GRANT query_external_access TO myuser<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nEXPLAIN and PREPARE<\/h2>\n
Of course, we can do things with queries other than just running them. We can use EXPLAIN to understand how the query engine computes a query. And we can use PREPARE to set up a query for repeated execution.<\/p>\n
In Couchbase 5.0, the permissions for EXPLAIN and PREPARE are simple. They are the same as the permissions required for the underlying statement. That’s all there is to it.<\/p>\n
To test this, let’s try to EXPLAIN a simple SELECT statement, the same one we used in the earlier “Primary Roles” section:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"explain select * from testbucket1\"<\/pre>\nIn response we get an error message asking for a specific role:<\/p>\n
\"errors\": [{\"code\":13014,\"msg\":\"User does not have credentials to run SELECT queries \r\n on the testbucket1 bucket. Add role query_select on testbucket1 to allow the query to run.\"}],<\/pre>\nLet’s provide a user with that role:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"explain select * from testbucket1\" -u user1 -p password<\/pre>\nSuccess, just as we saw for the statement itself back in “Primary Roles”.<\/span><\/p>\nNow let’s try to PREPARE the second statement from “Primary Roles”:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"PREPARE INSERT INTO testbucket2 (KEY source.c_id, VALUE source.customer) \r\n SELECT * FROM testbucket1 source WHERE source.new = true\"<\/pre>\nWe get the same error message we originally got for the statement itself:<\/span><\/p>\n\"errors\": [{\"code\":13014,\"msg\":\"User does not have credentials to run INSERT queries on the \r\n testbucket2 bucket. Add role query_insert on testbucket2 to allow the query to run.\"}],<\/pre>\nAnd if we add a user with credentials for the SELECT and INSERT, the PREPARE succeeds:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"PREPARE INSERT INTO testbucket2 (KEY source.c_id, VALUE source.customer) \r\n SELECT * FROM testbucket1 source WHERE source.new = true\" \r\n -u user3 \r\n -p password<\/pre>\nGRANT and REVOKE<\/h2>\n
In 5.0, N1QL includes statements for giving users roles (GRANT) and for taking them away (REVOKE). These statements require Administrator permission to run.<\/span><\/p>\nBefore trying out these statements, let’s review what users are configured and what roles they have. Here is what you should see in the Security screen of the Couchbase console.<\/span><\/p>\n![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/user-permissions-300x161.png\")
<\/p>\n
We can grant a new role cluster_admin to user1 like this:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"grant cluster_admin to user1\" -u Administrator -p password<\/pre>\nThis will succeed, and shortly thereafter the Couchbase console will update to reflect the new role assignment.<\/p>\n
We can also assign parameterized roles, like this:<\/p>\n
cbq -e https:\/\/localhost:8093\/ \r\n -s \"grant query_insert on testbucket2 to user2\" \r\n -u Administrator \r\n -p password<\/pre>\nWe can undo the initial grant by a REVOKE:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"revoke cluster_admin from user1\" -u Administrator -p password<\/pre>\nAll of these parameters can take lists of arguments:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ \r\n -s \"grant query_insert, query_delete on testbucket1, testbucket2 to user5, user6\" \r\n -u Administrator \r\n -p password<\/pre>\nAnd finally, the query_ prefix is optional for query_insert, query_update, query_delete, and query_select, making some of the syntax more familiar:<\/span><\/p>\ncbq -e \u00a0https:\/\/localhost:8093\/ -s \"grant insert,delete on testbucket1 to user4\" \r\n -u Administrator -p password<\/pre>\nComparison with Oracle<\/h2>\n
Role-based access control in Couchbase 5.0 has been designed to be familiar to professionals who have used access control in other current database systems. By now, you should have recognized familiar concepts such as insert\/select\/update\/delete permissions being applicable to buckets, which are sort of like tables. Also, the notion of administrator users with broad permissions should be familiar.\u00a0Role-based access control in Couchbase 5.0 has been designed to be familiar to professionals who have used access control in other current database systems. By now, you should have recognized familiar concepts such as insert\/select\/update\/delete permissions being applicable to buckets, which are sort of like tables. Also, the notion of administrator users with broad permissions should be familiar.<\/p>\n
For example, this GRANT query will work on both Couchbase and Oracle:<\/p>\n
