Neo4j Node security access controls
I'm looking to have node access controls by implementing custom properties on the nodes themselves and having trouble determining the best path to take. Access to these need to be determined on the fly and cannot be determined beforehand.
For example:
Let's say I have
(bob:Person {name: "Bob",access:"1000000000}) - [:KNOWS] -
(adam:Person {name:"Adam",access:"110010000"})
Based on the access object, there can be up to 512 different combinations to determine access to an object. In reality, the access level can have even more variations and may expand in the future. Ideally, what I would be able to do is to filter out the nodes/relationships for any query that is run against this DB. I started looking into custom procedures but I'm unsure if that's the best approach.
neo4j
asked Nov 12 '18 at 15:06
neelzp
33
add a comment |
I'm looking to have node access controls by implementing custom properties on the nodes themselves and having trouble determining the best path to take. Access to these need to be determined on the fly and cannot be determined beforehand.
For example:
Let's say I have
(bob:Person {name: "Bob",access:"1000000000}) - [:KNOWS] -
(adam:Person {name:"Adam",access:"110010000"})
Based on the access object, there can be up to 512 different combinations to determine access to an object. In reality, the access level can have even more variations and may expand in the future. Ideally, what I would be able to do is to filter out the nodes/relationships for any query that is run against this DB. I started looking into custom procedures but I'm unsure if that's the best approach.
neo4j
asked Nov 12 '18 at 15:06
neelzp
33
How exactly are theaccessproperties supposed to be used?
– cybersam
Nov 13 '18 at 21:04
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
So, a user has a specificaccessstring, and s/he can only access nodes/relationships with the sameaccessvalue?
– cybersam
Nov 13 '18 at 21:20
add a comment |
I'm looking to have node access controls by implementing custom properties on the nodes themselves and having trouble determining the best path to take. Access to these need to be determined on the fly and cannot be determined beforehand.
For example:
Let's say I have
(bob:Person {name: "Bob",access:"1000000000}) - [:KNOWS] -
(adam:Person {name:"Adam",access:"110010000"})
Based on the access object, there can be up to 512 different combinations to determine access to an object. In reality, the access level can have even more variations and may expand in the future. Ideally, what I would be able to do is to filter out the nodes/relationships for any query that is run against this DB. I started looking into custom procedures but I'm unsure if that's the best approach.
neo4j
asked Nov 12 '18 at 15:06
neelzp
33
I'm looking to have node access controls by implementing custom properties on the nodes themselves and having trouble determining the best path to take. Access to these need to be determined on the fly and cannot be determined beforehand.
For example:
Let's say I have
(bob:Person {name: "Bob",access:"1000000000}) - [:KNOWS] -
(adam:Person {name:"Adam",access:"110010000"})
Based on the access object, there can be up to 512 different combinations to determine access to an object. In reality, the access level can have even more variations and may expand in the future. Ideally, what I would be able to do is to filter out the nodes/relationships for any query that is run against this DB. I started looking into custom procedures but I'm unsure if that's the best approach.
neo4j
neo4j
asked Nov 12 '18 at 15:06
neelzp
33
asked Nov 12 '18 at 15:06
neelzp
33
edited Nov 14 '18 at 14:27
asked Nov 12 '18 at 15:06
neelzp
33
asked Nov 12 '18 at 15:06
neelzp
33
asked Nov 12 '18 at 15:06
neelzp
33
33
How exactly are theaccessproperties supposed to be used?
– cybersam
Nov 13 '18 at 21:04
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
So, a user has a specificaccessstring, and s/he can only access nodes/relationships with the sameaccessvalue?
– cybersam
Nov 13 '18 at 21:20
add a comment |
How exactly are theaccessproperties supposed to be used?
– cybersam
Nov 13 '18 at 21:04
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
So, a user has a specificaccessstring, and s/he can only access nodes/relationships with the sameaccessvalue?
– cybersam
Nov 13 '18 at 21:20
How exactly are the
access properties supposed to be used?– cybersam
Nov 13 '18 at 21:04
How exactly are the
access properties supposed to be used?– cybersam
Nov 13 '18 at 21:04
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
So, a user has a specific
access string, and s/he can only access nodes/relationships with the same access value?– cybersam
Nov 13 '18 at 21:20
So, a user has a specific
access string, and s/he can only access nodes/relationships with the same access value?– cybersam
Nov 13 '18 at 21:20
add a comment |
1 Answer
1
active
oldest
votes
If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.
For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):
MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
a.access = $access AND
k.access = $access AND
b.access = $access
RETURN p;
Or, more generically (but perhaps less efficiently):
MATCH p= <an arbitrary path expression>
WHERE
ALL(n IN NODES(p) WHERE n.access = $access) AND
ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53264938%2fneo4j-node-security-access-controls%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.
For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):
MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
a.access = $access AND
k.access = $access AND
b.access = $access
RETURN p;
Or, more generically (but perhaps less efficiently):
MATCH p= <an arbitrary path expression>
WHERE
ALL(n IN NODES(p) WHERE n.access = $access) AND
ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
add a comment |
If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.
For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):
MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
a.access = $access AND
k.access = $access AND
b.access = $access
RETURN p;
Or, more generically (but perhaps less efficiently):
MATCH p= <an arbitrary path expression>
WHERE
ALL(n IN NODES(p) WHERE n.access = $access) AND
ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
add a comment |
If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.
For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):
MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
a.access = $access AND
k.access = $access AND
b.access = $access
RETURN p;
Or, more generically (but perhaps less efficiently):
MATCH p= <an arbitrary path expression>
WHERE
ALL(n IN NODES(p) WHERE n.access = $access) AND
ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.
For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):
MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
a.access = $access AND
k.access = $access AND
b.access = $access
RETURN p;
Or, more generically (but perhaps less efficiently):
MATCH p= <an arbitrary path expression>
WHERE
ALL(n IN NODES(p) WHERE n.access = $access) AND
ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
answered Nov 13 '18 at 21:32
cybersam
38.6k43151
38.6k43151
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
add a comment |
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Sorry, should have delved more into how the access model works. Each pair of numbers represent access perms for a particular type of data and having a positive value gives you access to lower levels. 00 - no access 01 - access to lvl 1 10 - access to lvl 1,2 Outside of the tuples, the overall combination may also impose its own access permissions. It's a complex mechanism which needs to be calculated on a per node basis. I can get a y/n by calling a function that takes user with node permissions. So I'd need to filter the graph based on calling this against every node.
– neelzp
Nov 13 '18 at 22:26
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
Re: "per node basis" --> do you mean "per node AND per relationship"? Also, if you are looking for a Cypher approach, it might be possible to do it in our Cypher (depending on the business logic), or you could write your own procedure or function.
– cybersam
Nov 13 '18 at 22:36
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
I amended my original question/title. I realized this access model only applies to the node itself, not the relationship. Based on our back and forth, I'm thinking a custom function might fit the bill better. Your help is much appreciated!
– neelzp
Nov 14 '18 at 14:39
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53264938%2fneo4j-node-security-access-controls%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How exactly are the
accessproperties supposed to be used?– cybersam
Nov 13 '18 at 21:04
They're intended to control access to information based on a particular user's permissions. Conceptually, each user has a very specific subgraph they can access and run queries against.
– neelzp
Nov 13 '18 at 21:18
So, a user has a specific
accessstring, and s/he can only access nodes/relationships with the sameaccessvalue?– cybersam
Nov 13 '18 at 21:20