GRANT query_external_access TO myuser<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nEXPLICAR e PREPARAR<\/h2>\n
\u00c9 claro que podemos fazer outras coisas com as consultas al\u00e9m de apenas execut\u00e1-las. Podemos usar o EXPLAIN para entender como o mecanismo de consulta calcula uma consulta. E podemos usar o PREPARE para configurar uma consulta para execu\u00e7\u00e3o repetida.<\/p>\n
No Couchbase 5.0, as permiss\u00f5es para EXPLAIN e PREPARE s\u00e3o simples. Elas s\u00e3o as mesmas que as permiss\u00f5es necess\u00e1rias para a declara\u00e7\u00e3o subjacente. Isso \u00e9 tudo o que h\u00e1 para fazer.<\/p>\n
Para testar isso, vamos tentar EXPLORAR uma instru\u00e7\u00e3o SELECT simples, a mesma que usamos na se\u00e7\u00e3o anterior \"Fun\u00e7\u00f5es prim\u00e1rias\":<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"explain select * from testbucket1\"<\/pre>\nEm resposta, recebemos uma mensagem de erro solicitando uma fun\u00e7\u00e3o espec\u00edfica:<\/p>\n
\"errors\": [{\"code\":13014,\"msg\":\"User does not have credentials to run SELECT queries \r\n on the testbucket1 bucket. Add role query_select on testbucket1 to allow the query to run.\"}],<\/pre>\nVamos fornecer um usu\u00e1rio com essa fun\u00e7\u00e3o:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"explain select * from testbucket1\" -u user1 -p password<\/pre>\nSucesso, assim como vimos para a pr\u00f3pria declara\u00e7\u00e3o em \"Fun\u00e7\u00f5es prim\u00e1rias\".<\/span><\/p>\nAgora vamos tentar PREPARAR a segunda declara\u00e7\u00e3o de \"Primary Roles\":<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"PREPARE INSERT INTO testbucket2 (KEY source.c_id, VALUE source.customer) \r\n SELECT * FROM testbucket1 source WHERE source.new = true\"<\/pre>\nRecebemos a mesma mensagem de erro que recebemos originalmente para a declara\u00e7\u00e3o em si:<\/span><\/p>\n\"errors\": [{\"code\":13014,\"msg\":\"User does not have credentials to run INSERT queries on the \r\n testbucket2 bucket. Add role query_insert on testbucket2 to allow the query to run.\"}],<\/pre>\nE se adicionarmos um usu\u00e1rio com credenciais para SELECT e INSERT, o PREPARE ser\u00e1 bem-sucedido:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"PREPARE INSERT INTO testbucket2 (KEY source.c_id, VALUE source.customer) \r\n SELECT * FROM testbucket1 source WHERE source.new = true\" \r\n -u user3 \r\n -p password<\/pre>\nCONCESS\u00c3O e REVOGA\u00c7\u00c3O<\/h2>\n
Na vers\u00e3o 5.0, o N1QL inclui comandos para conceder fun\u00e7\u00f5es aos usu\u00e1rios (GRANT) e para retir\u00e1-las (REVOKE). Esses comandos exigem permiss\u00e3o de administrador para serem executados.<\/span><\/p>\nAntes de experimentar essas declara\u00e7\u00f5es, vamos analisar quais usu\u00e1rios est\u00e3o configurados e quais fun\u00e7\u00f5es eles t\u00eam. Veja o que voc\u00ea deve ver na tela Security (Seguran\u00e7a) do console do Couchbase.<\/span><\/p>\n![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/user-permissions-300x161.png\")
<\/p>\n
Podemos conceder uma nova fun\u00e7\u00e3o cluster_admin ao usu\u00e1rio1 da seguinte forma:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"grant cluster_admin to user1\" -u Administrator -p password<\/pre>\nIsso ser\u00e1 bem-sucedido e, logo em seguida, o console do Couchbase ser\u00e1 atualizado para refletir a nova atribui\u00e7\u00e3o de fun\u00e7\u00e3o.<\/p>\n
Tamb\u00e9m podemos atribuir fun\u00e7\u00f5es parametrizadas, como esta:<\/p>\n
