Skip to content

Commit 3395104

Browse files
Remove all introduced in 5.x mentions from the dev branch (#2022)
Co-authored-by: NataliaIvakina <[email protected]>
1 parent 1b83460 commit 3395104

File tree

82 files changed

+381
-517
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+381
-517
lines changed

modules/ROOT/pages/authentication-authorization/auth-providers.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
:description: This section explains how to use Cypher to manage authentication and authorization at the user level using Cypher.
2-
:page-role: enterprise-edition new-5.24
2+
:page-role: enterprise-edition
33

44
[[access-control-auth-providers]]
55
= User auth providers

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -469,7 +469,7 @@ GRANT [IMMUTABLE] SET PASSWORD[S]
469469
GRANT [IMMUTABLE] SET AUTH
470470
ON DBMS
471471
TO role[, ...]
472-
| label:new[Introduced in 5.24] Enables the specified roles to `SET` or `REMOVE` users' xref:authentication-authorization/auth-providers.adoc[auth providers].
472+
| Enables the specified roles to `SET` or `REMOVE` users' xref:authentication-authorization/auth-providers.adoc[auth providers].
473473

474474
| [source, syntax, role=noheader]
475475
GRANT [IMMUTABLE] SET USER HOME DATABASE
@@ -614,7 +614,7 @@ A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTE
614614
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
615615
----
616616

617-
label:new[Introduced in 5.24] A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
617+
A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
618618

619619
[source, cypher, role=noplay]
620620
----
@@ -1574,13 +1574,7 @@ The ability to use elevated privileges when executing a procedure can be granted
15741574
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <<access-control-name-globbing, name-globbing>>.
15751575
The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not the execution of the procedure.
15761576
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
1577-
1578-
1579-
[NOTE]
1580-
====
1581-
Since Neo4j 5.0, both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
1582-
This differs from Neo4j 4.x, when only the `EXECUTE BOOSTED PROCEDURE` is required.
1583-
====
1577+
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
15841578

15851579
[source, cypher, role=noplay]
15861580
----
@@ -1873,13 +1867,7 @@ The ability to use elevated privileges when executing a user-defined function (U
18731867
A user with this privilege will not be restricted to their other privileges when executing the UDFs matched by the <<access-control-name-globbing, name-globbing>>.
18741868
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
18751869
Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the functions as well.
1876-
1877-
1878-
[NOTE]
1879-
====
1880-
Since Neo4j 5.0, both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
1881-
This differs from Neo4j 4.x, when only the `EXECUTE BOOSTED USER DEFINED FUNCTION` is required.
1882-
====
1870+
Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
18831871

18841872
[IMPORTANT]
18851873
====
@@ -1926,7 +1914,7 @@ a|Rows: 2
19261914
======
19271915

19281916

1929-
[role=label--new-5.6]
1917+
19301918
[[access-control-dbms-administration-setting]]
19311919
== The DBMS `SETTING` privileges
19321920

modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@
44
:description: This section explains how to use Cypher to manage immutable roles and privileges.
55

66

7-
Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges].
8-
Starting with Neo4j 5.26, Neo4j also introduces immutable roles.
7+
Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges].
98
Immutable roles are useful for providing _system roles_, which appear as permanent parts of the DBMS.
109

1110

@@ -38,8 +37,8 @@ The following examples demonstrate how to use Cypher to manage immutable roles a
3837

3938
=== Restricting the actions of users who can manage privileges
4039

41-
To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role.
42-
The `PUBLIC` role implicitly and irrevocably applies to all users.
40+
To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role.
41+
The `PUBLIC` role implicitly and irrevocably applies to all users.
4342

4443
. Ensure that you have completed steps 1 and 2 from <<administer-immutable-roles-and-privileges>>.
4544
. Run the following command to deny the `IMMUTABLE DATABASE MANAGEMENT` privilege to the `PUBLIC` role:

modules/ROOT/pages/authentication-authorization/ldap-integration.adoc

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,6 @@ dbms.security.ldap.authorization.access_permitted_group=501
334334
. Map the groups in the LDAP system to the Neo4j built-in and custom roles.
335335
For more information, see xref:authentication-authorization/ldap-integration.adoc#auth-ldap-map-ldap-roles[Map the LDAP groups to the Neo4j roles].
336336

337-
[role=label--new-5.24]
338337
[[auth-ldap-auth-providers]]
339338
== Configure authentication/authorization at the user level using auth providers
340339
xref:authentication-authorization/auth-providers.adoc[User auth providers] can be used to determine which users can authenticate and authorize using the configured providers, including LDAP.

