You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+5-17Lines changed: 5 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -469,7 +469,7 @@ GRANT [IMMUTABLE] SET PASSWORD[S]
469
469
GRANT [IMMUTABLE] SET AUTH
470
470
ON DBMS
471
471
TO role[, ...]
472
-
| label:new[Introduced in 5.24] Enables the specified roles to `SET` or `REMOVE` users' xref:authentication-authorization/auth-providers.adoc[auth providers].
472
+
| Enables the specified roles to `SET` or `REMOVE` users' xref:authentication-authorization/auth-providers.adoc[auth providers].
473
473
474
474
| [source, syntax, role=noheader]
475
475
GRANT [IMMUTABLE] SET USER HOME DATABASE
@@ -614,7 +614,7 @@ A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTE
614
614
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
615
615
----
616
616
617
-
label:new[Introduced in 5.24] A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
617
+
A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
618
618
619
619
[source, cypher, role=noplay]
620
620
----
@@ -1574,13 +1574,7 @@ The ability to use elevated privileges when executing a procedure can be granted
1574
1574
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <<access-control-name-globbing, name-globbing>>.
1575
1575
The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not the execution of the procedure.
1576
1576
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
1577
-
1578
-
1579
-
[NOTE]
1580
-
====
1581
-
Since Neo4j 5.0, both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
1582
-
This differs from Neo4j 4.x, when only the `EXECUTE BOOSTED PROCEDURE` is required.
1583
-
====
1577
+
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
1584
1578
1585
1579
[source, cypher, role=noplay]
1586
1580
----
@@ -1873,13 +1867,7 @@ The ability to use elevated privileges when executing a user-defined function (U
1873
1867
A user with this privilege will not be restricted to their other privileges when executing the UDFs matched by the <<access-control-name-globbing, name-globbing>>.
1874
1868
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
1875
1869
Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the functions as well.
1876
-
1877
-
1878
-
[NOTE]
1879
-
====
1880
-
Since Neo4j 5.0, both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
1881
-
This differs from Neo4j 4.x, when only the `EXECUTE BOOSTED USER DEFINED FUNCTION` is required.
1882
-
====
1870
+
Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc
+3-4Lines changed: 3 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,8 +4,7 @@
4
4
:description: This section explains how to use Cypher to manage immutable roles and privileges.
5
5
6
6
7
-
Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges].
8
-
Starting with Neo4j 5.26, Neo4j also introduces immutable roles.
7
+
Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges].
9
8
Immutable roles are useful for providing _system roles_, which appear as permanent parts of the DBMS.
10
9
11
10
@@ -38,8 +37,8 @@ The following examples demonstrate how to use Cypher to manage immutable roles a
38
37
39
38
=== Restricting the actions of users who can manage privileges
40
39
41
-
To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role.
42
-
The `PUBLIC` role implicitly and irrevocably applies to all users.
40
+
To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role.
41
+
The `PUBLIC` role implicitly and irrevocably applies to all users.
43
42
44
43
. Ensure that you have completed steps 1 and 2 from <<administer-immutable-roles-and-privileges>>.
45
44
. Run the following command to deny the `IMMUTABLE DATABASE MANAGEMENT` privilege to the `PUBLIC` role:
. Map the groups in the LDAP system to the Neo4j built-in and custom roles.
335
335
For more information, see xref:authentication-authorization/ldap-integration.adoc#auth-ldap-map-ldap-roles[Map the LDAP groups to the Neo4j roles].
336
336
337
-
[role=label--new-5.24]
338
337
[[auth-ldap-auth-providers]]
339
338
== Configure authentication/authorization at the user level using auth providers
340
339
xref:authentication-authorization/auth-providers.adoc[User auth providers] can be used to determine which users can authenticate and authorize using the configured providers, including LDAP.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/manage-privileges.adoc
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,7 +48,7 @@ The components of the graph privilege commands are:
48
48
** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled.
49
49
Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege.
50
50
Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges.
51
-
Starting from Neo4j 5.26, immutable privileges can also be used together with immutable roles.
51
+
Immutable privileges can also be used together with immutable roles.
52
52
See xref:authentication-authorization/immutable-roles-privileges.adoc[] for more information.
53
53
54
54
* _graph-privilege_:
@@ -203,7 +203,7 @@ The following image shows the hierarchy between different graph privileges:
`<key><value>` pairs for the `SET AUTH` clause could include:
298
298
[source, syntax, role="noheader"]
@@ -633,7 +633,6 @@ RETURN user AS adminUser
633
633
|===
634
634
======
635
635
636
-
[role=label--new-5.24]
637
636
[[access-control-list-user-auth-providers]]
638
637
== Listing user auth providers
639
638
@@ -753,7 +752,6 @@ You can create users using one of the following Cypher commands, depending on wh
753
752
In both cases, you can specify the user's password, whether they must change it at the next login, their status, home database, and auth provider settings.
754
753
The `SET` clauses can be applied in any order.
755
754
It is mandatory to specify a `SET PASSWORD` and/or at least one `SET AUTH` clause because users must have at least one auth provider.
756
-
`SET AUTH` is available from Neo4j 5.24 onwards.
757
755
758
756
.`CREATE USER` syntax
759
757
[source, syntax, role="noheader"]
@@ -801,7 +799,7 @@ If not set, the default is `ACTIVE`.
801
799
A home database is resolved if it is pointing to a database or a database alias.
802
800
If no home database is set, the DBMS default database is used as the home database for that user.
