You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/limitations.adoc
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -390,8 +390,10 @@ So due to the additional data access required by the security checks, this opera
390
390
391
391
[[property-based-access-control-limitations]]
392
392
=== Property-based access control limitations
393
-
Extra node-level security checks are necessary when adding security rules based on property rules, and these can have a significant performance impact.
394
-
The following example shows how the database behaves when adding security rules to roles `restricted` and `unrestricted`:
393
+
Extra node or relationship-level security checks are necessary when adding security rules based on property rules, and these can have a significant performance impact.
394
+
395
+
The following example shows how the database behaves when adding security rules for nodes to roles `restricted` and `unrestricted`.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc
+35-20Lines changed: 35 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,9 +12,9 @@ CREATE ROLE regularUsers;
12
12
[[property-based-access-control]]
13
13
= Property-based access control
14
14
15
-
Property-based access control grants permissions to users to read node properties based on property/value conditions.
15
+
Property-based access control grants or denies permission to read or traverse nodes or relationships based on property/value conditions.
16
16
Each property-based privilege can only be restricted by a single property.
17
-
For information about read privileges and their syntax, see xref:authentication-authorization/privileges-reads.adoc[Read privileges].
17
+
For information about and syntax for these privileges, see xref:authentication-authorization/privileges-reads.adoc[Read privileges].
18
18
19
19
[IMPORTANT]
20
20
====
@@ -25,28 +25,32 @@ Users who can change this property can affect the granted property-based privile
25
25
26
26
== Syntax
27
27
28
-
To specify the property/value conditions of the read privilege, you can use the following syntax:
28
+
To specify the property/value conditions of the privilege, you can use the following syntax:
29
29
30
30
[source, syntax, role="noheader"]
31
31
----
32
32
{GRANT | DENY | REVOKE [GRANT | DENY]}
33
33
[IMMUTABLE]
34
-
{MATCH | READ | TRAVERSE}
34
+
{MATCH | READ | TRAVERSE}
35
35
ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } }
36
36
[
37
37
ELEMENT[S] { * | label-or-rel-type[, ...] }
38
38
| NODE[S] { * | label[, ...] }
39
39
| RELATIONSHIP[S] { * | rel-type[, ...] }
40
40
| FOR {
41
-
42
-
([var][:label["|" ...]] "{" property: value "}")
43
-
| (var[:label["|" ...]])
44
-
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
45
-
| (var[:label["|" ...]]
46
-
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } )
47
-
}
48
-
49
-
{TO | FROM} role[, ...]
41
+
([var][:label["|" ...]] "{" property: value "}")
42
+
| (var[:label["|" ...]])
43
+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
44
+
| (var[:label["|" ...]]
45
+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } )
46
+
| ()[<]-"["[var][:type["|" ...]] "{" property: value "}" "]"-[>]()
47
+
| ()[<]-"["var[:type["|" ...]]"]"-[>]()
48
+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } }
49
+
| ()[<]-"["var[:type["|" ...]]
50
+
WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL | IN { "["[value[, ...]]"]" | listParam } } "]"-[>]()
51
+
}
52
+
]
53
+
{TO | FROM} role[, ...]
50
54
----
51
55
52
56
@@ -57,7 +61,7 @@ See xref:authentication-authorization/limitations.adoc#property-based-access-con
57
61
58
62
When having property rules, the following factors can worsen the impact on performance:
59
63
60
-
* The number of properties on the nodes concerned (more properties = greater performance impact).
64
+
* The number of properties on the nodes and relationships concerned (more properties = greater performance impact).
61
65
* The number of property-based privileges (more property-based privileges = greater performance impact).
62
66
* The type of the privilege: `TRAVERSE` property-based privileges have greater performance impact than `READ` property-based privileges.
63
67
* The type of storage medium in operation. The impact of the property-based privileges on performance is considerably amplified by accessing disc storage.
@@ -81,7 +85,7 @@ GRANT privilege-name ON GRAPH graph-name FOR pattern TO role-name
81
85
The user role does not need to have `READ` privilege for the property used by the property-based privilege.