GRANT select, insert ON default TO jlarson, pedwards<\/pre>\nOne conceptual difference between Couchbase and other systems such as Oracle is that we have a binary model of privilege: users and roles. They typically have a trinary model, with users, roles, and privileges. Accordingly, giving users permissions in Oracle is about granting privileges on objects to users. In Couchbase, it’s about granting parameterized roles to users.<\/p>\n
Roles are static in 5.0. There is no equivalent of statements to CREATE\/DROP\/ALTER ROLE.<\/p>\n
Couchbase permissions are either on the system as a whole or on buckets. We have no notion of permissions on tables, columns, or collections.<\/p>\n
In Couchbase GRANT and REVOKE are only possible by Admin users. There is no such thing as an ADMIN OPTION or a GRANT OPTION. Changing permissions requires you to be an Administrator.<\/p>\n
Finally, we have no equivalent of SET ROLE. SET ROLE is a session-level command, which makes no sense in Couchbase because we have no sessions, only individual RESTful requests.<\/p>\n
New System Keyspaces<\/h2>\n
Couchbase 5.0 introduces three new system keyspaces related to users. The first of these is system:user_info. This keyspace lists the users configured in the system, including their roles. Let’s try a query:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:user_info\" -u Administrator -p password<\/pre>\nThat gets us seven entries like this, one for every user we have set up, plus the configured Administrator:<\/p>\n
{\"user_info\":{\"domain\":\"local\",\"id\":\"user4\",\"name\":\"User4\",\"roles\":[{\"bucket_name\":\"testbucket1\",\"role\":\"query_manage_index\"},{\"bucket_name\":\"testbucket1\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket1\",\"role\":\"delete\"}]}},\r\n{\"user_info\":{\"domain\":\"local\",\"id\":\"user2\",\"name\":\"User 2\",\"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"select\"},{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"}]}},\r\n{\"user_info\":{\"domain\":\"local\",\"id\":\"user5\",\"name\":\"User5\",\"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket1\",\"role\":\"insert\"},{\"bucket_name\":\"testbucket2\",\"role\":\"delete\"},{\"bucket_name\":\"testbucket1\",\"role\":\"delete\"},{\"role\":\"query_system_catalog\"}]}},<\/pre>\nThe system:applicable_roles keyspace is similar, but breaks up each user role into a separate entry, producing a more relational view of the data:<\/p>\n
cbq -e https:\/\/localhost:8093\/ \r\n -s \"select * from system:applicable_roles where grantee = 'user3'\" \r\n -u Administrator \r\n -p password<\/pre>\n\"results\": [\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket2\",\"grantee\":\"user3\",\"role\":\"select\"}},\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket1\",\"grantee\":\"user3\",\"role\":\"select\"}},\r\n{\"applicable_roles\":{\"bucket_name\":\"testbucket2\",\"grantee\":\"user3\",\"role\":\"insert\"}}\r\n],<\/pre>\nFinally, the system:my_user_info keyspace shows the portion of system:my_user_info corresponding to the user whose credentials are passed in with the query.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:my_user_info\" -u user3 -p password<\/pre>\n\"results\": [\r\n{\"my_user_info\":{\"domain\":\"local\",\"id\":\"user3\",\"name\":\"User 3\",\r\n \"roles\":[{\"bucket_name\":\"testbucket2\",\"role\":\"select\"},{\"bucket_name\":\"testbucket1\",\"role\":\"select\"},{\"bucket_name\":\"testbucket2\",\"role\":\"insert\"}]}}\r\n],<\/pre>\nAccess to System Keyspaces<\/h2>\n
In keeping with a general philosophy of secure operation, system keyspaces (buckets) are secured in version 5.0. The degree of restriction varies based on the data present in each keyspace.<\/p>\n
Three keyspaces have nothing that is likely to be valuable to an attacker:<\/p>\n
\n- system:datastores<\/li>\n
- system:namespaces<\/li>\n
- system:dual<\/li>\n<\/ul>\n
Accordingly, these keyspaces are not secured. No credentials are needed to access them.<\/p>\n
cbq -e https:\/\/localhost:8093\/query\/service -s \"select * from system:datastores\"<\/pre>\n\"results\": [\r\n{\"datastores\":{\"id\":\"https:\/\/127.0.0.1:8091\",\"url\":\"https:\/\/127.0.0.1:8091\"}}\r\n],<\/pre>\nAt the other end of security are system:user_info and system:applicable_roles, which contain the list of users and their roles. These are accessible only by Admin and Read Only Admin users. The system:my_user_info table is similar, but only shows the relevant information for the user whose credentials are presented with the query. We have already explored these tables, above.<\/p>\n
The next four system keyspaces contain a variety of runtime and configuration information.<\/p>\n
\n- System:prepareds<\/li>\n
- System:completed_requests<\/li>\n
- System:active_requests<\/li>\n
- System:nodes<\/li>\n<\/ul>\n
Since the information in them is not as sensitive as user information, they are more widely viewable. They can be accessed by most admins, even minor ones: Admin, Read Only Admin, Cluster Admin, Query System Catalog, Replication Admin, Bucket Admin(any bucket), or Views Admin(any bucket).<\/p>\n
