ONTOTEXT ANSWER:
You’ve probably seen our news on the topic and are getting confused between our products. There is Ontotext’s GraphDB and then there is Ontotext Platform. The graph database does not support ABAC (attribute-based access control). It supports RBAC (role-based access control). Ontotext Platform, which is built on top of Ontotext’s GraphDB, offers object-level RBAC security, with ABAC attribute filtering rules on it.
Here’s an example:
EuropeanCompanyRead:
description: "Role which can read properties of companies based in the USA"
actions: [
Company/*/read/
(where: {headquarters: {country: {name: {EQ: “USA”}}}})
]
Using this declarative configuration, we define a role that can read only Company instances with headquarters in the USA. The same can be also declared for mutations(write) and can use all different filter options supported by Ontotext Platform such as equality/inequality, less-than/greater-than, regular expression, inside/outside of an array of values and different combination between them. See filter examples.
An additional option is to use the user’s username in the filter clause, for example:
rbac:
Expert:
actions: [
'Organization/*/*/(where: {creator: {user: {userName: {EQ: ${ctx.claims.preferred_username}}}}})'
]
The Expert role above will allow full access to all Organizations that have a creator property pointing towards their username in the JWT. In other words, each user who has the Expert role will have a full access to the Organizations that were created by them.
Did this help you solve your issue? Your opinion is important not only to us but also to your peers.
Share this article
