Tenant based permission allocation for a graph database
Systems, methods, and software described herein provide enhancements for managing permissions in a shared graph. In one implementation, a graph management system identifies a request to classify a first subgraph in the graph for access by a tenant of a plurality of tenants, wherein the request indicates one or more vertex types and/or one or more edge types for the first subgraph. The graph management system further identifies one or more vertices and/or one or more edges in the graph that qualify for the first subgraph based on the indicated one or more vertex types and/or one or more edge types, and allocates permissions to at least one user associated with the tenant to access the first subgraph.
1. A method of managing a graph for access by a plurality of tenants, the method comprising:
identifying a request to classify a first subgraph in the graph for access by a tenant of the plurality of tenants, wherein the request indicates one or more vertex types of a plurality of vertex types in the graph and one or more edge types of a plurality of edge types in the graph for the first subgraph;
identifying one or more vertices and one or more edges in the graph that qualify as part of the first subgraph based on the indicated one or more vertex types and one or more edge types;
classifying the one or more vertices and one or more edges as part of the first subgraph; and
allocating permissions to at least one user associated with the tenant to access the first subgraph, wherein the permissions allow the at least one user to assign one or more roles to one or more other users associated with the tenant to access the first subgraph.
2. The method of claim 1 further comprising:
identifying the plurality of vertex types and the plurality of edge types for the graph;
generating a plurality of vertices for the graph, wherein each vertex of the plurality of vertices is associated with at least one of the plurality of vertex types; and
generating a plurality of edges for the graph, wherein each edge of the plurality of edges is associated with at least one of the plurality of edge types.
3. The method of claim 1 further comprising:
identifying a second request to classify a second subgraph in the graph for access by a second tenant of the plurality of tenants, wherein the second request indicates one or more vertex types and one or more edge types for the second subgraph;
identifying one or more vertices and one or more edges in the graph that qualify for the first subgraph based on the indicated one or more vertex types and one or more edge types for the second subgraph; and
allocating permissions to at least one user associated with the second tenant to access the second subgraph.
4. The method of claim 3 , wherein the first subgraph and the second subgraph share at least one vertex type and/or edge type.
5. The method of claim 1 , wherein allocating the permissions to the at least one user associated with the tenant to access the first subgraph comprises allocating one or more roles to the at least one user, wherein the one or more roles for the at least one user define available commands for the at least one user to interact with the first subgraph.
6. The method of claim 1 , wherein a role of the one or more roles permit the at least one user to generate and execute queries on the first subgraph.
7. The method of claim 1 further comprising identifying a request from the at least one user to allocate at least one role to a second end user associated with the tenant to access the first subgraph and, in response to the request, allocate the at least one role to the second end user for the first subgraph, wherein the role permits the second end user to generate and execute queries on the first subgraph.
8. The method of claim 1 , wherein allocating the permissions to the at least one user associated with the tenant to access the first subgraph comprises allocating at least view permissions to the at least one user to view the first subgraph.
9. A computing system comprising:
one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media that, when read and executed by a processing system, direct the processing system to at least:
identify a request to classify a first subgraph in the graph for access by a tenant of the plurality of tenants, wherein the request indicates one or more vertex types of a plurality of vertex types in the graph and one or more edge types of a plurality of edge types in the graph for the first subgraph;
identify one or more vertices and one or more edges in the graph to classify as part of the first subgraph based on the indicated one or more vertex types and one or more edge types;
classify the one or more vertices and one or more edges as part of the first subgraph; and
allocate permissions to at least one user associated with the tenant to access the first subgraph, wherein the permissions allow the at least one user to assign one or more roles to one or more other users associated with the tenant to access the first subgraph.
10. The computing system of claim 9 , wherein the program instructions further direct the processing system to:
identify the plurality of vertex types and the plurality of edge types for the graph;
generate a plurality of vertices for the graph, wherein each vertex of the plurality of vertices is associated with at least one of the plurality of vertex types; and
generate a plurality of edges for the graph, wherein each edge of the plurality of edges is associated with at least one of the plurality of edge types.
11. The computing system of claim 9 further comprising the processing system.
12. A system comprising:
a graph storage system configured to store a graph, wherein the graph comprises a plurality of vertices each assigned at least one vertex type of a plurality of vertex types and a plurality of edges each assigned at least one edge type of a plurality of edge types;
a processing system configured to:
identify a request to classify a first subgraph in the graph for access by a tenant of a plurality of tenants, wherein the request indicates one or more vertex types of the plurality of vertex types in the graph and one or more edge types of the plurality of edge types in the graph for the first subgraph;
identify one or more vertices and one or more edges in the graph to classify as part of the first subgraph based on the indicated one or more vertex types and one or more edge types; and
allocate permissions to at least one user associated with the tenant to access the first subgraph, wherein the permissions allow the at least one user to assign one or more roles to one or more other users associated with the tenant to access the first subgraph.
13. The system of claim 12 , wherein the processing system is further configured to:
identify the plurality of vertex types and the plurality of edge types for the graph;
generate a plurality of vertices for the graph, wherein each vertex of the plurality of vertices is associated with at least one of the plurality of vertex types; and
generate a plurality of edges for the graph, wherein each edge of the plurality of edges is associated with at least one of the plurality of edge types.
14. The system of claim 12 , wherein allocating the permissions to the at least one user associated with the tenant to access the first subgraph comprises allocating one or more roles to the at least one user, wherein the one or more roles for the at least one user define available commands for the at least one user to interact with the first subgraph.
15. The system of claim 12 , wherein a role of the one or more roles permit the at least one user to generate and execute queries on the first subgraph.
16. The computing system of claim 9 , wherein the program instructions further direct the processing system to:
identify a second request to classify a second subgraph in the graph for access by a second tenant of the plurality of tenants, wherein the second request indicates one or more vertex types and one or more edge types for the second subgraph;
identify one or more vertices and one or more edges in the graph that qualify for the first subgraph based on the indicated one or more vertex types and one or more edge types for the second subgraph; and
allocate permissions to at least one user associated with the second tenant to access the second subgraph.
17. The computing system of claim 16 , wherein the first subgraph and the second subgraph share at least one vertex type and/or edge type.
18. The computing system of claim 9 , wherein allocating the permissions to the at least one user associated with the tenant to access the first subgraph comprises allocating one or more roles to the at least one user, wherein the one or more roles for the at least one user define available commands for the at least one user to interact with the first subgraph.
19. The computing system of claim 9 , wherein a role of the one or more roles permits the at least one user to generate and execute queries on the first subgraph.
20. The computing system of claim 9 , wherein allocating the permissions to the at least one user associated with the tenant to access the first subgraph comprises allocating at least view permissions to the at least one user to view the first subgraph.