Permissions management for queries in a graph
Systems, methods, and software described herein manage permissions in association with a query to a graph. In one example, a method of managing the permissions includes identifying a request for a query operation. In response to the request, the method further provides for identifying an access control list (ACL) in association with the query operation and identifying whether the query operation is permitted based on the ACL. The method further includes, in response to determining that the query operation is permitted, initiating the query operation.
1 . A method comprising:
receiving a request, in a deployment environment, for a query operation related to a query generated by a developer system;
in response to the request, identifying an access control list (ACL) associated with the query operation and deployed by the developer system to the deployment environment, wherein:
the ACL comprises a view list and an execute list, the view list defining users permitted to read code associated with the query and the execute list defining users permitted to execute the query,
the ACL takes precedence over a role-based access control (RBAC) separate from the ACL, wherein the RBAC assigns users to roles and defines which roles are permitted to perform operations associated with the query,
the RBAC is defined by an administrator of the deployment environment, and
the administrator of the deployment environment is prevented from modifying the ACL;
identifying permissions associated with vertices in a graph;
identifying one or more vertices of the vertices accessible by a user initiating the request; and
in response to determining, based on the ACL, that the user has permission to perform the query operation, initiating the query operation, wherein initiating the query operation comprises initiating the query operation on the one or more vertices accessible by the user.
2 . The method of claim 1 , wherein the query operation comprises an operation to execute the query.
3 . The method of claim 1 , wherein the query operation comprises an operation to read the query.
4 . The method of claim 1 further comprising:
in response to a request from a developer, generating, in the developer system, the ACL associated with the query;
assigning permitted query operations to the user in the ACL based on preferences from the developer; and
distributing the ACL with the query to the deployment environment.
5 . The method of claim 4 , wherein generating the ACL comprises assigning a password to the ACL, wherein the password permits modifications to the ACL.
6 . The method of claim 4 , wherein the deployment environment comprises one or more computing systems to support a graph database.
7 . The method of claim 1 , wherein the graph comprises a social network or organizational structure graph.
8 . A computing apparatus comprising:
a storage system;
a processing system operatively coupled to the storage system; and
program instructions on the storage system that, when executed by the processing system, direct the computing apparatus to:
receive a request, in a deployment environment, for a query operation related to a query generated by a developer system;
in response to the request, identify an access control list (ACL) associated with the query operation and deployed by the developer system to the deployment environment, wherein:
the ACL comprises a view list and an execute list, the view list defining users permitted to read code associated with the query and the execute list defining users permitted to execute the query,
the ACL takes precedence over a role-based access control (RBAC) separate from the ACL, wherein the RBAC assigns users to roles and defines which roles are permitted to perform operations associated with the query,
the RBAC is defined by an administrator of the deployment environment, and
the administrator of the deployment environment is prevented from modifying the ACL;
identify permissions associated with vertices in a graph;
identify one or more vertices of the vertices accessible by a user initiating the request; and
in response to determining, based on the ACL, that the user has permission to perform the query operation, initiating the query operation, wherein initiating the query operation comprises initiating the query operation on the one or more vertices accessible by the user.
9 . The computing apparatus of claim 8 , wherein the query operation comprises an operation to execute the query.
10 . The computing apparatus of claim 8 , wherein the query operation comprises an operation to read the query.
11 . The computing apparatus of claim 8 , wherein the program instructions further direct the computing apparatus to:
in response to a request from a developer, generating, in the developer system, the ACL associated with the query;
assigning permitted query operations to the user in the ACL based on preferences from the developer; and
distributing the ACL with the query to the deployment environment.
12 . The computing apparatus of claim 11 , wherein generating the ACL comprises assigning a password to the ACL, wherein the password permits modifications to the ACL.
13 . The computing apparatus of claim 11 , wherein the deployment environment comprises one or more computing systems to support a graph database.
14 . The computing apparatus of claim 8 , wherein the graph comprises a social network or organizational structure graph.
15 . A method comprising:
receiving a request, in a deployment environment, for a query operation related to a query generated by a developer system;
determining whether the query is associated with an access control list (ACL), wherein the ACL comprises a view list and an execute list, the view list defining users permitted to read code associated with the query and the execute list defining users permitted to execute the query, and wherein the query and the ACL are generated by the developer system and deployed to the deployment environment;
in the event that the query is associated with an ACL:
identifying whether the query operation is permitted based on the ACL and an identifier for a user initiating the request;
in the event that the query operation is permitted:
identifying permissions associated with vertices in a graph,
identifying one or more vertices of the vertices accessible by the user initiating the request, and
initiating the query operation, wherein initiating the query operation comprises initiating the query operation on the one or more vertices accessible by the user; and
in the event that the query operation is not permitted, blocking the query operation;
in the event that the query is not associated with an ACL:
determining whether the user initiating the request is allocated a role that permits the query operation in a role-based access control (RBAC) separate from the ACL, wherein the RBAC assigns users to roles and defines which roles are permitted to perform operations associated with the query, wherein the RBAC is defined by an administrator of the deployment environment, and wherein the administrator of the deployment environment is prevented from modifying the ACL;
in the event that the user is allocated a role that permits the query operation, initiating the query operation; and
in the event that the user is not allocated a role that permits the query operation, blocking the query operation.
16 . The method of claim 15 , wherein the query operation comprises an operation to execute the query.
17 . The method of claim 15 , wherein the query operation comprises an operation to read the query.