modules/ROOT/pages/authentication-authorization/load-privileges.adoc

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ CREATE ROLE roleLoadCidr
1111
[[access-control-load-privileges]]
1212
= Load privileges
1313

14-
_This feature is available from Neo4j 5.13._
15-
1614
This section explains how to use Cypher to manage load privileges.
1715
All load privileges apply to the whole system.
1816
Like DBMS privileges, they do not belong to one specific database or graph.
@@ -46,8 +44,7 @@ GRANT [IMMUTABLE] LOAD
4644
GRANT [IMMUTABLE] LOAD
4745
ON CIDR cidr
4846
TO role[, ...]
49-
| Enables the specified roles to load external data from the given CIDR range in queries.label:new[Introduced in 5.16]
50-
47+
| Enables the specified roles to load external data from the given CIDR range in queries.
5148
|===
5249

5350
[NOTE]
@@ -103,8 +100,6 @@ The `LOAD ON ALL DATA` privilege is granted to the `PUBLIC` role by default.
103100
[[access-control-load-cidr]]
104101
== The `CIDR` privilege
105102

106-
_This feature is available from Neo4j 5.16._
107-
108103
The load privilege on `CIDR cidr` enables or disables loading data from the given IPv4 or IPv6 CIDR range.
109104
If granted, the user can load data from sources in the given CIDR range.
110105
If missing or denied, no data can be loaded from sources in the given CIDR range.

modules/ROOT/pages/authentication-authorization/manage-privileges.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ The components of the graph privilege commands are:
4848
** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled.
4949
Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege.
5050
Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges.
51-
Starting from Neo4j 5.26, immutable privileges can also be used together with immutable roles.
51+
Immutable privileges can also be used together with immutable roles.
5252
See xref:authentication-authorization/immutable-roles-privileges.adoc[] for more information.
5353

5454
* _graph-privilege_:
@@ -203,7 +203,7 @@ The following image shows the hierarchy between different graph privileges:
203203
image::privileges_hierarchy.svg[title="Graph privileges hierarchy"]
204204

205205

206-
[role=label--new-5.9]
206+
207207
[[access-control-list-supported-privileges]]
208208
== Listing supported privileges
209209

modules/ROOT/pages/authentication-authorization/manage-roles.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@ For more information, see xref:authentication-authorization/dbms-administration.
340340

341341

342342
You can view all available roles using the Cypher command `SHOW ROLES`, which returns a single column by default.
343-
Starting from 5.26, you can optionally use `SHOW ROLES YIELD *` to see if the role is immutable.
343+
Optionally, you can also use `SHOW ROLES YIELD *` to see if the role is immutable.
344344
See <<access-control-immutable-roles, Immutable roles>> for more information.
345345

346346
.`SHOW ROLES` output
@@ -582,7 +582,6 @@ This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE R
582582
The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`.
583583
====
584584

585-
[role=new-in-5.26]
586585
[[access-control-immutable-roles]]
587586
== Immutable roles
588587

modules/ROOT/pages/authentication-authorization/manage-users.adoc

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ CREATE USER name [IF NOT EXISTS]
152152
[[SET PASSWORD] CHANGE [NOT] REQUIRED]
153153
[SET STATUS {ACTIVE \| SUSPENDED}]
154154
[SET HOME DATABASE name]
155-
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]... # Introduced in Neo4j 5.24
155+
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]...
156156
----
157157

158158
`<key><value>` pairs for the `SET AUTH` clause could include:
@@ -203,7 +203,7 @@ CREATE OR REPLACE USER name
203203
[[SET PASSWORD] CHANGE [NOT] REQUIRED]
204204
[SET STATUS {ACTIVE \| SUSPENDED}]
205205
[SET HOME DATABASE name]
206-
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]... # Introduced in Neo4j 5.24
206+
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]...
207207
----
208208
`<key><value>` pairs for the `SET AUTH` clause could include:
209209
[source, syntax, role="noheader"]
@@ -292,7 +292,7 @@ ALTER USER name [IF EXISTS]
292292
[[SET PASSWORD] CHANGE [NOT] REQUIRED]
293293
[SET STATUS {ACTIVE \| SUSPENDED} ]
294294
[SET HOME DATABASE name]
295-
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]... # Introduced in Neo4j 5.24
295+
[SET AUTH [PROVIDER] 'provider' "{"{SET <key> <value>}..."}"]...
296296
----
297297
`<key><value>` pairs for the `SET AUTH` clause could include:
298298
[source, syntax, role="noheader"]
@@ -633,7 +633,6 @@ RETURN user AS adminUser
633633
|===
634634
======
635635

