Tag: Authentication & Authorization

Authentication and authorization are critical components of Geode’s enterprise security architecture. As a production-ready graph database handling sensitive data, Geode provides comprehensive security controls to ensure only authorized users and applications can access your data. Geode implements multiple authentication mechanisms, fine-grained authorization policies, and integration with enterprise identity providers. Combined with Row-Level Security (RLS), encryption, and audit logging, Geode delivers the security guarantees required for regulated industries and mission-critical applications. This guide explores Geode’s authentication and authorization capabilities, from basic username/password authentication through advanced integration patterns with LDAP, OAuth2, and SAML. <h3 id="authentication-mechanisms" class="position-relative d-flex align-items-center group"> Authentication Mechanisms <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authentication-mechanisms" aria-haspopup="dialog" aria-label="Share link: Authentication Mechanisms"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode supports multiple authentication methods to accommodate different deployment scenarios: Username/Password Authentication: The default authentication mechanism uses password hashing with bcrypt or Argon2. Credentials are stored securely in Geode’s system catalogs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create a user with password CREATE USER analyst PASSWORD 'secure_password_123'; -- Connect with credentials -- (Implementation depends on client library) </code></pre></div>TLS Client Certificates: For machine-to-machine authentication, Geode supports mutual TLS (mTLS) where clients present X.509 certificates: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Start server requiring client certificates geode serve --tls-cert server.crt --tls-key server.key \ --tls-client-ca ca.crt --tls-client-auth required # Connect with client certificate geode shell --tls-cert client.crt --tls-key client.key \ --tls-ca ca.crt </code></pre></div>API Tokens: Long-lived tokens for service accounts and automation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Generate an API token CREATE TOKEN service_token FOR USER api_service EXPIRES '2025-12-31' SCOPES 'read:nodes', 'write:edges'; -- Revoke a token REVOKE TOKEN service_token; </code></pre></div>LDAP Integration: Authenticate users against existing LDAP directories: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-toml" data-lang="toml"># geode.toml configuration [auth.ldap] url = "ldaps://ldap.example.com:636" bind_dn = "cn=geode,ou=services,dc=example,dc=com" bind_password_file = "/secure/ldap_password" user_search_base = "ou=users,dc=example,dc=com" user_search_filter = "(uid=%s)" </code></pre></div>OAuth2/OIDC: Integrate with identity providers like Auth0, Okta, or Azure AD: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-toml" data-lang="toml">[auth.oidc] issuer = "https://auth.example.com" client_id = "geode-production" client_secret_file = "/secure/oidc_secret" redirect_url = "https://geode.example.com/auth/callback" </code></pre></div>SAML 2.0: Enterprise single sign-on for web-based access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-toml" data-lang="toml">[auth.saml] idp_metadata_url = "https://idp.example.com/metadata" sp_entity_id = "geode-production" assertion_consumer_service_url = "https://geode.example.com/saml/acs" </code></pre></div> <h3 id="authorization-and-access-control" class="position-relative d-flex align-items-center group"> Authorization and Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-and-access-control" aria-haspopup="dialog" aria-label="Share link: Authorization and Access Control"> Share link </button> </h3>Once authenticated, Geode’s authorization system controls what users can do: Role-Based Access Control (RBAC): Users are assigned roles that define their permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create roles CREATE ROLE readonly; CREATE ROLE analyst; CREATE ROLE admin; -- Grant permissions to roles GRANT SELECT ON GRAPH social_network TO readonly; GRANT SELECT, INSERT ON GRAPH social_network TO analyst; GRANT ALL ON GRAPH social_network TO admin; -- Assign roles to users GRANT ROLE readonly TO USER guest_user; GRANT ROLE analyst TO USER john_doe; </code></pre></div>Graph-Level Permissions: Control access at the graph level: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant graph-level privileges GRANT CREATE GRAPH TO ROLE