Skip to content

Commit f4af31a

Browse files
andrejtonevandrejtonev
committed
Added user profile information
1 parent ea9158c commit f4af31a

File tree

6 files changed

+266
-5
lines changed

6 files changed

+266
-5
lines changed

‎pages/database-management/authentication-and-authorization.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,8 @@ authentication and access control using Memgraph's auth module.
2525
## [Impersonate user](/database-management/authentication-and-authorization/impersonate-user) (Enterprise)
2626

2727
Learn how the impersonate user feature enables authorized users to execute
28-
queries with the full permissions and context of another user.
28+
queries with the full permissions and context of another user.
29+
30+
## [User profiles](/database-management/authentication-and-authorization/user-profiles) (Enterprise)
31+
32+
Learn how to manage user profiles and set resource limits for users to control resource consumption and prevent abuse.

‎pages/database-management/authentication-and-authorization/_meta.ts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,6 @@ export default {
22
"users": "Users",
33
"role-based-access-control": "Role-based access control",
44
"auth-system-integrations": "Auth system integrations",
5-
"impersonate-user": "Impersonate user"
5+
"impersonate-user": "Impersonate user",
6+
"user-profiles": "User profiles"
67
}

‎pages/database-management/authentication-and-authorization/role-based-access-control.mdx

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ role, enhancing security and minimizing risks.
1818
With role-based access control, a database administrator can assign various
1919
privileges to roles, but for even more control over who can access certain
2020
data, Memgraph Enterprise offers [fine-grained access
21-
control](#fine-grained-access-control).
21+
control](#fine-grained-access-control). Additionally, you can use [user profiles](/database-management/authentication-and-authorization/user-profiles) to set resource limits for users.
2222

