GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date('2024-10-25') FROM `regularUsers`"
177-
a|Rows: 1
191+
|"REVOKE GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.createdAt > date('2024-10-25') FROM `regularUsers`"
192+
a|Rows: 2
178193
|===
179194

0 commit comments

Comments
 (0)