Configure Access Control

Configure fine-grained access control to define which collections each edge client user can read from or write to.

Prerequisites

Couchbase Edge Server {version} or later.
A users file configured for your deployment. See Authentication.
Users must authenticate using Basic Auth or mTLS client certificates.

Enable Access Control on a Database

Access control enforcement is opt-in and is configured at the server level. Set enable_user_access_control to true in the top-level server configuration.

{
  "enable_user_access_control": true,
  "databases": {
    "mydb": { }
  }
}

When this property is not set or is set to false, all configured users have unrestricted read and write access to all collections in all databases.

Define User Access Permissions

Access permissions are defined in the users file using the access property. Each entry maps a keyspace pattern to an array of permitted operations.

{
  "$schema": "…/users_schema.json",
  "appUser": {
    "access": {
      "travel.*": ["read"],
      "travel.inventory.hotels": ["write"],
      "travel.inventory.landmarks": ["read", "write"],
      "sales": ["read"]
    },
    "password": "<<bcrypt password>>"
  },
  "admin": {
    "roles": ["admin"],
    "password": "<<bcrypt password>>"
  }
}

In this example:

appUser has read access to all collections in the travel database.
appUser has write-only access to the hotels collection in the travel.inventory scope.
appUser has read and write access to the landmarks collection in the travel.inventory scope.
appUser has read access to the _default._default collection of the sales database.
admin has unrestricted access to all databases as an admin role user.

The password field is optional when using mTLS certificate-based authentication. If provided, it is ignored for mTLS users.

Keyspace Pattern Reference

Table 1. Keyspace Pattern Syntax
Pattern	Target
`database.scope.collection`	A specific collection within a specific scope.
`database.scope.*`	All collections within a specific scope.
`database.*`	All collections within the database, including `_default`.
`database`	The `_default._default` collection of the database.
`database._default.collection` or `database.collection`	A named collection within the `_default` scope.

Next Steps

To restrict which named queries a user can execute, see configuration:configure-query-access.adoc.
To review how Couchbase Edge Server enforces access control across REST operations, see configuration:fine-grained-access-control.adoc.