Let’s try looking at system:prepareds as user5, the user we created with Query System Catalog permission, above.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from system:prepareds\" -u user5 -p password<\/pre>\nThis shows us one prepared statement that we created earlier.<\/p>\n
The system:keyspaces keyspace shows the list of buckets configured in the system. This information is somewhat sensitive, since it gives an attacker information about what a system is used for. Accordingly, users with high-level roles (Admin, Read Only Admin, Cluster Admin) see everything in this keyspace. Users with the Query System Catalog role also see everything, since this role is intended for debugging query problems. For other users, the view is filtered; the user sees only those keyspaces for which they have query_select permission.<\/p>\n
For example, a query against system:keyspaces with no credentials will succeed but will show no entries:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\"<\/pre>\n\"results\": [\r\n\r\n],<\/pre>\nAdd credentials for user5, who has the Query System Catalog role, and all entries are shown:<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\" -u user5 -p password<\/pre>\n\"results\": [\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket1\",\"name\":\"testbucket1\",\"namespace_id\":\"default\"}},\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket2\",\"name\":\"testbucket2\",\"namespace_id\":\"default\"}}\r\n],<\/pre>\nUse credentials for user1, who has only query_select[testbucket1], and you’ll see only the entry for testbucket1.<\/span><\/p>\ncbq -e https:\/\/localhost:8093\/ -s \"select * from system:keyspaces\" -u user1 -p password<\/pre>\n\"results\": [\r\n{\"keyspaces\":{\"datastore_id\":\"https:\/\/127.0.0.1:8091\",\"id\":\"testbucket1\",\"name\":\"testbucket1\",\"namespace_id\":\"default\"}}\r\n],<\/pre>\nThe system:indexes keyspace is handled much like system:keyspaces: high-level roles allow complete access, while the query_select role allows filtered access. The real difference is that the query_manage_index role allows filtered access, like query_select.<\/span><\/p>\nProtection for Admin APIs<\/h2>\n
The N1QL query engine has RESTful APIs corresponding to three of the system keyspaces: system:prepareds, system:completed_requests, and system:active_requests. These used to be open in Couchbase 4.6, but are now secured. They require the same credentials as the the keyspaces do.<\/p>\n
curl https:\/\/localhost:8093\/admin\/prepareds<\/pre>\n{\"caller\":\"auth:268\",\r\n \"code\":13014,\"key\":\"datastore.couchbase.insufficient_credentiasl\",\r\n \"message\":\"User does not have credentials to run queries accessing the system tables. \r\n Add role query_system_catalog to allow the query to run.\"}<\/pre>\nIf we try again with user5, who has the required role, it works.<\/p>\n
curl https:\/\/localhost:8093\/admin\/prepareds -u user5:password<\/pre>\nAccess to Migrated Passwordless Buckets<\/h2>\n
When migrating from 4.6 to 5.0, it is useful to preserve existing permissions patterns, to allow legacy applications to keep working as they did before. This is a bit tricky in this case, because in 4.6 access was controlled using passwords on buckets themselves, whereas in 5.0 access control is based on users with various roles.<\/p>\n
To preserve legacy access patterns, during the upgrade process we create users with names and passwords matching the original bucket. This lets existing applications keep doing what they were doing, even in the case of access without any password at all.<\/p>\n
Seeing this in action is going to take some work. Get comfortable.<\/p>\n
Begin by installing Couchbase 4.6. Then create two buckets, “openbucket” with no password and “closedbucket” with password “password”.<\/p>\n
Go to the Query tab and add primary indexes for both buckets to allow N1QL queries to run.Go to the Query tab and add primary indexes for both buckets to allow N1QL queries to run.<\/p>\n
create primary index on openbucket\r\ncreate primary index on closedbucket<\/pre>\nVerify that openbucket can be queried without a password:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from openbucket\"<\/pre>\nBut querying closedbucket without a password fails:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\"<\/pre>\nBut closedbucket can be queried with a password:<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\" -u closedbucket -p password<\/pre>\nThis is the pattern of access we want to preserve as we upgrade to 5.0.\u00a0Now shut down Couchbase, and upgrade to 5.0, while preserving the underlying data we have just created. Then go to the Security screen of the Couchbase console. There you will see two new users created by the upgrade process.<\/p>\n
![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/created-users-300x63.png\")
