Access control: Managing groups

Role-based access control

Linkurious Enterprise relies on a role-based access control model:

• Users are associated with one or multiple roles (called "groups" in Linkurious Enterprise).
• Each group has a set of access-rights.
• A user's access-rights are the combination of their groups' access-rights.

Group management page

This page is accessed via Admin > Users & Groups in the main menu.

This page lists:

• Built-in groups: these groups are pre-defined when installing Linkurious Enterprise (they are listed after Custom groups).
• Custom groups: these groups are created by the Administrators.

Group management operations available to the Administrators are the following:

• Create a custom group.
• Edit a custom group.
• Delete a custom group.

Creating a group

Creating a group is a 2-step process:

1. "General & Admin rights": define access-rights on the features.
2. "Access-rights": define access-rights on the data.

General & Admin rights

Features access-rights description

Queries access-rights

• No access: the user group cannot execute queries (and cannot create them).
• Can run queries: the user group can execute read and write queries it was shared with, but cannot create them.
• Can create read-only queries and run queries:
  • The user group can create queries that cannot alter the data in the database.
  • The user group can execute read and write queries it created or it was shared with.
  • Can create read/write queries and run queries:
    • The user group can create queries that can read from database or write in the database.
    • The user group can execute read and write queries it created or it was shared with.

    Write queries are identified by keywords in their code:

    • Cypher: SET, CREATE, MERGE, DELETE, REMOVE, FOREACH, LOAD, DROP, CALL
    • Gremlin: addProperty, property, addE, addV, drop, remove, clear

Custom actions access-rights

• No access: the user group cannot execute custom actions (and cannot create them).
• Can run custom actions: the user group can execute custom action it was shared with but cannot create them.
• Can create and run custom actions:
  • The user group can create custom actions.
  • The user group can execute custom actions it was shared with.

Alert access-rights

• No access: the user group cannot access the Alerts (and cannot create them).
• Process alerts: the user group can access the Alerts, process the matches but cannot create new Alerts.
• Create and process alerts: the user group can process existing Alerts and can create new Alerts.

Admin access-rights

• Manage users & groups: the user group can create and edit users and manage groups and their permissions.
• Manage data-source schema: the user group can enrich and edit the schema, and to switch to strict-mode.
• Manage data-source default styles: the user group can change the default styles that are applied to all new visualizations across users.
• Re-index the data-source: the user group can launch a re-index of the database. If handled without care, re-indexing might overload the database as indexing is a costly process.
• Re-connect the data-source: the user group can initiate a connection sequence when the connection has been interrupted.

Access-rights with multiple groups

For users that belong to multiple groups, access-rights are cumulative. In other words, a user can do something if at least one of their groups allows them to do it.

For example if user belongs to 2 groups: one having No access and the other Process Alerts for the Alert rights, then they have the right to Process Alerts because one of their groups allows them to do so.

Access-rights on the data

There are 2 available options. You can read about them in their dedicated sections:

• Standard access-rights: the default option, access-rights are defined at the node category / edge type level.
• Property-level access-rights: offers, on top of standard access-rights, the ability to tune access-rights at the property-level.