RocksDB Column Families and Application-Layer Access Control Integration

Question

RocksDB is an embeddable persistent key-value store that lacks a native network layer, meaning it does not provide built-in authentication or credential management. Security boundaries and least-privilege access must be implemented entirely at the application layer.

When utilizing Column Families to partition data into logical stores, the isolation is logical rather than physical, as these families share the same underlying storage files and write-ahead logs. This architecture creates a challenge for applications that need to map specific user credentials to restricted access for individual Column Families.

Given that the storage engine does not track identity, the application must manage the mapping between authenticated sessions and the corresponding ColumnFamilyHandle.

How can an application efficiently invalidate access to specific Column Families when credentials expire without restarting the DB instance?
  What is the recommended pattern for ensuring that a handle passed to a worker thread cannot be used to access unauthorized Column Families?

Tasadduq Burney · Answer

Direct answer
RocksDB lacks built‑in per‑family authentication, so the application must map an authenticated session to the ColumnFamilyHandle that represents the user’s logical store. When credentials expire, the only safe way to revoke access without restarting the DB is to close the handle that grants the user permission and to ensure that no other thread continues to reference it. The application should keep a central permission store that maps a session token to the allowed handles; before any DB operation the store is consulted and the operation is aborted if the token is not authorized for the target family.
Confirmed steps

On credential expiration, locate the session token, retrieve the associated ColumnFamilyHandle(s), and call Close() (or Unload) on each handle to release the reference.
Remove the session token from the permission store so future operations are denied.
Provide worker threads with a wrapper object that holds a reference‑counted handle and checks the permission store before each DB call; the wrapper should reject the operation if the token is revoked.
Verify that no background thread still holds a reference by enumerating open handles (RocksDB’s GetHandles API) and confirming that handles for the revoked user are absent.

Please indicate how your application currently maps session tokens to ColumnFamilyHandle instances.

RocksDB Column Families and Application-Layer Access Control Integration

1 answer

Direct answer

Confirmed steps

Your perspective belongs here.

0 question comments