Skip to content
Developer Edition runs on one host and does not require a product license file. Need multi-host deployment or performance testing at scale? Explore Enterprise Edition

Configure user access

Add the user to a service group, then grant connection, schema access, and resource privileges. This guide walks through allowing user1 to query /finance/transactions.

Prerequisites

  • The user has been created in the Meta service, is enabled, and is not locked. For more information, see User management.
  • You are connected to the Graph service as the owner of the target service group. The owner holds the built-in ADMIN role.
  • The schemas and resources already exist. The example uses /finance/transactions; replace this with your actual path.

Note

If the user has already joined the service group, skip INVITE USER. Choose either role-based grants or direct grants below.

Choose direct grants or role-based grants

Method Use case Ongoing management
Role-based grants (recommended) Multiple users have the same responsibilities Change the role to update their access together.
Direct grants Temporary or individual access needs Update the user's grants separately.

A user's direct privileges and role privileges are combined. If the same privilege comes from several sources, the user can still perform the operation as long as one source remains.

Configure access by using a role

Run these commands in a GQL client connected to the Graph service as a user with ADMIN. The example creates finance_reader. If that role already exists, inspect its existing privileges first.

  1. Invite the user to the current service group:

    INVITE USER user1

  2. Create a role for querying the graph:

    CREATE ROLE IF NOT EXISTS finance_reader COMMENT "Read finance graphs"

  3. Grant the connection privilege to the role:

    GRANT CONNECT TO ROLE finance_reader

  4. Grant access to the non-default schema and permission to query the graph:

    '''
GRANT USAGE ON SCHEMA /finance TO ROLE finance_reader
'''

'''
GRANT MATCH ON GRAPH /finance/transactions TO ROLE finance_reader
'''

    USAGE allows the user to see and reference /finance. MATCH allows the user to query transactions. A regular user needs both privileges to query this graph.

  5. Grant the role to the user:

    GRANT ROLE finance_reader TO USER user1

  6. After the privilege change has synchronized, reconnect as user1 and run the following statements to verify access:

    '''
SESSION SET SCHEMA /finance
'''

'''
SESSION SET GRAPH transactions
'''

'''
MATCH (n) RETURN n LIMIT 1
'''

The query should succeed and return at most one node. An empty graph returns no rows; a successful empty result also confirms that the query privilege check passed.

Grant privileges directly to a user

For access that applies to only one user, skip the custom role and grant the privileges directly. For example:

View direct grants 
'''
INVITE USER user1
'''

'''
GRANT CONNECT TO USER user1
'''

'''
GRANT USAGE ON SCHEMA /finance TO USER user1
'''

'''
GRANT MATCH ON GRAPH /finance/transactions TO USER user1
'''

A direct grant does not create a custom role. In the output of SHOW PRIVILEGES FOR USER user1, the role column is empty for direct grant records.

Common authorization scenarios

Use these examples independently. The connection-only example includes an invitation. The other examples require the user to have joined the service group and the target graphs and schemas to exist.

Allow only connections to the service group

View grant commands 
'''
INVITE USER user1
'''

'''
GRANT CONNECT TO USER user1
'''

The user can establish a connection but has no action privileges on resources in schemas.

Query a graph in the default schema

View grant commands 
'''
CREATE ROLE IF NOT EXISTS movie_reader COMMENT "Read movie graph"
'''

'''
GRANT CONNECT TO ROLE movie_reader
'''

'''
GRANT MATCH ON GRAPH /default_schema/movie TO ROLE movie_reader
'''

'''
GRANT ROLE movie_reader TO USER user1
'''

Every user has implicit USAGE on /default_schema. This privilege does not need to be, and cannot be, granted explicitly.

Read and write a specific graph

View grant commands 
'''
CREATE ROLE IF NOT EXISTS finance_writer COMMENT "Read and write transactions"
'''

'''
GRANT CONNECT TO ROLE finance_writer
'''

'''
GRANT USAGE ON SCHEMA /finance TO ROLE finance_writer
'''

'''
GRANT MATCH, INSERT, UPDATE, DELETE ON GRAPH /finance/transactions TO ROLE finance_writer
'''

'''
GRANT ROLE finance_writer TO USER user1
'''

Grant only the actions required by the workload. For example, a user who only appends data typically does not need DELETE.

Access all graphs in a schema

View grant commands 
'''
CREATE ROLE IF NOT EXISTS finance_analyst COMMENT "Read all finance graphs"
'''

'''
GRANT CONNECT TO ROLE finance_analyst
'''

'''
GRANT USAGE, MATCH ANY GRAPH ON SCHEMA /finance TO ROLE finance_analyst
'''

'''
GRANT ROLE finance_analyst TO USER user1
'''

MATCH ANY GRAPH allows queries on every graph in the schema, including graphs created later. It does not grant write or administrative privileges.

Revoke access

Depending on how access was granted, you can revoke the role from the user:

REVOKE ROLE finance_reader FROM USER user1

Alternatively, revoke a privilege from the role:

REVOKE MATCH ON GRAPH /finance/transactions FROM ROLE finance_reader

After revoking access, test the original operation as the target user. If it still succeeds, check whether another role, a direct grant, ownership, or a parent-resource privilege provides the same access.

Note

Revoking CONNECT prevents new sessions but does not terminate existing sessions. To disconnect a user immediately, find the session by using SHOW SESSIONS, and then terminate it by using KILL SESSION.

More information