GraphDB 11.5.0 Release Notes

Important

GraphDB 11.5 introduces several new features that provide administrators with more control over its security mechanisms. It introduces a new repository-scoped permission — repository maintainer — which grants a user maintenance permissions for a specific repository without giving them indiscriminate access to all repositories. This minor release also introduces the option to use multiple authorization sources, combining LDAP, OAuth and Local databases. With 11.5, a primary source and one or more additional sources can be combined, which can be particularly useful in granting temporary access to users managed through the local authorization database when using an external security provider, reducing the need for lengthy IdP workflows.

The addition of the repository maintainer permission also brings a change in the nomenclature of user roles. Prior to GraphDB 11.5, the terminology did not differentiate between the roles assigned to a user and the additional repository-level permissions that can be assigned to users. With GraphDB 11.5, they are now called “user roles” and “additional permissions” respectively. This change is only with the terminology and does not affect the existing security mechanism in any way. No actions are required, but more information can be found in the Migrating GraphDB configurations page.

GraphDB 11.5 also introduces a new unifed metric endpoint for Prometheus monitoring. The endpoint returns all instance metrics in a single response, ready for ingestion by Prometheus.

The query log and the slow-query log now include the name of the repository where a query was executed, as well as the name of the user who executed it. The name of the repository is always included, while the username is excluded by default for security reasons.

Additionally, GraphDB 11.5 includes numerous other bug fixes and smaller improvements, enhancing overal product stability and user experience, including a critical RCE vulnerability through malicious code in prefixes, and a critical issue with the performance of max active repositories during cluster creation.

The development of the features in this release was partially funded by the EnrichMyData (GA nu: 101070284) Horizon Europe  research project.

Maintain repository permission

GraphDB 11.5 introduces a new repository-level permission maintain_repo_<repositoryId>, which grants a user elevated management permissions for a specific repository without giving them access to any other repository. A user with this permission can restart a given repository and edit its permissions, but cannot delete a repository.

Multiple authorization sources

GraphDB now supports configuring multiple authorization sources simultaneously. Previously, only one authorization backend could be active at a time (local, ldap, or oauth). With 11.5, a primary source and one or more additional sources can be combined. Adminstrators can now grant temporary access to users managed through the local authorization database directly in the Workbench using the UI and without touching the IdP.

Unified metrics endpoint for Prometheus

GraphDB 11.5 adds a unified metrics endpoint that returns all instance metrics in a single response, ready for ingestion by Prometheus and compatible monitoring stacks. The endpoint aggregates all Prometheus metrics (such as system, repository, cluster, and query statistics), as well as the newly introduced license metric, which monitors the number of days left until your GraphDB license expires.

Reduced disk space requirements through moving the replication’s snapshot location

Prior to GraphDB 11.5, when setting up a cluster, GraphDB required disk space equal to at least twice the size of the repository’s data directory. Now, when configuring a cluster, the disk space requirements can be significantly reduced by changing the replication’s snapshot location to be outside of the data directory. Decoupling the snapshot storage from the repository data directory can optimize the disk footprint of cluster deployments. This is controlled through the configuration property graphdb.home.data.recovery.

The query log and slow-query log now include additional contextual fields to help operations teams understand the query load of a production instance:

Enhanced query and slow-query logging

These additions make it significantly easier to attribute load to specific users and repositories. For security reasons, the user is excluded from the logs by default.