Sessionless mode

Sessionless mode lets SDK clients connect to NebulaGraph Database Developer Edition with an empty username and password. The Graph service checks request privileges using the identity set by sessionless_user.

Shared user privileges

All sessionless clients share this user's privileges. Use a dedicated regular user and grant only the privileges the application needs. Do not use the service group owner or a user with ADMIN.

Prerequisites

• Start NebulaGraph Database Developer Edition by following Deploy Developer Edition with Docker Compose.
• Have the Meta service's root password and a Graph service account with ADMIN.
• Identify the schemas, graphs, and operations the application needs so that you can grant the required privileges.

Configure sessionless mode

This example uses the regular user testUser1. Run user creation commands inside the ngctl container. Edit configuration and manage containers from the deployment directory on the development machine. For PowerShell syntax, see Windows PowerShell.

1. Follow Run ngctl with Docker Compose to log in to the Meta service, then create the user:

   ngctl user create testUser1 --password testPassword1
   

2. Connect to the Graph service as a user with ADMIN, then invite the user and grant the connection privilege:

   '''
   INVITE USER testUser1
   '''
   
   '''
   GRANT CONNECT TO USER testUser1
   '''
   

   Follow Configure user access to grant the resource privileges the application needs. Access to a non-default schema requires USAGE; querying a graph also requires MATCH.

3. Return to the development machine's terminal. Append --sessionless_user=testUser1 to services.graphd.command in compose.yaml, keeping the existing arguments. The list should look as follows. Keep the rest of the service configuration unchanged:

   services:
     graphd:
       command:
         - --meta_server_addrs=graph-cluster:9559
         - --port=9669
         - --host=graph-cluster
         - --memory_dynamic_reserved_gb=1
         - --sessionless_user=testUser1
   

4. Check and apply the configuration from the directory containing compose.yaml. This recreates the Graph container and interrupts its existing connections:

   docker compose config --quiet
   ACCEPT_EULA=Y docker compose up -d graphd
   

   Check container status with docker compose ps --all. Running only docker compose restart graphd does not apply the changed startup arguments.

5. Set both the username and password to "" in the SDK and connect to the Graph service. Run RETURN 1 AS result and expect 1. Then run an application query to confirm that testUser1 can access the required resources. For connection code, see the Java SDK guide and Go SDK guide.

Disable sessionless mode

Remove --sessionless_user=testUser1 from services.graphd.command, save the file, and run these commands from the deployment directory:

docker compose config --quiet
ACCEPT_EULA=Y docker compose up -d graphd

After the Graph container is recreated, clients can no longer sign in with an empty username and password. Reconnect with a normal username and password.

Sessionless mode skips Meta user authentication, so disabling testUser1 alone does not stop this access. Revoking the user's CONNECT prevents new sessionless connections but does not automatically end existing connections.