2323
## User roles
2424

@@ -75,6 +75,12 @@ To list all defined user roles run:
7575
SHOW ROLES;
7676
```
7777

78+
## User profiles
79+
80+
User profiles allow you to set resource limits for individual users to control resource consumption and prevent system abuse.
81+
82+
For detailed information about user profiles, including profile creation, management, and advanced features, see the [User profiles](/database-management/authentication-and-authorization/user-profiles) documentation.
83+
7884
## Privileges
7985

8086
At the moment, privileges are confined to users' abilities to perform certain

‎pages/database-management/authentication-and-authorization/user-profiles.mdx

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
title: User profiles
3+
description: Learn how to manage user profiles and set resource limits for users in Memgraph Enterprise.
4+
---
5+
6+
# User profiles
7+
8+
User profiles allow you to set resource limits for users in Memgraph Enterprise. You can define limits on the number of sessions and memory usage to control resource consumption and prevent abuse.
9+
10+
User profiles provide a way to:
11+
- Set resource limits for individual users
12+
- Control the number of concurrent sessions per user
13+
- Limit query memory usage over all active
14+
- Monitor resource consumption in real-time
15+
- Enforce resource quotas to prevent system abuse
16+
17+
## Prerequisites
18+
19+
To use user profiles, you need:
20+
- Memgraph Enterprise Edition
21+
- The `PROFILE_RESTRICTION` privilege to manage profiles
22+
23+
## Creating profiles
24+
25+
You can create a profile with default unlimited limits:
26+
27+
```cypher
28+
CREATE PROFILE profile_name;
29+
```
30+
31+
Or create a profile with specific limits:
32+
33+
```cypher
34+
CREATE PROFILE profile_name LIMIT sessions 10, transactions_memory 100MB;
35+
```
36+
37+
### Available limits
38+
39+
- **sessions**: Maximum number of concurrent sessions (default: unlimited)
40+
- **transactions_memory**: Maximum query memory usage over all active transactions (default: unlimited)
41+
42+
### Limit values
43+
44+
You can specify limits in different formats:
45+
46+
- **Unlimited**: `UNLIMITED` (default)
47+
- **Quantity**: A positive number (e.g., `10`)
48+
- **Memory**: A number with unit MB/KB (e.g., `100MB`, `512KB`)
49+
50+
### Examples
51+
52+
```cypher
53+
-- Create a profile with session limit only
54+
CREATE PROFILE session_limited LIMIT sessions 5;
55+
56+
-- Create a profile with memory limit only
57+
CREATE PROFILE memory_limited LIMIT transactions_memory 50MB;
58+
59+
-- Create a profile with both limits
60+
CREATE PROFILE strict_profile LIMIT sessions 3, transactions_memory 25MB;
61+
62+
-- Create a profile with different memory units
63+
CREATE PROFILE small_profile LIMIT transactions_memory 1KB;
64+
```
65+
66+
## Managing profiles
67+
68+
### Update a profile
69+
70+
```cypher
71+
UPDATE PROFILE profile_name LIMIT sessions 5, transactions_memory 50MB;
72+
```
73+
74+
### Drop a profile
75+
76+
```cypher
77+
DROP PROFILE profile_name;
78+
```
79+
80+
**Note**: When you drop a profile, all users assigned to that profile will have their limits reset and profile assignment cleared.
81+
82+
83+
### Clear a profile assignment
84+
85+
```cypher
86+
CLEAR PROFILE FOR username;
87+
```
88+
89+
This removes the profile assignment, returning the user to unlimited resources.
90+
91+
## Viewing profile assignments
92+
93+
### Show profile for a user
94+
95+
```cypher
96+
SHOW PROFILE FOR username;
97+
```
98+
99+
### Show users assigned to a profile
100+
101+
```cypher
102+
SHOW USERS FOR PROFILE profile_name;
103+
```
104+
105+
## Monitoring resource usage
106+
107+
### Show resource usage for a user
108+
109+
```cypher
110+
SHOW RESOURCE USAGE FOR username;
111+
```
112+
113+
This command shows the current resource consumption and imposed limits for the specified user, including:
114+
- Number of active sessions
115+
- Current transaction memory usage
116+
117+
## Profile management
118+
119+
User profiles are assigned directly to users and provide resource limits for those specific users. Each user can have one profile assigned at a time.
120+
121+
### Profile assignment behavior
122+
123+
**Important**: Profile assignment is a simple mapping between profile names and usernames. This means:
124+
125+
- **Users don't need to exist** when you assign a profile to them
126+
- You can assign a profile to a username that hasn't been created yet
127+
- You can assign a profile to a SSO user that will never exist in Memgraph
128+
- The profile will be automatically applied when that user connects to the database
129+
- Dropping a profile **does remove the mapping**
130+
131+
## Error handling
132+
133+
The system provides clear error messages for invalid operations:
134+
135+
- **Duplicate profile creation**: Error when trying to create a profile with an existing name
136+
- **Non-existent profile operations**: Error when trying to show, update, or drop non-existent profiles
137+
- **Invalid limit values**: Error for negative numbers or invalid memory units
138+
- **Invalid limit names**: Error for unsupported limit types
139+
140+
**Note**: Assigning a profile to a non-existent user will **not** cause an error. The assignment will be stored and applied when the user connects to the database.
141+
142+
## Best practices
143+
144+
