Migrate to v3.7 label-based access control ^Enterprise

Motivation for the breaking change

Current label-based access control implementation was good for a number of use cases, but there are certain things that it could not do:

• It had hierarchical access rights ➡ If a user had CREATE_DELETE permission, he would be given full manipulation access to the node. Sometimes, you only want to grant CREATE separately, without DELETE.
• Permission lists of for the nodes were not expressive ➡ An example could be that a data science team wants to manipulate all the nodes that have :DataScience label in it. They would also need to be granted additional labels in order to see their nodes, just because the rule was to have permission for EVERY label in the node. This per se is not troubling if you have one team. If you have multiple teams, their permission intersection is zero, meaning they can’t have shared visibility ownership of a node.

What’s changed?

Node label matching semantics

Before (v3.6): Rules matched exact label sets only. By executing the following query:

GRANT READ ON LABELS :User

the permission would be granted only to nodes which matched exactly the :User label. If any other label was present to which you don’t have permission, e.g. (:User:Admin), you would be denied access.

After (v3.7): Rules use flexible matching modes.

• GRANT READ ON NODES CONTAINING LABELS :User ➡ if a node contains the label :User, grant READ on that node
• GRANT READ ON NODES CONTAINING LABELS :User MATCHING ANY ➡ same behaviour as above
• GRANT READ ON NODES CONTAINING LABELS :User MATCHING EXACTLY ➡ Grants READ if the node has exactly the set of labels (:User and no more, no less)

Permission model change

Before (v3.6): Hierarchical permissions

• NOTHING ➡ user doesn’t have any grants
• READ ➡ user can read a node or a relationship
• UPDATE ➡ user can read and update a node or a relationship
• CREATE_DELETE ➡ user has the full CRUD access on a node or a relationship

After (v3.7): Discrete permissions

• NOTHING, CREATE, READ, UPDATE, DELETE
• Each permission is independent and must be granted explicitly. Any combination of CREATE, READ, UPDATE, and DELETE can be granted.

Syntax changes

For more details, please read the guide to label-based access control.

Before upgrading to v3.7

SHOW USERS;
// For each user
SHOW PRIVILEGES FOR username;
 
SHOW ROLES;
// For each role
SHOW PRIVILEGES FOR rolename;

# Default location. Adjust if using a custom data directory
cp -r /var/lib/memgraph/auth/backup/location/auth-backup <your_backup_location>

What gets migrated automatically

Global permissions only (grants on *)

Example:

// v3.6
GRANT UPDATE ON LABELS * TO alice;
 
// After automatic migration
GRANT READ, UPDATE ON NODES CONTAINING LABELS * TO alice;

What you must recreate manually

Review your pre-upgrade SHOW PRIVILEGES output to identify which users/roles had per-label permissions. For each permission that you need to recreate:

Verify behaviour

SHOW USERS;
// For each user
SHOW PRIVILEGES FOR username;
 
SHOW ROLES;
// For each role
SHOW PRIVILEGES FOR rolename;

Example scenario

Your SHOW PRIVILEGES output shows:

• alice has READ on :User node
• bob has UPDATE on :Document node
• charlie has CREATE_DELETE on :User node and CREATE_DELETE on :KNOWS relationship
• dave has READ on :Transportation and :Airplane
• eve has READ on :Transportation, :Airplane, :Bus, :Car ➡ she can see all transportations

Based on this information, the new rewritten authorization queries should be:

GRANT READ ON NODES CONTAINING LABELS :User MATCHING EXACTLY TO alice;
 
GRANT READ, UPDATE ON NODES CONTAINING LABELS :Document MATCHING EXACTLY TO bob;
 
GRANT CREATE, READ, UPDATE, DELETE ON NODES CONTAINING LABELS :User MATCHING EXACTLY TO charlie;
GRANT CREATE, READ, UPDATE, DELETE ON EDGES OF TYPE :KNOWS TO charlie;
 
GRANT READ ON NODES CONTAINING LABELS :Transportation, :Airplane MATCHING EXACTLY TO dave;
GRANT READ ON NODES CONTAINING LABELS :Transportation MATCHING ANY TO eve;

Changelog

For additional details, refer to the RBAC documentation and the complete summary of changes in version 3.7.