Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/
Documentation version: v5.3.2

# Configure user access

Add the user to a service group, then grant connection, schema access, and resource privileges. This guide walks through allowing `user1` to query `/finance/transactions`.

## Prerequisites

- The user has been created in the Meta service, is enabled, and is not locked. For more information, see [User management](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/).
- You are connected to the Graph service as the owner of the target service group. The owner holds the built-in `ADMIN` role.
- The schemas and resources already exist. The example uses `/finance/transactions`; replace this with your actual path.

Note

If the user has already joined the service group, skip `INVITE USER`. Choose either role-based grants or direct grants below.

## Choose direct grants or role-based grants

 | Method | Use case | Ongoing management
 | Role-based grants (recommended) | Multiple users have the same responsibilities | Change the role to update their access together.
 | Direct grants | Temporary or individual access needs | Update the user's grants separately.

A user's direct privileges and role privileges are combined. If the same privilege comes from several sources, the user can still perform the operation as long as one source remains.

## Configure access by using a role

Run these commands in a GQL client connected to the Graph service as a user with `ADMIN`. The example creates `finance_reader`. If that role already exists, inspect its existing privileges first.

1. 

Invite the user to the current service group:

````
INVITE USER user1

````

2. 

Create a role for querying the graph:

````
CREATE ROLE IF NOT EXISTS finance_reader COMMENT "Read finance graphs"

````

3. 

Grant the connection privilege to the role:

````
GRANT CONNECT TO ROLE finance_reader

````

4. 

Grant access to the non-default schema and permission to query the graph:

````
'''
GRANT USAGE ON SCHEMA /finance TO ROLE finance_reader
'''

'''
GRANT MATCH ON GRAPH /finance/transactions TO ROLE finance_reader
'''

````

`USAGE` allows the user to see and reference `/finance`. `MATCH` allows the user to query `transactions`. A regular user needs both privileges to query this graph.

5. 

Grant the role to the user:

````
GRANT ROLE finance_reader TO USER user1

````

6. 

After the privilege change has synchronized, reconnect as `user1` and run the following statements to verify access:

````
'''
SESSION SET SCHEMA /finance
'''

'''
SESSION SET GRAPH transactions
'''

'''
MATCH (n) RETURN n LIMIT 1
'''

````

The query should succeed and return at most one node. An empty graph returns no rows; a successful empty result also confirms that the query privilege check passed.

## Grant privileges directly to a user

For access that applies to only one user, skip the custom role and grant the privileges directly. For example:

View direct grants

````
'''
INVITE USER user1
'''

'''
GRANT CONNECT TO USER user1
'''

'''
GRANT USAGE ON SCHEMA /finance TO USER user1
'''

'''
GRANT MATCH ON GRAPH /finance/transactions TO USER user1
'''

````

A direct grant does not create a custom role. In the output of `SHOW PRIVILEGES FOR USER user1`, the `role` column is empty for direct grant records.

## Common authorization scenarios

Use these examples independently. The connection-only example includes an invitation. The other examples require the user to have joined the service group and the target graphs and schemas to exist.

### Allow only connections to the service group

View grant commands

````
'''
INVITE USER user1
'''

'''
GRANT CONNECT TO USER user1
'''

````

The user can establish a connection but has no action privileges on resources in schemas.

### Query a graph in the default schema

View grant commands

````
'''
CREATE ROLE IF NOT EXISTS movie_reader COMMENT "Read movie graph"
'''

'''
GRANT CONNECT TO ROLE movie_reader
'''

'''
GRANT MATCH ON GRAPH /default_schema/movie TO ROLE movie_reader
'''

'''
GRANT ROLE movie_reader TO USER user1
'''

````

Every user has implicit `USAGE` on `/default_schema`. This privilege does not need to be, and cannot be, granted explicitly.

### Read and write a specific graph

View grant commands

````
'''
CREATE ROLE IF NOT EXISTS finance_writer COMMENT "Read and write transactions"
'''

'''
GRANT CONNECT TO ROLE finance_writer
'''

'''
GRANT USAGE ON SCHEMA /finance TO ROLE finance_writer
'''

'''
GRANT MATCH, INSERT, UPDATE, DELETE ON GRAPH /finance/transactions TO ROLE finance_writer
'''

'''
GRANT ROLE finance_writer TO USER user1
'''

````

Grant only the actions required by the workload. For example, a user who only appends data typically does not need `DELETE`.

### Access all graphs in a schema

View grant commands

````
'''
CREATE ROLE IF NOT EXISTS finance_analyst COMMENT "Read all finance graphs"
'''

'''
GRANT CONNECT TO ROLE finance_analyst
'''

'''
GRANT USAGE, MATCH ANY GRAPH ON SCHEMA /finance TO ROLE finance_analyst
'''

'''
GRANT ROLE finance_analyst TO USER user1
'''

````

`MATCH ANY GRAPH` allows queries on every graph in the schema, including graphs created later. It does not grant write or administrative privileges.

## Revoke access

Depending on how access was granted, you can revoke the role from the user:

````
REVOKE ROLE finance_reader FROM USER user1

````

Alternatively, revoke a privilege from the role:

````
REVOKE MATCH ON GRAPH /finance/transactions FROM ROLE finance_reader

````

After revoking access, test the original operation as the target user. If it still succeeds, check whether another role, a direct grant, ownership, or a parent-resource privilege provides the same access.

Note

Revoking `CONNECT` prevents new sessions but does not terminate existing sessions. To disconnect a user immediately, find the session by using [SHOW SESSIONS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-sessions/), and then terminate it by using [KILL SESSION](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/kill/kill-session/).

## More information

- [Manage roles and privileges](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/manage-roles/)
- [Schema access control](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/schema-access-control/)
- [Authorization overview](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/)
- [Privilege reference](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/)
- [GRANT](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/grant-privilege/) and [REVOKE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/revoke-privilege/)