cbq -e https:\/\/localhost:8093\/ \r\n -s \"grant query_insert on testbucket2 to user2\" \r\n -u Administrator \r\n -p password<\/pre>\nPodemos desfazer a concess\u00e3o inicial por meio de um REVOKE:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"revoke cluster_admin from user1\" -u Administrator -p password<\/pre>\nTodos esses par\u00e2metros podem receber listas de argumentos:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"grant query_insert, query_delete on testbucket1, testbucket2 to user5, user6\" \r\n -u Administrator \r\n -p password<\/pre>\nE, por fim, o prefixo query_ \u00e9 opcional para query_insert, query_update, query_delete e query_select, tornando parte da sintaxe mais familiar:<\/span><\/p>\ncbq -e \u00a0https:\/\/localhost:8093\/ -s \"grant insert,delete on testbucket1 to user4\" \r\n -u Administrator -p password<\/pre>\nCompara\u00e7\u00e3o com a Oracle<\/h2>\n
O controle de acesso baseado em fun\u00e7\u00e3o no Couchbase 5.0 foi projetado para ser familiar aos profissionais que j\u00e1 usaram o controle de acesso em outros sistemas de banco de dados atuais. A esta altura, voc\u00ea j\u00e1 deve ter reconhecido conceitos familiares, como as permiss\u00f5es de inser\u00e7\u00e3o\/sele\u00e7\u00e3o\/atualiza\u00e7\u00e3o\/exclus\u00e3o aplic\u00e1veis a buckets, que s\u00e3o como tabelas. Al\u00e9m disso, a no\u00e7\u00e3o de usu\u00e1rios administradores com permiss\u00f5es amplas deve ser familiar. O controle de acesso baseado em fun\u00e7\u00e3o no Couchbase 5.0 foi projetado para ser familiar aos profissionais que usaram o controle de acesso em outros sistemas de banco de dados atuais. A esta altura, voc\u00ea j\u00e1 deve ter reconhecido conceitos familiares, como as permiss\u00f5es de inser\u00e7\u00e3o\/sele\u00e7\u00e3o\/atualiza\u00e7\u00e3o\/exclus\u00e3o aplic\u00e1veis aos buckets, que s\u00e3o como tabelas. Al\u00e9m disso, a no\u00e7\u00e3o de usu\u00e1rios administradores com permiss\u00f5es amplas deve ser familiar.<\/p>\n
Por exemplo, essa consulta GRANT funcionar\u00e1 tanto no Couchbase quanto no Oracle:<\/p>\n
GRANT select, insert ON default TO jlarson, pedwards<\/pre>\nUma diferen\u00e7a conceitual entre o Couchbase e outros sistemas, como o Oracle, \u00e9 que temos um modelo bin\u00e1rio de privil\u00e9gio: usu\u00e1rios e fun\u00e7\u00f5es. Eles normalmente t\u00eam um modelo trin\u00e1rio, com usu\u00e1rios, fun\u00e7\u00f5es e privil\u00e9gios. Dessa forma, conceder permiss\u00f5es aos usu\u00e1rios no Oracle \u00e9 conceder privil\u00e9gios em objetos aos usu\u00e1rios. No Couchbase, trata-se de conceder fun\u00e7\u00f5es parametrizadas aos usu\u00e1rios.<\/p>\n
As fun\u00e7\u00f5es s\u00e3o est\u00e1ticas na vers\u00e3o 5.0. N\u00e3o h\u00e1 declara\u00e7\u00f5es equivalentes a CREATE\/DROP\/ALTER ROLE.<\/p>\n
As permiss\u00f5es do Couchbase est\u00e3o no sistema como um todo ou nos buckets. N\u00e3o temos no\u00e7\u00e3o de permiss\u00f5es em tabelas, colunas ou cole\u00e7\u00f5es.<\/p>\n
No Couchbase, GRANT e REVOKE s\u00f3 s\u00e3o poss\u00edveis para usu\u00e1rios administradores. N\u00e3o existe uma OP\u00c7\u00c3O DE ADMIN ou uma OP\u00c7\u00c3O DE GRANT. Para alterar as permiss\u00f5es, voc\u00ea precisa ser um administrador.<\/p>\n
Por fim, n\u00e3o temos equivalente a SET ROLE. SET ROLE \u00e9 um comando em n\u00edvel de sess\u00e3o, o que n\u00e3o faz sentido no Couchbase porque n\u00e3o temos sess\u00f5es, apenas solicita\u00e7\u00f5es RESTful individuais.<\/p>\n
Novos espa\u00e7os-chave do sistema<\/h2>\n
O Couchbase 5.0 apresenta tr\u00eas novos espa\u00e7os de chave do sistema relacionados aos usu\u00e1rios. O primeiro deles \u00e9 system:user_info. Esse espa\u00e7o de chave lista os usu\u00e1rios configurados no sistema, incluindo suas fun\u00e7\u00f5es. Vamos tentar uma consulta:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:user_info\" -u Administrator -p password<\/pre>\nIsso nos d\u00e1 sete entradas como esta, uma para cada usu\u00e1rio que configuramos, mais o Administrador configurado:<\/p>\n