developer; GRANT DROP GRAPH TO ROLE admin; -- Revoke privileges REVOKE INSERT ON GRAPH sensitive_data FROM ROLE analyst; </code></pre></div>Label-Level Permissions: Restrict access to specific node or relationship types: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Restrict access to sensitive labels GRANT SELECT ON :User TO ROLE analyst; GRANT SELECT ON :Transaction TO ROLE auditor; DENY SELECT ON :CreditCard TO ROLE analyst; </code></pre></div>Property-Level Security: Hide sensitive properties from unauthorized users: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Allow reading most properties but hide sensitive ones GRANT SELECT(name, email, created_at) ON :User TO ROLE support; DENY SELECT(password_hash, ssn, salary) ON :User TO ROLE support; </code></pre></div> <h3 id="row-level-security-rls" class="position-relative d-flex align-items-center group"> Row-Level Security (RLS) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="row-level-security-rls" aria-haspopup="dialog" aria-label="Share link: Row-Level Security (RLS)"> Share link </button> </h3>RLS enables fine-grained access control where users can only see data matching specific criteria: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create RLS policy for multi-tenant access CREATE POLICY tenant_isolation ON :User FOR ALL TO analyst USING (tenant_id = current_user_property('tenant_id')); -- Create RLS policy for regional data access CREATE POLICY regional_access ON :Customer FOR SELECT TO regional_manager USING (region IN current_user_property('authorized_regions')); -- Department-based access CREATE POLICY department_data ON :Employee FOR ALL TO manager USING (department = current_user_property('department')); </code></pre></div>RLS Use Cases: <ul> <li>Multi-tenancy: Isolate tenant data in shared databases</li> <li>Hierarchical access: Managers see their team’s data only</li> <li>Regional compliance: Restrict data access by geography</li> <li>Privacy controls: Users can only access their own data</li> </ul> <h3 id="user-and-role-management" class="position-relative d-flex align-items-center group"> User and Role Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="user-and-role-management" aria-haspopup="dialog" aria-label="Share link: User and Role Management"> Share link </button> </h3>Creating and Managing Users: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create user with role CREATE USER alice PASSWORD 'secure_password' ROLE analyst; -- Modify user properties ALTER USER alice SET email = 'alice@example.com'; -- Change password ALTER USER alice PASSWORD 'new_secure_password'; -- Disable user account ALTER USER alice DISABLE; -- Delete user DROP USER alice; </code></pre></div>Role Hierarchy: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role hierarchy CREATE ROLE employee; CREATE ROLE manager INHERITS employee; CREATE ROLE director INHERITS manager; -- Grant privileges at each level GRANT SELECT ON :Employee TO employee; GRANT SELECT, UPDATE ON :Employee TO manager; GRANT ALL ON :Employee TO director; </code></pre></div> <h3 id="authentication-best-practices" class="position-relative d-flex align-items-center group"> Authentication Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authentication-best-practices" aria-haspopup="dialog" aria-label="Share link: Authentication Best Practices"> Share link </button> </h3>Use Strong Password Policies: Enforce minimum password requirements: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-toml" data-lang="toml">[auth.password_policy] min_length = 12 require_uppercase = true require_lowercase = true require_numbers = true require_special_chars = true max_age_days = 90 prevent_reuse = 5 </code></pre></div>Implement Multi-Factor Authentication (MFA): Add second factor for critical accounts: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Enable TOTP for user ALTER USER admin ENABLE MFA TOTP; -- Require MFA for privileged roles ALTER ROLE admin REQUIRE MFA; </code></pre></div>Rotate Credentials Regularly: Set expiration on passwords and tokens: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Set password expiration ALTER USER analyst PASSWORD_EXPIRES '90 days'; -- Create short-lived tokens CREATE TOKEN temp_access FOR USER consultant EXPIRES '24 hours'; </code></pre></div>Implement Least Privilege: Grant minimal permissions necessary: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Instead of granting all permissions -- GRANT ALL ON GRAPH * TO analyst; -- Too broad -- Grant specific permissions needed GRANT SELECT ON GRAPH analytics TO analyst; GRANT INSERT ON :Event TO analyst; </code></pre></div>Audit Authentication Events: Monitor authentication attempts: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View authentication logs SELECT * FROM system.auth_log WHERE event_type IN ('login_success', 'login_failure') AND timestamp > current_timestamp() - INTERVAL '24 hours'; -- Alert on suspicious activity CREATE ALERT failed_login_attempts WHEN (SELECT count(*) FROM system.auth_log WHERE event_type = 'login_failure' AND timestamp > current_timestamp() - INTERVAL '5 minutes' AND username = $username ) > 5 ACTION notify_security_team; </code></pre></div> <h3 id="secure-connection-setup" class="position-relative d-flex align-items-center group"> Secure Connection Setup <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="secure-connection-setup" aria-haspopup="dialog" aria-label="Share link: Secure Connection Setup"> Share link </button> </h3>TLS Configuration: Always use TLS in production: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-toml" data-lang="toml">[server.tls] enabled = true cert_file = "/etc/geode/tls/server.crt" key_file = "/etc/geode/tls/server.key" ca_file = "/etc/geode/tls/ca.crt" min_version = "1.3" cipher_suites = ["TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"] </code></pre></div>QUIC Security: Geode uses QUIC with mandatory TLS 1.3: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Server automatically uses QUIC+TLS geode serve --tls-cert cert.pem --tls-key key.pem # Client verifies server certificate geode shell --tls-ca ca.pem </code></pre></div> <h3 id="integration-patterns" class="position-relative d-flex align-items-center group"> Integration Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="integration-patterns" aria-haspopup="dialog" aria-label="Share link: Integration Patterns"> Share link </button> </h3>Microservices Authentication: Use service accounts with limited scopes: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE USER recommendation_service; GRANT SELECT ON :User, :Product, :Purchase TO recommendation_service; CREATE TOKEN rec_service_token FOR USER recommendation_service; </code></pre></div>Web Application Integration: Implement session management: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode import connect from flask import session @app.route('/api/users') @require_authentication def get_users(): # Use session credentials conn = connect( host='geode.example.com', username=session['username'], token=session['geode_token'] ) return conn.execute("MATCH (u:User) RETURN u LIMIT 100") </code></pre></div>Data Pipeline Authentication: Use long-lived tokens for batch jobs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">import os from geode import connect # Use token from environment conn = connect( host='geode.example.com', token=os.environ['GEODE_TOKEN'] ) # Process data with read-only token for batch in data_batches: conn.execute(insert_query, batch) </code></pre></div> <h3 id="troubleshooting-authentication-issues" class="position-relative d-flex align-items-center group"> Troubleshooting Authentication Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting-authentication-issues" aria-haspopup="dialog" aria-label="Share link: Troubleshooting Authentication Issues"> Share link </button> </h3>Login Failures: Check authentication logs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">SELECT timestamp, username, client_ip, failure_reason FROM system.auth_log WHERE event_type = 'login_failure' ORDER BY timestamp DESC LIMIT 50; </code></pre></div>Permission Denied Errors: Verify user privileges: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Check user's effective permissions SHOW GRANTS FOR USER alice; -- Check role hierarchy SHOW ROLE HIERARCHY FOR USER alice; </code></pre></div>Token Expiration: Monitor token validity: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- List active tokens SELECT token_id, username, expires_at FROM system.tokens WHERE expires_at > current_timestamp() ORDER BY expires_at; </code></pre></div>TLS Certificate Issues: Validate certificate chain: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Verify server certificate openssl s_client -connect geode.example.com:3141 \ -CAfile ca.crt # Check certificate expiration openssl x509 -in server.crt -noout -dates </code></pre></div> <h3 id="security-compliance" class="position-relative d-flex align-items-center group"> Security Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-compliance" aria-haspopup="dialog" aria-label="Share link: Security