82
86
====
83
87
84
-
=== Grant a property-based privilege on a specific property using its value
88
+
=== Grant a property-based privilege on a specific property using the value of another property
85
89
86
90
The following example shows how to grant permission to `READ` the `address` property on `Email` or `Website` nodes with domain `exampledomain.com` to role `regularUsers`:
87
91
@@ -97,6 +101,12 @@ Alternatively, you can use the following syntax:
97
101
GRANT READ { address } ON GRAPH * FOR (:Email|Website {domain: 'exampledomain.com'}) TO regularUsers
98
102
----
99
103
104
+
The following example shows how to grant permission to `READ` the `since` property on `OWNS` relationships having `classification` equal to `UNCLASSIFIED` to role `regularUsers`:
105
+
106
+
[source, syntax, role="noheader"]
107
+
----
108
+
GRANT READ { since } ON GRAPH * FOR ()-[o:OWNS]-() WHERE o.classification = 'UNCLASSIFIED' TO regularUsers
109
+
----
100
110
101
111
=== Grant a property-based privilege using `NULL`
102
112
@@ -109,20 +119,22 @@ GRANT TRAVERSE ON GRAPH * FOR (n:Email) WHERE n.classification IS NULL TO regula
109
119
110
120
=== Deny a property-based privilege using a comparison operator
111
121
112
-
The following example shows how to deny permission to `READ` and `TRAVERSE` nodes where the property `classification` is different from `UNCLASSIFIED` to role `regularUsers`:
122
+
The following example shows how to deny permission to `READ` and `TRAVERSE` nodes and relationships where the property `classification` is different from `UNCLASSIFIED` to role `regularUsers`:
113
123
114
124
[source, syntax, role="noheader"]
115
125
----
116
126
DENY MATCH {*} ON GRAPH * FOR (n) WHERE n.classification <> 'UNCLASSIFIED' TO regularUsers
127
+
DENY MATCH {*} ON GRAPH * FOR ()-[r]-() WHERE r.classification <> 'UNCLASSIFIED' TO regularUsers
117
128
----
118
129
119
130
=== Grant a property-based privilege on all properties using a property value
120
131
121
-
The following example shows how to grant permission to `READ` all properties on nodes where the property `securityLevel` is higher than `3` to role `regularUsers`:
132
+
The following example shows how to grant permission to `READ` all properties on nodes and relationships where the property `securityLevel` is higher than `3` to role `regularUsers`:
122
133
123
134
[source, syntax, role="noheader"]
124
135
----
125
136
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.securityLevel > 3 TO regularUsers
137
+
GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.securityLevel > 3 TO regularUsers
126
138
----
127
139
128
140
[NOTE]
@@ -132,22 +144,24 @@ The role `regularUsers` does not need to have `READ` privilege for the property
132
144
133
145
=== Deny a property-based privilege using a list of values
134
146
135
-
The following example shows how to deny permission to `READ` all properties on nodes where the property `classification` is not included in the list of `[UNCLASSIFIED, PUBLIC]`:
147
+
The following example shows how to deny permission to `READ` all properties on nodes and relationships where the property `classification` is not included in the list of `[UNCLASSIFIED, PUBLIC]`:
136
148
137
149
[source, syntax, role="noheader"]
138
150
----
139
151
DENY READ {*} ON GRAPH * FOR (n) WHERE NOT n.classification IN ['UNCLASSIFIED', 'PUBLIC'] TO regularUsers
152
+
DENY READ {*} ON GRAPH * FOR ()-[r]-() WHERE NOT r.classification IN ['UNCLASSIFIED', 'PUBLIC'] TO regularUsers
140
153
----
141
154
142
155
// The last two examples were added in 5.26.
143
156
144
157
=== Grant a property-based privilege using temporal value
145
158
146
-
The following example shows how to grant permission to `READ` all properties on nodes where the property `createdAt` is later than the current date:
159
+
The following example shows how to grant permission to `READ` all properties on nodes and relationships where the property `createdAt` is later than the current date:
147
160
148
161
[source, syntax, role="noheader"]
149
162
----
150
163
GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date() TO regularUsers
164
+
GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.createdAt > date() TO regularUsers
151
165
----
152
166
153
167
[NOTE]
@@ -174,6 +188,7 @@ SHOW ROLE regularUsers PRIVILEGES AS REVOKE COMMANDS
174
188
|===
175
189
|command
176
190
|"REVOKE GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date('2024-10-25') FROM `regularUsers`"
177
-
a|Rows: 1
191
+
|"REVOKE GRANT READ {*} ON GRAPH * FOR ()-[r]-() WHERE r.createdAt > date('2024-10-25') FROM `regularUsers`"
@@ -162,6 +160,10 @@ It is recommended to use `SHOW USERS`, `SHOW ROLES`, and `SHOW ROLE $role PRIVIL
162
160
Note: this is an EXPERIMENTAL option. Consult Neo4j support before use.
163
161
|false
164
162
163
+
|--prefer-diff-as-parent
164
+
|label:new[Introduced in 2025.04] When performing a differential backup, prefer the latest non-empty differential backup as the parent instead of the latest backup.
165
+
|false
166
+
165
167
|--temp-path=<path>
166
168
|Provide a path to a temporary empty directory for storing backup files until the command is completed. The files will be deleted once the command is finished.
=== Perform a differential backup using the `--prefer-diff-as-parent` option
467
+
468
+
By default, a differential backup (`--type=DIFF`) uses the *most recent non-empty* backup -- whether full or differential -- in the directory as its parent.
469
+
470
+
The `--prefer-diff-as-parent` option changes this behavior and forces the backup job to use the *latest differential* backup as the parent, even if a newer full backup exists.
471
+
472
+
This approach allows you to maintain a chain of differential backups for all transactions and restore to any point in time.
473
+
Without this option, the transactions between the last full backup and a previous differential backup cannot be backed up as individual transactions.
474
+
475
+
To use the `--prefer-diff-as-parent` option, set it to `true`.
476
+
477
+
The following examples cover different scenarios for using the `--prefer-diff-as-parent` option.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/backup-restore/restore-backup.adoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -300,7 +300,7 @@ For more information, see xref:clustering/databases.adoc#cluster-seed[Designated
300
300
301
301
If you have backed up a database with the option `--include-metadata`, you can manually restore the users and roles metadata.
302
302
303
-
From the _<NEO4J_HOME>_ directory, you run the Cypher script _data/databases/databasename/tools/metadata_script.cypher_, which the `neo4j-admin database restore` command outputs, using xref:cypher-shell.adoc[][Cypher Shell]:
303
+
From the _<NEO4J_HOME>_ directory, you run the Cypher script _data/databases/databasename/tools/metadata_script.cypher_, which the `neo4j-admin database restore` command outputs, using xref:cypher-shell.adoc[]:
0 commit comments