{\"user_info\":{\"domain\":\"local\",\"id\":\"user4\",\"name\":\"User4\",\"roles\":[{\"bucket_name\":\"testbucket1\",\"role\":\"query_manage_index\"},{\"bucket_name\":\"testbucket1\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket1\",\"role\":\"delete\"}]}},\r\n{\"user_info\":{\"domain\":\"local\",\"id\":\"user2\",\"name\":\"User 2\",\"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"select\"},{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"}]}},\r\n{\"user_info\":{\"domain\":\"local\",\"id\":\"user5\",\"name\":\"User5\",\"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket1\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket2\",\"role\":\"delete\"},{\"bucket_name\":\"testbucket1\",\"role\":\"delete\"},{\"role\":\"query_system_catalog\"}]}},<\/pre>\nO espa\u00e7o-chave system:applicable_roles \u00e9 semelhante, mas divide cada fun\u00e7\u00e3o de usu\u00e1rio em uma entrada separada, produzindo uma vis\u00e3o mais relacional dos dados:<\/p>\n
cbq -e https:\/\/localhost:8093\/ \r\n -s \"select * from system:applicable_roles where grantee = 'user3'\" \r\n -u Administrator \r\n -p password<\/pre>\n\"results\": [\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket2\",\"grantee\":\"user3\",\"role\":\"select\"}},\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket1\",\"grantee\":\"user3\",\"role\":\"select\"}},\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket2\",\"grantee\":\"user3\",\"role\":\"insert\"}}\r\n],<\/pre>\nPor fim, o espa\u00e7o-chave system:my_user_info mostra a parte do system:my_user_info correspondente ao usu\u00e1rio cujas credenciais s\u00e3o passadas com a consulta.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:my_user_info\" -u user3 -p password<\/pre>\n\"results\": [\r\n{\"my_user_info\":{\"domain\":\"local\",\"id\":\"user3\",\"name\":\"User 3\",\r\n \"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"select\"},{\"bucket_name\":\"testbucket1\",\"role\":\"select\"},{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"}]}}\r\n],<\/pre>\nAcesso aos espa\u00e7os-chave do sistema<\/h2>\n
De acordo com uma filosofia geral de opera\u00e7\u00e3o segura, os espa\u00e7os de chave do sistema (buckets) s\u00e3o protegidos na vers\u00e3o 5.0. O grau de restri\u00e7\u00e3o varia de acordo com os dados presentes em cada espa\u00e7o de chave.<\/p>\n
Tr\u00eas espa\u00e7os de chaves n\u00e3o t\u00eam nada que possa ser valioso para um invasor:<\/p>\n
\n- sistema:armazenamentos de dados<\/li>\n
- sistema:namespaces<\/li>\n
- sistema: duplo<\/li>\n<\/ul>\n
Dessa forma, esses espa\u00e7os de chaves n\u00e3o s\u00e3o protegidos. N\u00e3o s\u00e3o necess\u00e1rias credenciais para acess\u00e1-los.<\/p>\n
cbq -e https:\/\/localhost:8093\/query\/service -s \"select * from system:datastores\"<\/pre>\n\"results\": [\r\n{\"datastores\":{\"id\":\"https:\/\/127.0.0.1:8091\",\"url\":\"https:\/\/127.0.0.1:8091\"}}\r\n],<\/pre>\nNo outro extremo da seguran\u00e7a est\u00e3o system:user_info e system:applicable_roles, que cont\u00eam a lista de usu\u00e1rios e suas fun\u00e7\u00f5es. Elas podem ser acessadas apenas por usu\u00e1rios Admin e Read Only Admin. A tabela system:my_user_info \u00e9 semelhante, mas mostra apenas as informa\u00e7\u00f5es relevantes para o usu\u00e1rio cujas credenciais s\u00e3o apresentadas com a consulta. J\u00e1 exploramos essas tabelas acima.<\/p>\n
Os pr\u00f3ximos quatro espa\u00e7os de chave do sistema cont\u00eam uma variedade de informa\u00e7\u00f5es de tempo de execu\u00e7\u00e3o e configura\u00e7\u00e3o.<\/p>\n
\n- Sistema: prepara\u00e7\u00f5es<\/li>\n
- Sistema:completed_requests<\/li>\n
- Sistema:active_requests<\/li>\n
- Sistema: n\u00f3s<\/li>\n<\/ul>\n
Como as informa\u00e7\u00f5es nelas contidas n\u00e3o s\u00e3o t\u00e3o confidenciais quanto as informa\u00e7\u00f5es do usu\u00e1rio, elas podem ser visualizadas mais amplamente. Eles podem ser acessados pela maioria dos administradores, mesmo os menores: Admin, Read Only Admin, Cluster Admin, Query System Catalog, Replication Admin, Bucket Admin (qualquer bucket) ou Views Admin (qualquer bucket).<\/p>\n