803
801
804
-
<6> label:new[Introduced in 5.24] One or more `SET AUTH` clause can be used to configure external xref:authentication-authorization/auth-providers.adoc[auth providers], such as LDAP or OIDC, which define authentication/authorization providers for that user.
802
+
<6> One or more `SET AUTH` clause can be used to configure external xref:authentication-authorization/auth-providers.adoc[auth providers], such as LDAP or OIDC, which define authentication/authorization providers for that user.
805
803
`SET AUTH` can also be used as an alternative way to set the native (password-based) auth settings like `SET PASSWORD` and `SET PASSWORD CHANGE REQUIRED`.
806
804
For further informations, see the examples in this section, as well as xref:authentication-authorization/sso-integration.adoc#auth-sso-auth-providers[Configure SSO at the user level using auth providers] for OIDC, and xref:authentication-authorization/ldap-integration.adoc#auth-ldap-auth-providers[Configure authentication/authorization at the user level using auth providers] for LDAP.
807
805
+
@@ -838,7 +836,6 @@ SET STATUS SUSPENDED
838
836
SET HOME DATABASE anotherDb
839
837
----
840
838
841
-
[role=label--new-5.24]
842
839
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
843
840
844
841
[source,cypher,role=noplay]
@@ -862,7 +859,6 @@ SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff
862
859
SET STATUS ACTIVE
863
860
----
864
861
865
-
[role=label--new-5.24]
866
862
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
867
863
.
868
864
[source,cypher,role=noplay]
@@ -896,7 +892,6 @@ CREATE USER jake IF NOT EXISTS
896
892
SET PLAINTEXT PASSWORD 'abcd1234'
897
893
----
898
894
899
-
[role=label--new-5.24]
900
895
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
901
896
902
897
[source,cypher,role=noplay]
@@ -919,7 +914,6 @@ SET PLAINTEXT PASSWORD 'abcd1234'
919
914
920
915
This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`.
921
916
922
-
[role=label--new-5.24]
923
917
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
924
918
925
919
[source,cypher,role=noplay]
@@ -1004,7 +998,7 @@ Where:
1004
998
<1> Specifies the command to alter a user.
1005
999
<2> Removes the home database for the user.
1006
1000
As a result, the DBMS default database will be used as the home database for that user.
1007
-
<3> label:new[Introduced in 5.24] Removes one, several, or all existing xref:authentication-authorization/auth-providers.adoc[auth provider(s)] from a user.
1001
+
<3> Removes one, several, or all existing xref:authentication-authorization/auth-providers.adoc[auth provider(s)] from a user.
1008
1002
However, a user must always have at least one auth provider.
1009
1003
Therefore, `REMOVE ALL AUTH` must be used in conjunction with at least one `SET AUTH` clause in order to meet this requirement.
1010
1004
<4> Specifies the password for the user.
@@ -1023,7 +1017,7 @@ The `SET PASSWORD` prefix of the `CHANGE [NOT] REQUIRED` clause is only optional
1023
1017
<6> Specifies the user's status.
1024
1018
<7> Specifies a home database for a user. A home database is resolved if it is pointing to a database or a database alias. If no home database is set, the DBMS default database is used as the home database for that user.
1025
1019
1026
-
<8> label:new[Introduced in 5.24] One or more `SET AUTH` clauses can be used to set xref:authentication-authorization/auth-providers.adoc[auth providers], which define authentication / authorization providers for that user.
1020
+
<8> One or more `SET AUTH` clauses can be used to set xref:authentication-authorization/auth-providers.adoc[auth providers], which define authentication / authorization providers for that user.
1027
1021
This might be used to configure external auth providers like LDAP or OIDC, but can also be used as an alternative way to set the native (password-based) auth settings like `SET PASSWORD` and `SET PASSWORD CHANGE REQUIRED`.
1028
1022
For further informations, see the examples in this section, as well as xref:authentication-authorization/sso-integration.adoc#auth-sso-auth-providers[Configure SSO at the user level using auth providers], and xref:authentication-authorization/ldap-integration.adoc#auth-ldap-auth-providers[Configure authentication/authorization at the user level using auth providers].
1029
1023
+
@@ -1050,7 +1044,6 @@ SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
1050
1044
SET STATUS ACTIVE
1051
1045
----
1052
1046
1053
-
[role=label--new-5.24]
1054
1047
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
1055
1048
1056
1049
----
@@ -1070,7 +1063,6 @@ ALTER USER bob
1070
1063
SET PASSWORD CHANGE REQUIRED
1071
1064
----
1072
1065
1073
-
[role=label--new-5.24]
1074
1066
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
| The claim to use for the database roles. Neo4j expects to find a claim in the JWT or user_info response with this name. The claim may be a string claim representing a single role or a string array claim representing multiple roles. From Neo4j 5.4, the JWT claim may also contain a single group returned as a string as well as a list of groups as was previously required.
117
+
| The claim to use for the database roles. Neo4j expects to find a claim in the JWT or user_info response with this name. The claim may be a string claim representing a single role or a string array claim representing multiple roles. The JWT claim may also contain a single group returned as a string as well as a list of groups as was previously required.
It is possible to fetch just the username, just the groups, or both from the userinfo endpoint.
273
273
274
-
[role=label--new-5.24]
274
+
275
275
[[auth-sso-auth-providers]]
276
276
=== Configure SSO at the user level using auth providers
277
277
xref:authentication-authorization/auth-providers.adoc[User auth providers] can be used to determine which users can authenticate and authorize using the configured providers.
0 commit comments