636-
[role=label--new-5.24]
637636
[[access-control-list-user-auth-providers]]
638637
== Listing user auth providers
639638

@@ -753,7 +752,6 @@ You can create users using one of the following Cypher commands, depending on wh
753752
In both cases, you can specify the user's password, whether they must change it at the next login, their status, home database, and auth provider settings.
754753
The `SET` clauses can be applied in any order.
755754
It is mandatory to specify a `SET PASSWORD` and/or at least one `SET AUTH` clause because users must have at least one auth provider.
756-
`SET AUTH` is available from Neo4j 5.24 onwards.
757755

758756
.`CREATE USER` syntax
759757
[source, syntax, role="noheader"]
@@ -801,7 +799,7 @@ If not set, the default is `ACTIVE`.
801799
A home database is resolved if it is pointing to a database or a database alias.
802800
If no home database is set, the DBMS default database is used as the home database for that user.
803801

804-
<6> label:new[Introduced in 5.24] One or more `SET AUTH` clause can be used to configure external xref:authentication-authorization/auth-providers.adoc[auth providers], such as LDAP or OIDC, which define authentication/authorization providers for that user.
802+
<6> One or more `SET AUTH` clause can be used to configure external xref:authentication-authorization/auth-providers.adoc[auth providers], such as LDAP or OIDC, which define authentication/authorization providers for that user.
805803
`SET AUTH` can also be used as an alternative way to set the native (password-based) auth settings like `SET PASSWORD` and `SET PASSWORD CHANGE REQUIRED`.
806804
For further informations, see the examples in this section, as well as xref:authentication-authorization/sso-integration.adoc#auth-sso-auth-providers[Configure SSO at the user level using auth providers] for OIDC, and xref:authentication-authorization/ldap-integration.adoc#auth-ldap-auth-providers[Configure authentication/authorization at the user level using auth providers] for LDAP.
807805
+
@@ -838,7 +836,6 @@ SET STATUS SUSPENDED
838836
SET HOME DATABASE anotherDb
839837
----
840838
841-
[role=label--new-5.24]
842839
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
843840
844841
[source,cypher,role=noplay]
@@ -862,7 +859,6 @@ SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff
862859
SET STATUS ACTIVE
863860
----
864861
865-
[role=label--new-5.24]
866862
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
867863
.
868864
[source,cypher,role=noplay]
@@ -896,7 +892,6 @@ CREATE USER jake IF NOT EXISTS
896892
SET PLAINTEXT PASSWORD 'abcd1234'
897893
----
898894
899-
[role=label--new-5.24]
900895
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
901896
902897
[source,cypher,role=noplay]
@@ -919,7 +914,6 @@ SET PLAINTEXT PASSWORD 'abcd1234'
919914
920915
This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`.
921916
922-
[role=label--new-5.24]
923917
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
924918
925919
[source,cypher,role=noplay]
@@ -1004,7 +998,7 @@ Where:
1004998
<1> Specifies the command to alter a user.
1005999
<2> Removes the home database for the user.
10061000
As a result, the DBMS default database will be used as the home database for that user.
1007-
<3> label:new[Introduced in 5.24] Removes one, several, or all existing xref:authentication-authorization/auth-providers.adoc[auth provider(s)] from a user.
1001+
<3> Removes one, several, or all existing xref:authentication-authorization/auth-providers.adoc[auth provider(s)] from a user.
10081002
However, a user must always have at least one auth provider.
10091003
Therefore, `REMOVE ALL AUTH` must be used in conjunction with at least one `SET AUTH` clause in order to meet this requirement.
10101004
<4> Specifies the password for the user.
@@ -1023,7 +1017,7 @@ The `SET PASSWORD` prefix of the `CHANGE [NOT] REQUIRED` clause is only optional
10231017
<6> Specifies the user's status.
10241018
<7> Specifies a home database for a user. A home database is resolved if it is pointing to a database or a database alias. If no home database is set, the DBMS default database is used as the home database for that user.
10251019