Vamos tentar olhar para system:prepareds como user5, o usu\u00e1rio que criamos com a permiss\u00e3o Query System Catalog, acima.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:prepareds\" -u user5 -p password<\/pre>\nIsso nos mostra uma declara\u00e7\u00e3o preparada que criamos anteriormente.<\/p>\n
O espa\u00e7o de chave system:keyspaces mostra a lista de buckets configurados no sistema. Essas informa\u00e7\u00f5es s\u00e3o um tanto sens\u00edveis, pois fornecem ao invasor informa\u00e7\u00f5es sobre a finalidade do uso do sistema. Dessa forma, os usu\u00e1rios com fun\u00e7\u00f5es de alto n\u00edvel (Admin, Read Only Admin, Cluster Admin) veem tudo o que est\u00e1 nesse espa\u00e7o de chave. Os usu\u00e1rios com a fun\u00e7\u00e3o Query System Catalog tamb\u00e9m veem tudo, pois essa fun\u00e7\u00e3o \u00e9 destinada \u00e0 depura\u00e7\u00e3o de problemas de consulta. Para outros usu\u00e1rios, a visualiza\u00e7\u00e3o \u00e9 filtrada; o usu\u00e1rio v\u00ea apenas os espa\u00e7os-chave para os quais tem permiss\u00e3o query_select.<\/p>\n
Por exemplo, uma consulta a system:keyspaces sem credenciais ser\u00e1 bem-sucedida, mas n\u00e3o mostrar\u00e1 nenhuma entrada:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\"<\/pre>\n\"results\": [\r\n\r\n],<\/pre>\nAdicione credenciais para o usu\u00e1rio5, que tem a fun\u00e7\u00e3o Query System Catalog, e todas as entradas s\u00e3o mostradas:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\" -u user5 -p password<\/pre>\n\"results\": [\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket1\",\"name\":\"testbucket1\",\"namespace_id\":\"default\"}},\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket2\",\"name\":\"testbucket2\",\"namespace_id\":\"default\"}}\r\n],<\/pre>\nUse as credenciais para user1, que tem apenas query_select[testbucket1], e voc\u00ea ver\u00e1 apenas a entrada para testbucket1.<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\" -u user1 -p password<\/pre>\n\"results\": [\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket1\",\"name\":\"testbucket1\",\"namespace_id\":\"default\"}}\r\n],<\/pre>\nO espa\u00e7o de chave system:indexes \u00e9 tratado de forma muito semelhante a system:keyspaces: as fun\u00e7\u00f5es de alto n\u00edvel permitem acesso completo, enquanto a fun\u00e7\u00e3o query_select permite acesso filtrado. A diferen\u00e7a real \u00e9 que a fun\u00e7\u00e3o query_manage_index permite acesso filtrado, como query_select.<\/span><\/p>\nProte\u00e7\u00e3o para APIs de administra\u00e7\u00e3o<\/h2>\n
O mecanismo de consulta N1QL tem APIs RESTful correspondentes a tr\u00eas dos espa\u00e7os-chave do sistema: system:prepareds, system:completed_requests e system:active_requests. Elas costumavam ser abertas no Couchbase 4.6, mas agora est\u00e3o protegidas. Eles exigem as mesmas credenciais que os espa\u00e7os de chave.<\/p>\n
curl https:\/\/localhost:8093\/admin\/prepareds<\/pre>\n{\"caller\":\"auth:268\",\r\n \"code\":13014,\"key\":\"datastore.couchbase.insufficient_credentiasl\",\r\n \"message\":\"User does not have credentials to run queries accessing the system tables. \r\n Add role query_system_catalog to allow the query to run.\"}<\/pre>\nSe tentarmos novamente com o usu\u00e1rio 5, que tem a fun\u00e7\u00e3o necess\u00e1ria, isso funcionar\u00e1.<\/p>\n
curl https:\/\/localhost:8093\/admin\/prepareds -u user5:password<\/pre>\nAcesso a buckets migrados sem senha<\/h2>\n
Ao migrar da vers\u00e3o 4.6 para a 5.0, \u00e9 \u00fatil preservar os padr\u00f5es de permiss\u00f5es existentes, para permitir que os aplicativos legados continuem funcionando como antes. Isso \u00e9 um pouco complicado nesse caso, porque na vers\u00e3o 4.6 o acesso era controlado por meio de senhas nos pr\u00f3prios buckets, enquanto na vers\u00e3o 5.0 o controle de acesso \u00e9 baseado em usu\u00e1rios com v\u00e1rias fun\u00e7\u00f5es.<\/p>\n