Compliance"> Share link </button> </h3>Geode’s authentication system helps meet compliance requirements: <ul> <li>SOC 2: User access controls, audit logging</li> <li>HIPAA: Fine-grained access, encryption, audit trails</li> <li>GDPR: Data access restrictions, user consent management</li> <li>PCI DSS: Strong authentication, privileged access management</li> </ul> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/row-level-security/" >Row-Level Security (RLS)</a> </li> <li><a href="/tags/encryption/" >Encryption and Data Protection</a> </li> <li><a href="/tags/audit-logging/" >Audit Logging and Compliance</a> </li> <li><a href="/tags/security/" >Security Best Practices</a> </li> <li><a href="/tags/sessions/" >User and Session Management</a> </li> <li><a href="/tags/networking/" >TLS and Network Security</a> </li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li>Enterprise Security Architecture Guide</li> <li>Authentication Integration Patterns</li> <li>Compliance and Regulatory Requirements</li> <li>Security Hardening Checklist</li> <li>Incident Response Playbook</li> </ul> <h3 id="advanced-authentication-patterns" class="position-relative d-flex align-items-center group"> Advanced Authentication Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="advanced-authentication-patterns" aria-haspopup="dialog" aria-label="Share link: Advanced Authentication Patterns"> Share link </button> </h3> <h4 id="jwt-token-based-authentication" class="position-relative d-flex align-items-center group"> JWT Token-Based Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="jwt-token-based-authentication" aria-haspopup="dialog" aria-label="Share link: JWT Token-Based Authentication"> Share link </button> </h4>Integrate Geode with JSON Web Tokens for stateless authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">import jwt from geode_client import Client # Generate JWT for user def generate_token(user_id, roles): payload = { 'user_id': user_id, 'roles': roles, 'exp': datetime.utcnow() + timedelta(hours=24) } return jwt.encode(payload, SECRET_KEY, algorithm='HS256') # Connect with JWT token = generate_token('user123', ['analyst']) client = Client('localhost:3141', token=token) </code></pre></div>Configure Geode to validate JWTs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml auth: jwt: enabled: true secret_key_file: /secure/jwt_secret algorithm: HS256 issuer: myapp.example.com audience: geode-api token_lifetime_seconds: 86400 </code></pre></div> <h4 id="service-account-authentication" class="position-relative d-flex align-items-center group"> Service Account Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="service-account-authentication" aria-haspopup="dialog" aria-label="Share link: Service Account Authentication"> Share link </button> </h4>Create service accounts for automated systems: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create service account CREATE USER etl_service TYPE service_account; -- Grant minimal required permissions GRANT SELECT ON :RawData TO etl_service; GRANT INSERT ON :ProcessedData TO etl_service; -- Generate long-lived API key CREATE API_KEY FOR etl_service DESCRIPTION 'ETL pipeline data ingestion' EXPIRES '2027-01-01'; </code></pre></div>Use service accounts in applications: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># etl_pipeline.py import os from geode_client import Client # Load API key from environment API_KEY = os.environ['GEODE_API_KEY'] client = Client( 'geode.prod.example.com:3141', api_key=API_KEY ) # Service account has limited permissions # Can only read RawData and write ProcessedData </code></pre></div> <h4 id="multi-factor-authentication-setup" class="position-relative d-flex align-items-center group"> Multi-Factor Authentication Setup <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-factor-authentication-setup" aria-haspopup="dialog" aria-label="Share link: Multi-Factor Authentication Setup"> Share link </button> </h4>Enable MFA for administrative accounts: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Enable TOTP MFA for admin user ALTER USER admin ENABLE MFA USING TOTP SECRET generate_qr_code(); -- Require MFA for all admins ALTER ROLE admin REQUIRE MFA; -- Verify MFA code during login AUTHENTICATE USER admin PASSWORD 'secure_password' MFA_CODE '123456'; </code></pre></div>Implement MFA in client applications: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">async def login_with_mfa(username, password, mfa_code): try: client = Client( 'localhost:3141', username=username, password=password, mfa_code=mfa_code ) return client except MFARequired: # Prompt user for MFA code mfa_code = input("Enter MFA code: ") return await login_with_mfa(username, password, mfa_code) </code></pre></div> <h4 id="sso-integration-with-saml" class="position-relative d-flex align-items-center group"> SSO Integration with SAML <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="sso-integration-with-saml" aria-haspopup="dialog" aria-label="Share link: SSO Integration with SAML"> Share link </button> </h4>Configure SAML 2.0 for enterprise single sign-on: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-xml" data-lang="xml"> <EntityDescriptor entityID="https://geode.example.com/saml/metadata" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <KeyDescriptor use="signing"> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:X509Data> <ds:X509Certificate>MIIDXTCCAkWgAwIBAgIJ...</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </KeyDescriptor> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://geode.example.com/saml/slo"/> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://geode.example.com/saml/acs" index="1"/> </SPSSODescriptor> </EntityDescriptor> </code></pre></div> <h4 id="oauth-20-authorization-code-flow" class="position-relative d-flex align-items-center group"> OAuth 2.0 Authorization Code Flow <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="oauth-20-authorization-code-flow" aria-haspopup="dialog" aria-label="Share link: OAuth 2.0 Authorization Code Flow"> Share link </button> </h4>Integrate with OAuth providers: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml auth: oauth2: enabled: true provider: okta client_id: ${OAUTH_CLIENT_ID} client_secret_file: /secure/oauth_secret authorization_endpoint: https://dev-123.okta.com/oauth2/v1/authorize token_endpoint: https://dev-123.okta.com/oauth2/v1/token userinfo_endpoint: https://dev-123.okta.com/oauth2/v1/userinfo scopes: - openid - profile - email redirect_url: https://geode.example.com/oauth/callback </code></pre></div>Implement OAuth flow in web application: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from flask import Flask, redirect, request, session from geode_client import Client import requests app = Flask(__name__) @app.route('/login') def login(): # Redirect to OAuth provider auth_url = ( f"{OAUTH_AUTH_ENDPOINT}?" f"client_id={CLIENT_ID}&" f"redirect_uri={REDIRECT_URL}&" f"response_type=code&" f"scope=openid profile email" ) return redirect(auth_url) @app.route('/oauth/callback') def oauth_callback(): code = request.args.get('code') # Exchange code for token token_response = requests.post(OAUTH_TOKEN_ENDPOINT, data={ 'grant_type': 'authorization_code', 'code': code, 'redirect_uri': REDIRECT_URL, 'client_id': CLIENT_ID, 'client_secret': CLIENT_SECRET }) access_token = token_response.json()['access_token'] # Create Geode client with OAuth token session['geode_client'] = Client( 'localhost:3141', oauth_token=access_token ) return redirect('/dashboard') </code></pre></div> <h4 id="dynamic-permission-management" class="position-relative d-flex align-items-center group"> Dynamic Permission Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="dynamic-permission-management" aria-haspopup="dialog" aria-label="Share link: Dynamic Permission Management"> Share link </button> </h4>Implement runtime permission checks: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Check user's current permissions CALL dbms.security.showUserPermissions('analyst') YIELD role, permission, resource RETURN role, permission, resource; -- Temporarily elevate privileges BEGIN TRANSACTION; SET SESSION AUTHORIZATION admin; -- Perform privileged operation CREATE GRAPH sensitive_data; -- Restore normal privileges RESET SESSION AUTHORIZATION; COMMIT; </code></pre></div> <h4 id="audit-logging-for-compliance" class="position-relative d-flex align-items-center group"> Audit Logging for Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-logging-for-compliance" aria-haspopup="dialog" aria-label="Share link: Audit Logging for Compliance"> Share link </button> </h4>Track all authentication events: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View recent authentication attempts SELECT timestamp, username, client_ip, user_agent, auth_method, success, failure_reason FROM system.auth_audit WHERE timestamp > current_timestamp() - INTERVAL '24 hours' ORDER BY timestamp DESC; -- Alert on suspicious patterns CREATE ALERT brute_force_detection WHEN ( SELECT COUNT(*) as failed_attempts FROM system.auth_audit WHERE success = false AND username = $username