1026-
<8> label:new[Introduced in 5.24] One or more `SET AUTH` clauses can be used to set xref:authentication-authorization/auth-providers.adoc[auth providers], which define authentication / authorization providers for that user.
1020+
<8> One or more `SET AUTH` clauses can be used to set xref:authentication-authorization/auth-providers.adoc[auth providers], which define authentication / authorization providers for that user.
10271021
This might be used to configure external auth providers like LDAP or OIDC, but can also be used as an alternative way to set the native (password-based) auth settings like `SET PASSWORD` and `SET PASSWORD CHANGE REQUIRED`.
10281022
For further informations, see the examples in this section, as well as xref:authentication-authorization/sso-integration.adoc#auth-sso-auth-providers[Configure SSO at the user level using auth providers], and xref:authentication-authorization/ldap-integration.adoc#auth-ldap-auth-providers[Configure authentication/authorization at the user level using auth providers].
10291023
+
@@ -1050,7 +1044,6 @@ SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
10501044
SET STATUS ACTIVE
10511045
----
10521046
1053-
[role=label--new-5.24]
10541047
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
10551048
10561049
----
@@ -1070,7 +1063,6 @@ ALTER USER bob
10701063
SET PASSWORD CHANGE REQUIRED
10711064
----
10721065
1073-
[role=label--new-5.24]
10741066
The equivalent command using the xref:authentication-authorization/auth-providers.adoc[auth providers] syntax would be:
10751067
10761068
----
@@ -1079,7 +1071,7 @@ SET AUTH 'native' {SET PASSWORD CHANGE REQUIRED}
10791071
----
10801072
======
10811073

1082-
[role=label--enterprise-edition label--new-5.24]
1074+
[role=label--enterprise-edition]
10831075
.Modify a user to use an external OIDC auth provider
10841076
======
10851077
For example, you can modify the user `bob` by removing his native auth provider and adding an external OIDC auth provider:
@@ -1092,7 +1084,7 @@ SET AUTH 'oidc-mysso1' {SET ID 'bobsUniqueMySso1Id'}
10921084
----
10931085
======
10941086

1095-
[role=label--enterprise-edition label--new-5.24]
1087+
[role=label--enterprise-edition]
10961088
.Modify a user to use multiple external OIDC auth providers
10971089
======
10981090
For example, you can modify the user `bob` by removing all of his existing auth providers and adding two external OIDC auth providers:

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ CREATE ROLE regularUsers;
77
----
88
////
99

10-
:page-role: enterprise-edition aura-db-business-critical aura-db-dedicated new-5.24
10+
:page-role: enterprise-edition aura-db-business-critical aura-db-dedicated
1111
[[property-based-access-control]]
1212
= Property-based access control
1313

@@ -106,7 +106,7 @@ GRANT READ {*} ON GRAPH * FOR (n) WHERE n.createdAt > date() TO regularUsers
106106
----
107107
[NOTE]
108108
====
109-
The `date()` function is evaluated, and the value used to evaluate the privilege is the date when the property-based privilege is created.
109+
The `date()` function is evaluated, and the value used to evaluate the privilege is the date when the property-based privilege is created.
110110
Keep this in mind when designing your property rules, and use the `SHOW PRIVILEGES AS COMMANDS` command to check the stored value.
111111
This is essential when revoking property-based privileges containing evaluated function values like `date()`.
112112
====

modules/ROOT/pages/authentication-authorization/sso-integration.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ The default is `false`, to read the claim from the token.
114114
| xref:configuration/configuration-settings.adoc#config_dbms.security.oidc.-provider-.claims.groups[dbms.security.oidc.<provider>.claims.groups]
115115
|
116116
| true
117-
| The claim to use for the database roles. Neo4j expects to find a claim in the JWT or user_info response with this name. The claim may be a string claim representing a single role or a string array claim representing multiple roles. From Neo4j 5.4, the JWT claim may also contain a single group returned as a string as well as a list of groups as was previously required.
117+
| The claim to use for the database roles. Neo4j expects to find a claim in the JWT or user_info response with this name. The claim may be a string claim representing a single role or a string array claim representing multiple roles. The JWT claim may also contain a single group returned as a string as well as a list of groups as was previously required.
118118

119119
| xref:configuration/configuration-settings.adoc#config_dbms.security.oidc.-provider-.authorization.group_to_role_mapping[dbms.security.oidc.<provider>.authorization.group_to_role_mapping]
120120
|
@@ -271,7 +271,7 @@ dbms.security.oidc.mysso.get_groups_from_user_info=true
271271
+
272272
It is possible to fetch just the username, just the groups, or both from the userinfo endpoint.
273273

274-
[role=label--new-5.24]
274+
275275
[[auth-sso-auth-providers]]
276276
=== Configure SSO at the user level using auth providers
277277
xref:authentication-authorization/auth-providers.adoc[User auth providers] can be used to determine which users can authenticate and authorize using the configured providers.

0 commit comments

Comments
 (0)