Para preservar os padr\u00f5es de acesso legados, durante o processo de atualiza\u00e7\u00e3o, criamos usu\u00e1rios com nomes e senhas correspondentes ao bucket original. Isso permite que os aplicativos existentes continuem fazendo o que estavam fazendo, mesmo no caso de acesso sem nenhuma senha.<\/p>\n
Para ver isso em a\u00e7\u00e3o, ser\u00e1 necess\u00e1rio algum trabalho. Fique confort\u00e1vel.<\/p>\n
Comece instalando o Couchbase 4.6. Em seguida, crie dois buckets, \"openbucket\" sem senha e \"closedbucket\" com a senha \"password\".<\/p>\n
V\u00e1 para a guia Query (Consulta) e adicione \u00edndices prim\u00e1rios para ambos os buckets para permitir a execu\u00e7\u00e3o de consultas N1QL.<\/p>\n
create primary index on openbucket\r\ncreate primary index on closedbucket<\/pre>\nVerifique se o openbucket pode ser consultado sem uma senha:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from openbucket\"<\/pre>\nMas a consulta ao closedbucket sem uma senha falha:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\"<\/pre>\nMas o closedbucket pode ser consultado com uma senha:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\" -u closedbucket -p password<\/pre>\nEsse \u00e9 o padr\u00e3o de acesso que queremos preservar quando atualizarmos para a vers\u00e3o 5.0. Agora, desligue o Couchbase e fa\u00e7a a atualiza\u00e7\u00e3o para a vers\u00e3o 5.0, preservando os dados subjacentes que acabamos de criar. Em seguida, v\u00e1 para a tela Seguran\u00e7a do console do Couchbase. L\u00e1, voc\u00ea ver\u00e1 dois novos usu\u00e1rios criados pelo processo de atualiza\u00e7\u00e3o.<\/p>\n
![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/created-users-300x63.png\")
<\/p>\n
O usu\u00e1rio \"closedbucket\" tem o mesmo nome que o bucket \"closedbucket\" e a senha que foi atribu\u00edda ao bucket na vers\u00e3o 4.6. Ele nos permite preservar o acesso legado ao closedbucket. O usu\u00e1rio \"openbucket\" faz o mesmo, mas para o openbucket.<\/p>\n
Vamos verificar se o padr\u00e3o de acesso anterior ainda funciona.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from openbucket\"<\/pre>\nO Openbucket ainda pode ser acessado sem uma senha.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\"<\/pre>\nO acesso ao Closedbucket falha sem uma senha.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\" -u closedbucket -p password<\/pre>\nMas o acesso ao closedbucket \u00e9 bem-sucedido com uma senha.<\/p>\n
Viva! As coisas funcionam como antes. V\u00e1 preparar uma guloseima para voc\u00ea.<\/p>\n
Resumo<\/h2>\n\n- O controle de acesso no Couchbase 4.6 usava senhas para os buckets. No 5.0, ele usa fun\u00e7\u00f5es atribu\u00eddas aos usu\u00e1rios.<\/li>\n
- As principais fun\u00e7\u00f5es usadas para controlar o acesso de um usu\u00e1rio ao N1QL s\u00e3o query_select\/query_insert\/query_update\/query_delete. Todas elas s\u00e3o parametrizadas por bucket.<\/li>\n
- Fun\u00e7\u00f5es importantes mais especializadas incluem query_manage_index, query_system_catalog e query_external_access.<\/li>\n
- Explicar ou preparar uma consulta requer as mesmas fun\u00e7\u00f5es que a execu\u00e7\u00e3o da mesma.
\nH\u00e1 novos comandos que permitem que voc\u00ea CONCEDA e REVOGUE fun\u00e7\u00f5es.<\/li>\n - O sistema de fun\u00e7\u00f5es deve ser familiar aos usu\u00e1rios familiarizados com outros grandes bancos de dados. A principal diferen\u00e7a \u00e9 que o Couchbase n\u00e3o tem no\u00e7\u00e3o de permiss\u00f5es fora das fun\u00e7\u00f5es.<\/li>\n
- H\u00e1 novos espa\u00e7os-chave do sistema para consultar os usu\u00e1rios e as fun\u00e7\u00f5es atribu\u00eddas a eles.
\nOs espa\u00e7os de chave do sistema s\u00e3o controlados para fins de seguran\u00e7a. O comportamento varia de espa\u00e7o de chave para espa\u00e7o de chave, dependendo da sensibilidade dos dados contidos nele.<\/li>\n - Os padr\u00f5es de acesso existentes, mesmo para buckets sem senha, ainda devem funcionar ap\u00f3s a migra\u00e7\u00e3o da vers\u00e3o 4.6 para a 5.0.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"