AND timestamp > current_timestamp() - INTERVAL '5 minutes' ) > 5 ACTION notify_security_team($username, $client_ip); </code></pre></div>Export audit logs for SIEM integration: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># export_audit_logs.py import asyncio from geode_client import Client import json async def export_audit_logs_to_splunk(): client = Client('localhost:3141', token=ADMIN_TOKEN) async with client.connection() as client: # Fetch recent audit events result, _ = await client.query(""" SELECT * FROM system.auth_audit WHERE timestamp > current_timestamp() - INTERVAL '1 hour' """) # Send to Splunk HTTP Event Collector for event in result.rows: payload = { 'time': event['timestamp'].isoformat(), 'source': 'geode-auth', 'sourcetype': 'geode:auth:audit', 'event': { 'username': event['username'], 'success': event['success'], 'client_ip': event['client_ip'], 'auth_method': event['auth_method'] } } requests.post( SPLUNK_HEC_URL, headers={'Authorization': f'Splunk {SPLUNK_TOKEN}'}, json=payload ) asyncio.run(export_audit_logs_to_splunk()) </code></pre></div> <h4 id="certificate-based-authentication" class="position-relative d-flex align-items-center group"> Certificate-Based Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-based-authentication" aria-haspopup="dialog" aria-label="Share link: Certificate-Based Authentication"> Share link </button> </h4>Use X.509 certificates for strong authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate client certificate openssl req -new -newkey rsa:4096 \ -days 365 -nodes -x509 \ -subj "/CN=analyst/O=Example Corp" \ -keyout client-key.pem \ -out client-cert.pem # Configure Geode to require client certificates geode serve \ --tls-cert server.crt \ --tls-key server.key \ --tls-client-ca ca.crt \ --tls-client-auth required </code></pre></div>Map certificates to users: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Map certificate subject to user account CREATE CERTIFICATE_MAPPING FOR USER analyst WITH SUBJECT '/CN=analyst/O=Example Corp'; </code></pre></div>Connect with certificate: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">client = Client( 'geode.example.com:3141', tls_cert='client-cert.pem', tls_key='client-key.pem', tls_ca='ca.crt' ) </code></pre></div> <h4 id="password-policy-enforcement" class="position-relative d-flex align-items-center group"> Password Policy Enforcement <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="password-policy-enforcement" aria-haspopup="dialog" aria-label="Share link: Password Policy Enforcement"> Share link </button> </h4>Configure strong password requirements: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml auth: password_policy: min_length: 14 require_uppercase: true require_lowercase: true require_numbers: true require_special_chars: true special_chars: "!@#$%^&*()_+-=[]{}|;:,.<>?" max_age_days: 90 prevent_reuse_count: 10 lockout_threshold: 5 lockout_duration_minutes: 30 password_history_count: 24 </code></pre></div>Enforce password changes: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Force password change on next login ALTER USER analyst REQUIRE PASSWORD_CHANGE; -- Set password expiration ALTER USER analyst PASSWORD_EXPIRES '90 days'; -- Check password compliance CALL dbms.security.validatePassword('proposed_password'); </code></pre></div> <h3 id="authentication-best-practices-summary" class="position-relative d-flex align-items-center group"> Authentication Best Practices Summary <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authentication-best-practices-summary" aria-haspopup="dialog" aria-label="Share link: Authentication Best Practices Summary"> Share link </button> </h3><ol> <li>Always use TLS in production to protect credentials in transit</li> <li>Implement principle of least privilege - grant minimum required permissions</li> <li>Enable audit logging for compliance and security monitoring</li> <li>Use strong authentication - multi-factor for admin accounts</li> <li>Rotate credentials regularly - passwords, API keys, certificates</li> <li>Monitor failed login attempts - detect and respond to attacks</li> <li>Separate user types - different auth methods for users, services, admins</li> <li>Integrate with enterprise identity - LDAP, OAuth, SAML for centralized management</li> <li>Encrypt sensitive auth data - passwords, tokens, secrets</li> <li>Test disaster recovery - ensure you can restore access after failures</li> </ol>

Popular

Related Articles

Security and Compliance Guide

Authentication

Security

Password Hashing with Argon2id