RDF4J with OIDC / building a platform

[uahic]

Hello everyone,

I started working on a project which in nature is a platform for uploading data organized as an ontology which describes product components and their comparability (which will also be checked to a certain extent automatically) and users then can either search the database for components or register new ones .

Now we would like to build a service platform where users can register their organisations, upload components, validate them etc. and I found keycloak to be a valid option for our user management. Or in other words: single sign-on is really something we would like to have. Then I started integrating Keycloak into Jena's Fuseki until project partners started asking for the platform to be also horizontally scalable, which Jena does not really seem to be but RDF4J does (at least on a very basic level if I got the documentation right?).

So, before I start really digging deep into RDF4J I'd like to ask the experienced community members for their opinions:

1. is integrating OpenID connect in RDF4J feasible/possible to have role-based and/or fine-grained level access control? From a rough look at the documentation, it looks somewhat similar to how Jena is setup on the first glance but probably its not. Keycloak does have a spring integration (if that helps)
2. is Apache HBase / Halyard working well with RDF4J? or is it more on a really buggy prototype level?
3. I likely need users to be able to create new graphs (at least on the logical level), is it possible to also have this secured? In Jena for example I have not yet figured out how to apply a custom Security filter for dynamically generated graphs, only the per-defined datasets in their configuration files.
4. Overall, do you think this approach is worth the while or does it lack features/stability required for production readiness?

I did spend a couple of hours/days looking at neo4j, graphdb, jena, rdf4j, Blazegraph, (allgero, virtuoso not so much yet), orient-db, etc. etc. but the regular pattern was: prohibitive licenses or costs for our publicly founded project - or the lack of RDF-converter/SPARQL capabilities.

Thank you very much for your help!

[hmottestad]

Hi @uahic

This seems like quite a big project.

I have not tried to use OpenID with the authentication mechanisms in the RDF4J Server. I believe we use the Java EE security-constraint approach. It's endpoint based, so I don't think you'll get graph level security. I haven't looked much into it though.

@pulquero maintains a fork of Halyard. I would try that out if I were you, and maybe talk to the maintainer if you have any questions. I think that Halyard is probably the only free and open source solution for a horizontally scalable RDF4J based triple store.

Feel free to contribute to RDF4J if you find something you want to improve :)

[uahic]

Hi @hmottestad thanks for the quick and helpful reply! yes, its quite overwhelming, especially to get the basics (OpenID auth, sparql, scalability) right. Only commercial solutions seem to offer what we need but there is no money for expensive licenses in our project :/

I actually started implementing OpenID (keycloak) for Jena (based on an existing project) (and the Authentication part works) but the issue there is that Jena officially has only a database that doesnt scale vertically at all. There are some projects with connectors for other but the maintainers of those dont reply to some questions and their code base is complex enough to get lost in them :/

@pulquero
I'm looking into your codebase right now but its not really clear to me how I would pass a bearer token until it hits Hbase and how HBase would do a verification lookup (e.g. keycloak), if that is even possible. HBase seems only to support Kerberos. If you think is doable I'd be grateful for some hints :)

From the first glance it looks like that without tons of effort it is not possible to achieve node-level security with RDF4J using SPARQL directly. Like others I would have probably to take a detour via Spring (which integrates with OpenID) and check the users privileges on the basis of per-specific-function-REST or GraphQL level instead via the sparql-endpoints.

[uahic]

@pulquero One general question I do have for you (if that is ok :) ). Is halyard actually making use of the sparql federation for sending/fetching parallel requests to all Hbase instances or is that handled internally by Hbase? Thanks

[pulquero]

Verification lookup: cell security is implemented using cell tags and adding the VisibilityController to the HBase servers. If that doesn't quite meet your requirements, you could write your own equivalent controller that uses custom cell tags to perform per cell security checks. This would then filter out any RDF statements that a user cannot see before they even reach Halyard.

Passing bearer token: here's one approach that comes to mind, for illustration purposes. HBase scan requests have arbitrary attributes that would be accessible to a visibility controller. It shouldn't be too hard to have Halyard send a bearer token as a scan attribute.

[pulquero]

@uahic parallel requests are handled internally by Halyard - the query execution engine is multithreaded, e.g. a SPARQL UNION is sent as parallel requests to HBase. Separate from this, there is support for efficient federated queries across HBase tables. That is, if you have several RDF4J repositories stored using Halyard, you can federate across them using SERVICE with little additional overhead compared to querying its own HBase table.

[uahic]

I decided to not directly expose rdf4j/halyard to the users but rather to do security with spring-boot + keycloak in-between. It is somewhat a lazy solution but gives us in our project more control over API access and triggering non-rdf4j-related actions by offering our own REST API as well. However, we do use Halyard-star (many thanks for your efforts, also to maintain it with the most recent versions of RDF4J).