In Couchbase 4.5, data was secured bucket by bucket. Each bucket had a password, and in order to access a bucket through a N1QL query, the user had to include the bucket password with the query. Passwordless buckets were possible, […]<\/p>","protected":false},"author":8157,"featured_media":4141,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1813,1812],"tags":[1903],"ppma_author":[9058],"class_list":["post-4136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-n1ql-query","tag-rbac"],"acf":[],"yoast_head":"\n
Role-Based Access Control (RBAC) Use in N1QL | Couchbase<\/title>\n<meta name=\"description\" content=\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.couchbase.com\/blog\/pt\/using-role-based-access-control-in-n1ql\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Using Role-Based Access Control in N1QL\" \/>\n<meta property=\"og:description\" content=\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.couchbase.com\/blog\/pt\/using-role-based-access-control-in-n1ql\/\" \/>\n<meta property=\"og:site_name\" content=\"The Couchbase Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-23T18:39:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-14T06:43:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2048\" \/>\n\t<meta property=\"og:image:height\" content=\"1365\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Johan Larson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Johan Larson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"},\"author\":{\"name\":\"Johan Larson\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1\"},\"headline\":\"Using Role-Based Access Control in N1QL\",\"datePublished\":\"2017-10-23T18:39:31+00:00\",\"dateModified\":\"2025-06-14T06:43:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"},\"wordCount\":2838,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"keywords\":[\"RBAC\"],\"articleSection\":[\"Security\",\"SQL++ \/ N1QL Query\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\",\"name\":\"Role-Based Access Control (RBAC) Use in N1QL | Couchbase\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"datePublished\":\"2017-10-23T18:39:31+00:00\",\"dateModified\":\"2025-06-14T06:43:19+00:00\",\"description\":\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"width\":2048,\"height\":1365},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.couchbase.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using Role-Based Access Control in N1QL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"name\":\"The Couchbase Blog\",\"description\":\"Couchbase, the NoSQL Database\",\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\",\"name\":\"The Couchbase Blog\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"width\":218,\"height\":34,\"caption\":\"The Couchbase Blog\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1\",\"name\":\"Johan Larson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/93b175bb8728e12439dd573fc27b9d1a\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g\",\"caption\":\"Johan Larson\"},\"description\":\"Johan Larson is a Senior Software Engineer at Couchbase. Johan's work responsibility is building an SQL-based query language for JSON data in a distributed NoSQL system.\",\"url\":\"https:\/\/www.couchbase.com\/blog\/pt\/author\/johan-larson\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Role-Based Access Control (RBAC) Use in N1QL | Couchbase","description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.couchbase.com\/blog\/pt\/using-role-based-access-control-in-n1ql\/","og_locale":"pt_BR","og_type":"article","og_title":"Using Role-Based Access Control in N1QL","og_description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","og_url":"https:\/\/www.couchbase.com\/blog\/pt\/using-role-based-access-control-in-n1ql\/","og_site_name":"The Couchbase