Monitor Access Control Activity

All Graph Lakehouse data access and access control modifications are logged in a system table named sth_acl. System administrators can monitor the sth_acl system table for various types of access control entries and activities. Those events include:

• "Init file execution"
• "Authorization Success"
• "Authorization Failure"
• "Create Role"
• "Drop Role"
• "Alter Role"
• "Alter Graph" (changes of ownership)
• "Alter Owned By"
• "Grant Membership"
• "Grant Privilege"
• "Revoke Membership"
• "Revoke Privilege"

In addition to monitoring access, an administrator can diagnose failures by examining the entries in the "sth_acl" table. You can query the Graph Lakehouse system table using regular SPARQL queries just like that of any other database source. For example:

azgi -c "select * where {table 'sth_acl'}"

The following provides a sample query of sth_acl table entries following execution of a GRANT statement:

xrowid | query | time | user | action_type | detail ---------+-------+---------------+------+-----------------------+------------------------------------------------ 1219813 | 12453 | 2020-11-20... | test | Grant Privilege | Granted privileges 1 on to 1220751 | 0 | 2020-11-20... | | Authorization Success | test 1219294 | 0 | 2020-11-20... | | Authorization Success | test 1212465 | 12370 | 2020-11-20... | test | Grant Membership | Granted membership of to

Access Control System Graphs

All Graph Lakehouse role and object attributes and privileges are stored in one of two system graphs, or .

Regardless of whether users are authenticated locally or by a remote directory service, the privileges granted to specific groups or roles is stored locally within the system graph named .

A second system graph named stores privileges to perform operations such as SELECT, UPDATE, DROP, and EXECUTE on objects such as graphs, views, and queries. When an object is created, its creator is designated as the owner of that object and that information is recorded with the entry of a triple in the system graph. To allow other users to access the same object, the owner can grant privileges on that object to other Graph Lakehouse roles.

The system graph is updated with new triples whenever an object is either created or dropped or if its privileges are altered. Only system administrators assigned the superuser role or belonging to a group with administration privileges have the ability to modify the system graph to update privileges.

The System Graph

The Graph Lakehouse**** system graph is updated whenever a role is created, altered, or dropped. The following triples get inserted, updated, or removed from the graph, whenever one of these operations is performed.

INSERT DATA { GRAPH { a ; attrib_list; # combined list of attributes "passwd"^^xsd:string; # optional triple for local authentication NNN; # optional triple NNN; # optional triple "member1,member2"; # list of all the roles granted privileges . } }

The System Graph

A second system graph, named , is updated with new triples whenever an object is created or dropped or if its privileges are altered. The following triples get inserted, updated, or removed from the system graph whenever one of these operations is performed.

INSERT DATA { GRAPH { <aclobj_uri> # <based on objname,objtype,objcontainer name; <graph | view | query | udx | subject | predicate | triple> ; acl; # mandatory: serialized json string for Privileges (graphid | viewid | queryid); # optional: for graph “container” ; # optional: for udx; name of the library

for subject - name of the graph

for predicate - name of the graph

for triple - name of the graph

. } }

Again, only an Graph Lakehouse system administrator, assigned the superuser role or belonging to a group with administration privileges, has the ability to directly modify the system graph.