<\/p>\n
The “closedbucket” user has the same name as the “closedbucket” bucket and the password that was assigned to the bucket in 4.6. It allows us to preserve legacy access to closedbucket. The “openbucket” user does the same, but for openbucket.<\/p>\n
Let’s check that the earlier access pattern still works.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from openbucket\"<\/pre>\nOpenbucket is still accessible without a password.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\"<\/pre>\nClosedbucket access fails without a password.<\/p>\n
cbq -e https:\/\/localhost:8093\/ -s \"select * from closedbucket\" -u closedbucket -p password<\/pre>\nBut closedbucket access succeeds with a password.<\/p>\n
Hurray! Things work as they did before. Go fix yourself a treat.<\/p>\n
Summary<\/h2>\n\n- Access control in in Couchbase 4.6 was using passwords for buckets. In 5.0 it is using roles assigned to users.<\/li>\n
- The primary roles used to control a user’s access to N1QL are query_select\/query_insert\/query_update\/query_delete. All of them are parameterized by bucket.<\/li>\n
- Important more specialized roles include query_manage_index, query_system_catalog, and query_external_access.<\/li>\n
- Explaining or preparing a query requires the same roles as executing it would.
\nThere are new statements that let you GRANT and REVOKE roles.<\/li>\n - The system of roles should be familiar to users familiar with other major databases. The main difference is that Couchbase has no notion of permissions outside of roles.<\/li>\n
- There are new system keyspaces for querying users and the roles assigned to them.
\nSystem keyspaces are controlled for security. The behavior varies from keyspace to keyspace depending on the sensitivity of the data therein.<\/li>\n - Existing access patterns, even for passwordless buckets, should still work after migration from 4.6 to 5.0.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
In Couchbase 4.5, data was secured bucket by bucket. Each bucket had a password, and in order to access a bucket through a N1QL query, the user had to include the bucket password with the query. Passwordless buckets were possible, […]<\/p>\n","protected":false},"author":8157,"featured_media":4141,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1813,1812],"tags":[1903],"ppma_author":[9058],"class_list":["post-4136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-n1ql-query","tag-rbac"],"acf":[],"yoast_head":"\n
Role-Based Access Control (RBAC) Use in N1QL | Couchbase<\/title>\n<meta name=\"description\" content=\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Using Role-Based Access Control in N1QL\" \/>\n<meta property=\"og:description\" content=\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\" \/>\n<meta property=\"og:site_name\" content=\"The Couchbase Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-23T18:39:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-14T06:43:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2048\" \/>\n\t<meta property=\"og:image:height\" content=\"1365\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Johan Larson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Johan Larson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"},\"author\":{\"name\":\"Johan Larson\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1\"},\"headline\":\"Using Role-Based Access Control in N1QL\",\"datePublished\":\"2017-10-23T18:39:31+00:00\",\"dateModified\":\"2025-06-14T06:43:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"},\"wordCount\":2838,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"keywords\":[\"RBAC\"],\"articleSection\":[\"Security\",\"SQL++ \/ N1QL Query\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\",\"name\":\"Role-Based Access Control (RBAC) Use in N1QL | Couchbase\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"datePublished\":\"2017-10-23T18:39:31+00:00\",\"dateModified\":\"2025-06-14T06:43:19+00:00\",\"description\":\"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg\",\"width\":2048,\"height\":1365},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.couchbase.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using Role-Based Access Control in N1QL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"name\":\"The Couchbase Blog\",\"description\":\"Couchbase, the NoSQL Database\",\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\",\"name\":\"The Couchbase Blog\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"width\":218,\"height\":34,\"caption\":\"The Couchbase Blog\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1\",\"name\":\"Johan Larson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/93b175bb8728e12439dd573fc27b9d1a\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g\",\"caption\":\"Johan Larson\"},\"description\":\"Johan Larson is a Senior Software Engineer at Couchbase. Johan's work responsibility is building an SQL-based query language for JSON data in a distributed NoSQL system.