1. **Start with unlimited profiles**: Create profiles without limits first, then gradually add restrictions
145+
2. **Monitor usage**: Regularly check resource usage to understand actual consumption patterns
146+
147+
## Examples
148+
149+
### Complete workflow example
150+
151+
```cypher
152+
-- 1. Create users
153+
CREATE USER developer1;
154+
CREATE USER developer2;
155+
156+
-- 2. Create profiles with different restrictions
157+
CREATE PROFILE basic_profile LIMIT sessions 10;
158+
CREATE PROFILE strict_profile LIMIT sessions 3, transactions_memory 50MB;
159+
160+
-- 3. Assign profiles
161+
SET PROFILE FOR developer1 TO basic_profile;
162+
SET PROFILE FOR developer2 TO strict_profile;
163+
164+
-- 4. Verify assignments
165+
SHOW PROFILE FOR developer1;
166+
SHOW USERS FOR PROFILE basic_profile;
167+
168+
-- 5. Monitor usage
169+
SHOW RESOURCE USAGE FOR developer1;
170+
171+
-- 6. Update limits based on usage patterns
172+
UPDATE PROFILE strict_profile LIMIT sessions 5, transactions_memory 25MB;
173+
174+
-- 7. Verify limits
175+
SHOW RESOURCE USAGE FOR developer2;
176+
```
177+
178+
## Syntax reference
179+
180+
| Command | Description |
181+
|---------|-------------|
182+
| `CREATE PROFILE name [LIMIT limit_list]` | Create a new profile |
183+
| `UPDATE PROFILE name LIMIT limit_list` | Update existing profile limits |
184+
| `DROP PROFILE name` | Delete a profile |
185+
| `SHOW PROFILES` | List all profiles |
186+
| `SHOW PROFILE name` | Show specific profile details |
187+
| `SET PROFILE FOR user TO profile` | Assign profile to user |
188+
| `CLEAR PROFILE FOR user` | Remove profile assignment |
189+
| `SHOW PROFILE FOR user` | Show profile assigned to user |
190+
| `SHOW USERS FOR PROFILE name` | List users assigned to profile |
191+
| `SHOW RESOURCE USAGE FOR user` | Show current resource usage |
192+
193+
### Limit syntax
194+
195+
```
196+
limit_list: limit_item [, limit_item]*
197+
limit_item: sessions number | transactions_memory memory_value
198+
memory_value: number (MB | KB)
199+
number: positive integer
200+
```

‎pages/database-management/authentication-and-authorization/users.mdx

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@ In Memgraph, users and their passwords can be created with a simple Cypher
1212
query. This level of security is supported within the Community version of
1313
Memgraph. For more advanced security features within Memgraph Enterprise, check
1414
out [role-based access
15-
control](/database-management/authentication-and-authorization/role-based-access-control)
16-
and [auth system integrations](/database-management/authentication-and-authorization/auth-system-integrations).
15+
control](/database-management/authentication-and-authorization/role-based-access-control),
16+
[auth system integrations](/database-management/authentication-and-authorization/auth-system-integrations),
17+
and [user profiles](/database-management/authentication-and-authorization/user-profiles).
1718

1819
## Administer users
1920

@@ -96,6 +97,51 @@ SHOW USERS;
9697

9798
If no users exist, `SHOW USERS` returns no results.
9899

100+
## User profiles (Enterprise)
101+
102+
In Memgraph Enterprise, you can assign user profiles to control resource limits for users. User profiles allow you to set limits on:
103+
104+
- **Number of concurrent sessions**: Control how many simultaneous connections a user can have
105+
- **Transaction memory usage**: Limit the amount of query memory a user can consume over all active transactions
106+
107+
### Basic profile operations
108+
109+
To assign a profile to a user:
110+
111+
```cypher
112+
SET PROFILE FOR username TO profile_name;
113+
```
114+
115+
To view the profile assigned to a user:
116+
117+
```cypher
118+
SHOW PROFILE FOR username;
119+
```
120+
121+
To clear a user's profile (removes all limits):
122+
123+
```cypher
124+
CLEAR PROFILE FOR username;
125+
```
126+
127+
To see all users assigned to a profile:
128+
129+
```cypher
130+
SHOW USERS FOR PROFILE profile_name;
131+
```
132+
133+
To monitor current resource usage for a user:
134+
135+
```cypher
136+
SHOW RESOURCE USAGE FOR username;
137+
```
138+
139+
### Profile assignment
140+
141+
**Note**: You can assign a profile to a username even if the user doesn't exist yet. The profile will be automatically applied when the user connects to the database.
142+
143+
For detailed information about user profiles, including profile creation, management, and advanced features, see the [User profiles](/database-management/authentication-and-authorization/user-profiles) documentation.
144+
99145
### Password encryption algorithm
100146

101147
Memgraph offers multiple password encryption algorithms:

‎pages/database-management/enabling-memgraph-enterprise.mdx

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,10 @@ terms of graph algorithms:
208208
expiration time. Once a vertex has expired, the vertex and all associated edges
209209
will be deleted.
210210

211+
### User profiles
212+
[User profiles](/database-management/authentication-and-authorization/user-profiles) allows administrators to monitor and limit
213+
resources used by specific users. You can set limits on the number of concurrent sessions and transaction memory usage to control resource consumption and prevent system abuse.
214+
211215
## Memgraph Lab Enterprise features
212216

213217
### Monitoring

0 commit comments

Comments
 (0)