RBAC for Applications

Couchbase roles each have a fixed association with a set of one or more privileges. Each privilege is associated with a resource. Privileges are actions such as Read, Write, Execute, Manage, Flush, or List; or a combination of some or all of these.

When an application attempts to access a resource, the application’s roles and privileges are checked by Couchbase Server. If the assigned roles contain privileges that support the kind of access that is being attempted, access is granted; otherwise, it is denied.

The following list contains all application-roles supported by Couchbase RBAC. Each role explained by means of a description and a table: the table lists the privileges in association with resources. Where a privilege is associated with a resource, this is indicated with a check-mark. Where a privilege is not associated with a resource (or where association would not be applicable), this is indicated with a cross.

Only a subset of application-roles are granted access to the Couchbase Web Console. In the tables below, if a UI row is included, the role is granted the UI-related privilege indicated in the row, and the username and password associated with the role can therefore be used to log into the console. If no UI row is included, no UI-related privilege is granted; and the username and password cannot therefore be used to log into the console.

The Bucket Full Access role provides full access to bucket data. Note that this privilege is available for the Community Edition of Couchbase Server, as well as for Enterprise Edition.

The role is provided in support of buckets that were created on versions of Couchbase Server prior to 5.0. Such buckets were accessed by specifying bucket-name and bucket-password: however, bucket-passwords are not recognized by Couchbase Server 5.0 and after. Therefore, for each pre-existing bucket, the 5.0 upgrade-process creates a new user, whose username is identical to the bucket-name; and whose password is identical to the former bucket-password, if one existed. If no bucket-password existed, the user is created with no password. This migration-process allows the same name-combination as before to be used in authentication. To ensure backwards compatibility, each system-created user is assigned the Bucket Full Access role, which authorizes the same read-write access to bucket-data as was granted before 5.0.

Use of the Bucket Full Access role is deprecated for buckets created on Couchbase Server 5.0 and after: use the other bucket-access roles provided.

The Data Reader role allows data to be read from a specified bucket. Note that the role does not permit the running of N1QL queries (such as SELECT) against data.

The Data Writer role allows information to be written to and read from a specified bucket.

The Data DCP Reader role allows DCP streams to be read.

The Data Backup role allows data to be backed up and restored.

The Data Monitoring role allows all bucket-statistics to be read.

The Views Reader role allows all views to be read.

The role FTS Searcher allows Full Text Search indexes to be searched by users with appropriate bucket-privileges.

The Query Select role allows the SELECT statement to be executed on a specified bucket.

The Query Update role allows the UPDATE statement to be executed on a specified bucket.

The Query Insert role allows the INSERT statement to be executed on a specified bucket.

The Query Delete role allows the DELETE statement to be executed on a specified bucket.

The Query Manage Index role allows indexes to be managed for a specified bucket.

The Query System Catalog role allows information to be looked up in the system catalog: this includes system:indexes, system:prepareds, and tables listing current and past queries. This role is designed for troubleshooters, who need to debug queries.

The Query External Access role allows the N1QL CURL function to be executed by an externally authenticated user.

Note that the Query External Access role should be assigned with caution, since it entails risk: CURL runs within the local Couchbase Server network; therefore, the assignee of the Query External Access role is permitted to run GET and POST requests on the internal network, while being themselves externally located.

For an account of limitations on CURL, see CURL Function.

In Couchbase Server 5.0, three new system keyspaces have been added:

Along with these three keyspaces, meta data related to roles and user access has been added as well.

This brings the total number of system keyspaces up to 12:

SELECT Operations on System Keyspaces

All of the system keyspaces support SELECT operations and are divided into the below security levels: