Skip to content

Commit 4020800

Browse files
andrejtonevandrejtonev
committed
auth database
1 parent 981dce1 commit 4020800

File tree

5 files changed

+238
-0
lines changed

5 files changed

+238
-0
lines changed

‎pages/database-management/authentication-and-authorization.mdx

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,28 @@ Learn how authentication and authorization works in Memgraph. Manage users and
99
roles, secure the database with role-based and fine-grained access control and
1010
learn how to integrate with other authentication systems.
1111

12+
## Recent changes to authentication requirements
13+
14+
Recent updates to Memgraph have introduced new requirements for authentication and authorization operations, particularly affecting multi-tenant environments:
15+
16+
### AUTH privilege requirement
17+
18+
Authentication and authorization queries (such as `CREATE USER`, `CREATE ROLE`, `GRANT`, `DENY`, `REVOKE`, etc.) now require the `AUTH` privilege. Users must be explicitly granted this privilege to perform user and role management operations.
19+
20+
### Default database access requirement
21+
22+
In addition to the `AUTH` privilege, users must also have access to the default "memgraph" database to execute authentication and authorization queries. This requirement applies even when the user is working in other databases within a multi-tenant environment.
23+
24+
### Multi-tenant recommendations
25+
26+
For multi-tenant environments, we recommend:
27+
- Treating the default "memgraph" database as an administrative/system database
28+
- Restricting access to the "memgraph" database to privileged users only
29+
- Storing application data in tenant-specific databases
30+
- Ensuring users who need to perform authentication operations have appropriate access
31+
32+
For detailed information about these requirements and best practices, see the [Role-based access control](/database-management/authentication-and-authorization/role-based-access-control#authentication-and-authorization-requirements) and [Multi-tenancy](/database-management/multi-tenancy#default-database-best-practices) documentation.
33+
1234
## [Users](/database-management/authentication-and-authorization/users)
1335

1436
Learn how to manage users in Memgraph.

‎pages/database-management/authentication-and-authorization/multiple-roles.mdx

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,59 @@ Key benefits:
1717
- **Tenant Isolation**: Users can have different permissions for different databases
1818
- **SSO Integration**: Support for external identity providers that return multiple roles
1919

20+
## Authentication and authorization requirements
21+
22+
Recent changes to Memgraph have introduced new requirements for authentication and authorization operations in multi-tenant environments. These changes affect how users can perform user and role management operations.
23+
24+
### AUTH privilege requirement
25+
26+
Authentication and authorization queries (such as `CREATE USER`, `CREATE ROLE`, `GRANT`, `DENY`, `REVOKE`, etc.) now require the `AUTH` privilege. Users must be explicitly granted this privilege to perform user and role management operations.
27+
28+
### Default database access requirement
29+
30+
In addition to the `AUTH` privilege, users must also have access to the default "memgraph" database to execute authentication and authorization queries. This requirement applies even when the user is working in other databases within a multi-tenant environment.
31+
32+
<Callout type="warning">
33+
**Multi-tenant environments**: This requirement is only a concern in multi-tenant environments where users have access to databases other than the default "memgraph" database. In single-database deployments, this requirement is automatically satisfied.
34+
</Callout>
35+
36+
### Impact on multi-tenant role management
37+
38+
When using multi-tenant roles, ensure that users who need to perform authentication and authorization operations have:
39+
1. The `AUTH` privilege granted to their roles
40+
2. Access to the default "memgraph" database
41+
3. Appropriate role assignments for the "memgraph" database
42+
43+
#### Example: Admin user with multi-tenant roles
44+
45+
```cypher
46+
-- Create admin role with full privileges
47+
CREATE ROLE system_admin;
48+
GRANT ALL PRIVILEGES TO system_admin;
49+
GRANT DATABASE memgraph TO system_admin;
50+
51+
-- Create tenant-specific admin roles
52+
CREATE ROLE tenant1_admin;
53+
CREATE ROLE tenant2_admin;
54+
GRANT MATCH, CREATE, MERGE, SET, DELETE, INDEX TO tenant1_admin;
55+
GRANT MATCH, CREATE, MERGE, SET, DELETE, INDEX TO tenant2_admin;
56+
GRANT DATABASE tenant1_db TO tenant1_admin;
57+
GRANT DATABASE tenant2_db TO tenant2_admin;
58+
59+
-- Create admin user
60+
CREATE USER admin_user IDENTIFIED BY 'admin_password';
61+
62+
-- Assign roles with database-specific assignments
63+
SET ROLE FOR admin_user TO system_admin ON memgraph;
64+
SET ROLE FOR admin_user TO tenant1_admin ON tenant1_db;
65+
SET ROLE FOR admin_user TO tenant2_admin ON tenant2_db;
66+
```
67+
68+
In this setup, `admin_user` can:
69+
- Perform authentication/authorization operations when connected to the "memgraph" database
70+
- Manage tenant1_db data when connected to tenant1_db
71+
- Manage tenant2_db data when connected to tenant2_db
72+
2073
## Database access with users and roles
2174

