Node-level permissions

[Romildo-Cumbe]

Hi,

I wish to secure access for the data contained in my Neo4j database down to the level of individual nodes.

In a relational database, this is called "Row-Level-Security".

https://mariadb.com/blog/protect-your-data-row-level-security-mariadb-100
http://kb.tableau.com/articles/knowledgebase/row-level-security-and-user-filters

[developerrespig]

Hi,

are there any news for this feature? I just have a use case where we need this too and I'm currently looking for a solution.

[AdaptiveThinking]

Is there some Update on this? Implementation should be not too hard, because you can just prefix a filter-Expression in front of an user query. (See e.g. "Splunk", "LogInsight" ...)

So as a Role you would say 'if node.[fieldname] == "abc"', then a user with that role would only get nodes back if the node has a field with value "abc".

See e.g. https://blogs.vmware.com/management/files/2018/03/2018-03-14_10-51-31.png

This is NOT a replacement to multiple Databases (see #266), because for easy multitenancy you want a stronger seperation than this.

[craigtaverner]

Node level security has been under discussion for some time as an extension to the role-based access control introduced in Neo4j 3.1, and is under consideration. At the moment, however, the only option you have to achieve this is the procedure-based security model (also introduced in 3.1). This approach means that you give specific procedures access to the sub-graphs. The definition of the sub-graph is encoded into the code of the procedure. For more information see:

• https://neo4j.com/blog/custom-security-plugins-user-defined-procedures-neo4j-enterprise/
• https://neo4j.com/docs/operations-manual/current/security/authentication-authorization/subgraph-access-control/

[mnd999]

Neo4j 4.1 provides granular security for both reads and writes at node and property level which meets this requirement. For information on how to set this up, see:

• https://neo4j.com/docs/operations-manual/4.1/authentication-authorization/access-control/

If you feel this does not meet the requirement, feel free to reopen this issue.

[sep2]

Correct me if I’m wrong, but this is NOT what to expected as “node-level security”.

@mnd999 The docs link basically says you could do authorization only based on name of node/property, but not the value of a property.

This includes controls permission to traverse, read or write data based on node labels, relationship types, and database and property names.

Please refer to Postgres for an example of “row-level security”, which means you could filter out rows based on what’s inside the rows, not the name of the columns or tables.

[brandonsmith86]

I have to agree with @sep2. This implementation of node-level security is more akin to column-level security in relational databases.

[nithin-uppila]

@sep2 Any update on this, were you able to implement this?

[sep2]

@nithin-uppila Sorry to hear in two years later this is still not implemented. We switched away from neo4j since it lacks many features and doesn't provide too much gain regarding performance. I don't see neo4j will implement this in the near future. In fact if you are considering row level security is a must, then relational model may be a better fit than graph model to your domain. You may want to look at the AGE project for Postgres as an alternative. We are still using raw Postgres though. It has everything we need to do the "graph" things, and much more matured in other features.

[mlraviol]

Hallo! We have good news, Neo4j is enhancing the current RBAC implementation by enabling access control based on the value of properties on a node.
Neo4j controls READ, TRAVERSE and MATCH privileges on nodes based on a single property value being equal/not equal to a certain literal value. This feature will be released in Neo4j 5.21 (next month).

Let me add an couple of examples here:
GRANT READ { address } ON GRAPH * FOR (n:Email|Website) WHERE n.domain = 'exampledomain.com' TO regularUsers
or
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.securityLevel > 3 TO regularUsers

[nithin-uppila]

Many thanks for the detailed response @sep2