Skip to content

Example of property-based access control using temporal value #1887

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Oct 31, 2024
Merged

Example of property-based access control using temporal value #1887

Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8abf3aa
example of property-based access control using temporal value
HannesSandberg Oct 21, 2024
1ce97a7
Update modules/ROOT/pages/authentication-authorization/property-based…
HannesSandberg Oct 22, 2024
1796982
Update modules/ROOT/pages/authentication-authorization/property-based…
HannesSandberg Oct 25, 2024
3f3369a
adding a example with show privileges
HannesSandberg Oct 25, 2024
363a703
Update modules/ROOT/pages/authentication-authorization/property-based…
HannesSandberg Oct 25, 2024
c912b3b
Update modules/ROOT/pages/authentication-authorization/property-based…
HannesSandberg Oct 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,33 @@ The role `regularUsers` does not need to have `READ` privilege for the property
[source, syntax, role="noheader"]
----
DENY READ {*} ON GRAPH * FOR (n) WHERE NOT n.classification IN ['UNCLASSIFIED', 'PUBLIC'] TO regularUsers
----
----

.Granting permission to `READ` all properties on nodes where the property `createdAt` is later than current date to role `regularUsers`:
[source, syntax, role="noheader"]
----
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date() TO regularUsers
----
[NOTE]
====
The `date()` function is evaluated, and the value used to evaluate the privilege is the date when the property-based privilege is created.
Keep this in mind when designing your property rules, and use the `SHOW PRIVILEGES AS COMMANDS` command to check the stored value.
This is essential when revoking property-based privileges containing evaluated function values like `date()`.
====
[NOTE]
====
Not all temporal values are comparable, see link:{neo4j-docs-base-uri}/cypher-manual/{page-version}/syntax/operators/#cypher-ordering[Cypher Manual -> Syntax -> Operators -> Ordering and comparison of values].
====

.Show the privilege created by the command in the example above as a revoke command:
[source, syntax, role="noheader"]
----
SHOW ROLE regularUsers PRIVILEGES AS REVOKE COMMANDS
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there's a lot of things granted to that role but if this page isn't being tested I guess just returning the one you want to show is fine 🤷

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, I did want to show the explicit case and not everything that was granted to the role

----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
|"REVOKE GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date('2024-10-25') FROM `regularUsers`"
a|Rows: 1
|===