2275
### Basic database access
@@ -287,3 +340,7 @@ SET ROLE multi_db_role FOR user1 ON db2;
287340
4. **Test permission combinations**: Verify that multi-tenant permissions work correctly in each database
288341
5. **Document role assignments**: Keep track of which users have which roles for which databases
289342
6. **Use deny sparingly**: Remember that deny takes precedence over grant across all databases
343+
7. **Treat memgraph database as admin database**: In multi-tenant environments, restrict access to the default "memgraph" database to privileged users only
344+
8. **Ensure AUTH privilege access**: Users who need to perform authentication/authorization operations must have both the `AUTH` privilege and access to the "memgraph" database
345+
9. **Separate application data**: Store all application data in tenant-specific databases, not in the default "memgraph" database
346+
10. **Plan for authentication operations**: Design your role structure to ensure that users who need to manage users and roles have appropriate access to the "memgraph" database

‎pages/database-management/authentication-and-authorization/role-based-access-control.mdx

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,66 @@ of the following commands:
121121
| Privileges to specific labels. | `ALL LABELS` |
122122
| Privileges to specific relationships types. | `ALL EDGE TYPES` |
123123

124+
## Authentication and authorization requirements
125+
126+
Recent changes to Memgraph have modified how user privileges are generated for authentication and authorization operations. These changes affect multi-tenant environments where users have access to databases other than the default "memgraph" database.
127+
128+
### AUTH privilege requirement
129+
130+
Authentication and authorization queries (such as `CREATE USER`, `CREATE ROLE`, `GRANT`, `DENY`, `REVOKE`, etc.) now require the `AUTH` privilege. Users must be explicitly granted this privilege to perform user and role management operations.
131+
132+
### Default database access requirement
133+
134+
In addition to the `AUTH` privilege, users must also have access to the default "memgraph" database to execute authentication and authorization queries. This requirement applies even when the user is working in other databases within a multi-tenant environment.
135+
136+
<Callout type="warning">
137+
**Multi-tenant environments**: This requirement is only a concern in multi-tenant environments where users have access to databases other than the default "memgraph" database. In single-database deployments, this requirement is automatically satisfied.
138+
</Callout>
139+
140+
### Recommended approach for multi-tenant environments
141+
142+
In multi-tenant environments, we recommend treating the default "memgraph" database as an administrative/system database rather than storing application data in it. This approach provides better security and isolation:
143+
144+
1. **Restrict access to the memgraph database**: Only grant access to privileged users who need to perform authentication and authorization operations
145+
2. **Use tenant-specific databases**: Store application data in dedicated tenant databases rather than the default database
146+
3. **Separate administrative functions**: Keep user management and system administration separate from application data
147+
148+
#### Example setup for multi-tenant environments
149+
150+
```cypher
151+
-- Create admin role with full privileges
152+
CREATE ROLE admin;
153+
GRANT ALL PRIVILEGES TO admin;
154+
GRANT DATABASE memgraph TO admin;
155+
156+
-- Create tenant-specific roles
157+
CREATE ROLE tenant1_user;
158+
CREATE ROLE tenant2_user;
159+
160+
-- Grant appropriate permissions to tenant roles
161+
GRANT MATCH, CREATE, MERGE, SET, DELETE TO tenant1_user;
162+
GRANT MATCH, CREATE, MERGE, SET, DELETE TO tenant2_user;
163+
164+
-- Grant access to tenant databases only
165+
GRANT DATABASE tenant1_db TO tenant1_user;
166+
GRANT DATABASE tenant2_db TO tenant2_user;
167+
168+
-- Create users
169+
CREATE USER admin_user IDENTIFIED BY 'admin_password';
170+
CREATE USER tenant1_user_account IDENTIFIED BY 'password1';
171+
CREATE USER tenant2_user_account IDENTIFIED BY 'password2';
172+
173+
-- Assign roles
174+
SET ROLE FOR admin_user TO admin;
175+
SET ROLE FOR tenant1_user_account TO tenant1_user;
176+
SET ROLE FOR tenant2_user_account TO tenant2_user;
177+
```
178+
179+
In this setup:
180+
- `admin_user` has access to the "memgraph" database and can perform all authentication/authorization operations
181+
- `tenant1_user_account` and `tenant2_user_account` can only access their respective tenant databases
182+
- Application data is stored in tenant-specific databases, not in the default "memgraph" database
183+
124184
After the first user is created, Memgraph will execute a query if and only if
125185
either a user or its role is granted that privilege and neither the user nor its
126186
role are denied that privilege. Otherwise, Memgraph will not execute that

‎pages/database-management/multi-tenancy.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,65 @@ A default database named 'memgraph' is automatically created during startup. New
2020
users are granted access only to this default database. The default
2121
database name cannot be altered.
2222