\",\"url\":\"https:\/\/www.couchbase.com\/blog\/author\/johan-larson\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Role-Based Access Control (RBAC) Use in N1QL | Couchbase","description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","og_locale":"en_US","og_type":"article","og_title":"Using Role-Based Access Control in N1QL","og_description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","og_url":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","og_site_name":"The Couchbase Blog","article_published_time":"2017-10-23T18:39:31+00:00","article_modified_time":"2025-06-14T06:43:19+00:00","og_image":[{"width":2048,"height":1365,"url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","type":"image\/jpeg"}],"author":"Johan Larson","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Johan Larson","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#article","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"},"author":{"name":"Johan Larson","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1"},"headline":"Using Role-Based Access Control in N1QL","datePublished":"2017-10-23T18:39:31+00:00","dateModified":"2025-06-14T06:43:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"},"wordCount":2838,"commentCount":0,"publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","keywords":["RBAC"],"articleSection":["Security","SQL++ \/ N1QL Query"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","url":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/","name":"Role-Based Access Control (RBAC) Use in N1QL | Couchbase","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","datePublished":"2017-10-23T18:39:31+00:00","dateModified":"2025-06-14T06:43:19+00:00","description":"Walk through the main functionality of role-based access control (RBAC) in Couchbase. These exercises will let you try out the new features for yourself.","breadcrumb":{"@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#primaryimage","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2017\/10\/Chain-link_and_barbed_wire.jpg","width":2048,"height":1365},{"@type":"BreadcrumbList","@id":"https:\/\/www.couchbase.com\/blog\/using-role-based-access-control-in-n1ql\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.couchbase.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Using Role-Based Access Control in N1QL"}]},{"@type":"WebSite","@id":"https:\/\/www.couchbase.com\/blog\/#website","url":"https:\/\/www.couchbase.com\/blog\/","name":"The Couchbase Blog","description":"Couchbase, the NoSQL Database","publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.couchbase.com\/blog\/#organization","name":"The Couchbase Blog","url":"https:\/\/www.couchbase.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","width":218,"height":34,"caption":"The Couchbase Blog"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/043ccbbfc54b95927c73f81ec7f6a0a1","name":"Johan Larson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/93b175bb8728e12439dd573fc27b9d1a","url":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","caption":"Johan Larson"},"description":"Johan Larson is a Senior Software Engineer at Couchbase. Johan's work responsibility is building an SQL-based query language for JSON data in a distributed NoSQL system.","url":"https:\/\/www.couchbase.com\/blog\/author\/johan-larson\/"}]}},"authors":[{"term_id":9058,"user_id":8157,"is_guest":0,"slug":"johan-larson","display_name":"Johan Larson","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/2ddf616344da1f84e85c42ba2bfc102e28380128c107cc21eeecc26edc737227?s=96&d=mm&r=g","author_category":"","last_name":"Larson","first_name":"Johan","job_title":"","user_url":"","description":"Johan Larson is a Senior Software Engineer at Couchbase. Johan's work responsibility is building an SQL-based query language for JSON data in a distributed NoSQL system."}],"_links":{"self":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/4136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/users\/8157"}],"replies":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/comments?post=4136"}],"version-history":[{"count":0,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/4136\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media\/4141"}],"wp:attachment":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media?parent=4136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/categories?post=4136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/tags?post=4136"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=4136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/new-user-0-260x300.png\")
<\/p>\n![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2017\/10\/new-user-1-262x300.png\")
<\/p>\n