Blog","article_published_time":"2017-10-23T18:39:31+00:00","article_modified_time":"2025-06-14T06:43:19+00:00","og_image":[{"width":2048,"height":1365,"url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","type":"image\/jpeg"}],"author":"Johan Larson","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Johan Larson","Est. reading time":"13 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#article","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"},"author":{"name":"Johan Larson","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1"},"headline":"Using Role-Based Access Control in N1QL","datePublished":"2017-10-23T18:39:31+00:00","dateModified":"2025-06-14T06:43:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"},"wordCount":2838,"commentCount":0,"publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","keywords":["RBAC"],"articleSection":["Security","SQL++ \/ N1QL Query"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","url":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","name":"Role-Based Access Control (RBAC) Use in N1QL | Couchbase","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","datePublished":"2017-10-23T18:39:31+00:00","dateModified":"2025-06-14T06:43:19+00:00","description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","breadcrumb":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","width":2048,"height":1365},{"@type":"BreadcrumbList","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.couchbase.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Using Role-Based Access Control in N1QL"}]},{"@type":"WebSite","@id":"https:\/\/www.couchbase.com\/blog\/#website","url":"https:\/\/www.couchbase.com\/blog\/","name":"Blog do Couchbase","description":"Couchbase, o banco de dados NoSQL","publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.couchbase.com\/blog\/#organization","name":"Blog do Couchbase","url":"https:\/\/www.couchbase.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","width":218,"height":34,"caption":"The Couchbase Blog"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1","name":"Johan Larson","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/93b175bb8728e12439dd573fc27b9d1a","url":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","caption":"Johan Larson"},"description":"Johan Larson \u00e9 engenheiro de software s\u00eanior da Couchbase. A responsabilidade do trabalho de Johan \u00e9 criar uma linguagem de consulta baseada em SQL para dados JSON em um sistema NoSQL distribu\u00eddo.","url":"https:\/\/www.couchbase.com\/blog\/pt\/author\/johan-larson\/"}]}},"authors":[{"term_id":9058,"user_id":8157,"is_guest":0,"slug":"johan-larson","display_name":"Johan Larson","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","first_name":"Johan","last_name":"Larson","user_url":"","author_category":"","description":"Johan Larson \u00e9 engenheiro de software s\u00eanior da Couchbase. A responsabilidade do trabalho de Johan \u00e9 criar uma linguagem de consulta baseada em SQL para dados JSON em um sistema NoSQL distribu\u00eddo."}],"_links":{"self":[{"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/posts\/4136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/users\/8157"}],"replies":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/comments?post=4136"}],"version-history":[{"count":0,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/posts\/4136\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/media\/4141"}],"wp:attachment":[{"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/media?parent=4136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/categories?post=4136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/tags?post=4136"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/pt\/wp-json\/wp\/v2\/ppma_author?post=4136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/new-user-0-260x300.png\")
<\/p>\n![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/new-user-1-262x300.png\")
<\/p>\n