23+
### Default database best practices
24+
25+
In multi-tenant environments, we recommend treating the default "memgraph" database as an administrative/system database rather than storing application data in it. This approach provides better security and isolation, especially given recent changes to authentication and authorization requirements.
26+
27+
#### Why treat memgraph as an admin database?
28+
29+
Recent changes to Memgraph require that users have both the `AUTH` privilege and access to the default "memgraph" database to execute authentication and authorization queries. This requirement affects multi-tenant environments where users might have access to other databases but not the default one.
30+
31+
#### Recommended setup
32+
33+
1. **Restrict memgraph database access**: Only grant access to the "memgraph" database to privileged users who need to perform system administration tasks
34+
2. **Use tenant-specific databases**: Store all application data in dedicated tenant databases
35+
3. **Separate concerns**: Keep user management, role management, and system administration separate from application data
36+
37+
#### Example configuration
38+
39+
```cypher
40+
-- Create admin role with full system privileges
41+
CREATE ROLE system_admin;
42+
GRANT ALL PRIVILEGES TO system_admin;
43+
GRANT DATABASE memgraph TO system_admin;
44+
45+
-- Create tenant-specific roles (no access to memgraph database)
46+
CREATE ROLE tenant1_admin;
47+
CREATE ROLE tenant1_user;
48+
CREATE ROLE tenant2_admin;
49+
CREATE ROLE tenant2_user;
50+
51+
-- Grant appropriate permissions to tenant roles
52+
GRANT MATCH, CREATE, MERGE, SET, DELETE, INDEX TO tenant1_admin;
53+
GRANT MATCH, CREATE, MERGE, SET, DELETE TO tenant1_user;
54+
GRANT MATCH, CREATE, MERGE, SET, DELETE, INDEX TO tenant2_admin;
55+
GRANT MATCH, CREATE, MERGE, SET, DELETE TO tenant2_user;
56+
57+
-- Grant access only to tenant databases
58+
GRANT DATABASE tenant1_db TO tenant1_admin, tenant1_user;
59+
GRANT DATABASE tenant2_db TO tenant2_admin, tenant2_user;
60+
61+
-- Create users
62+
CREATE USER system_admin_user IDENTIFIED BY 'admin_password';
63+
CREATE USER tenant1_admin_user IDENTIFIED BY 't1_admin_pass';
64+
CREATE USER tenant1_regular_user IDENTIFIED BY 't1_user_pass';
65+
CREATE USER tenant2_admin_user IDENTIFIED BY 't2_admin_pass';
66+
CREATE USER tenant2_regular_user IDENTIFIED BY 't2_user_pass';
67+
68+
-- Assign roles
69+
SET ROLE FOR system_admin_user TO system_admin;
70+
SET ROLE FOR tenant1_admin_user TO tenant1_admin;
71+
SET ROLE FOR tenant1_regular_user TO tenant1_user;
72+
SET ROLE FOR tenant2_admin_user TO tenant2_admin;
73+
SET ROLE FOR tenant2_regular_user TO tenant2_user;
74+
```
75+
76+
In this configuration:
77+
- `system_admin_user` can perform all authentication/authorization operations and has access to the "memgraph" database
78+
- Tenant users can only access their respective tenant databases
79+
- Application data is completely isolated in tenant-specific databases
80+
- The "memgraph" database serves purely as an administrative database
81+
2382
## Isolated databases
2483

2584
Isolated databases within Memgraph function as distinct single-database Memgraph

‎pages/help-center/errors/auth.mdx

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,45 @@ be missing.
3333
Queries that modify a user's authentication data are forbidden while using
3434
an auth module. Users are handled by the module and local users are disabled.
3535

36+
## User doesn't have AUTH privilege
37+
38+
This error occurs when a user attempts to execute authentication or authorization queries (such as `CREATE USER`, `CREATE ROLE`, `GRANT`, `DENY`, `REVOKE`, etc.) without the required `AUTH` privilege.
39+
40+
### Solution
41+
42+
Grant the `AUTH` privilege to the user or their role:
43+
44+
```cypher
45+
-- Grant AUTH privilege to a user
46+
GRANT AUTH TO username;
47+
48+
-- Grant AUTH privilege to a role
49+
GRANT AUTH TO role_name;
50+
```
51+
52+
### Multi-tenant environments
53+
54+
In multi-tenant environments, users must also have access to the default "memgraph" database to execute authentication and authorization queries. See the [authentication requirements documentation](/database-management/authentication-and-authorization/role-based-access-control#authentication-and-authorization-requirements) for more details.
55+
56+
## User doesn't have access to the memgraph database [#error-4]
57+
58+
This error occurs in multi-tenant environments when a user attempts to execute authentication or authorization queries but doesn't have access to the default "memgraph" database.
59+
60+
### Solution
61+
62+
Grant access to the "memgraph" database to the user or their role:
63+
64+
```cypher
65+
-- Grant access to memgraph database for a user
66+
GRANT DATABASE memgraph TO username;
67+
68+
-- Grant access to memgraph database for a role
69+
GRANT DATABASE memgraph TO role_name;
70+
```
71+
72+
### Best practice
73+
74+
In multi-tenant environments, we recommend treating the "memgraph" database as an administrative/system database and restricting access to privileged users only. See the [multi-tenancy documentation](/database-management/multi-tenancy#default-database-best-practices) for recommended setup patterns.
75+
3676

3777
<CommunityLinks/>

0 commit comments

Comments
 (0)