Skip to content

Commit 91ad954

Browse files
committed
updating privilege svg width
adding stuff about `SET AUTH` privileges
1 parent 50d1053 commit 91ad954

File tree

1 file changed

+12
-4
lines changed

1 file changed

+12
-4
lines changed

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,9 @@ All DBMS privileges are relevant system-wide.
6868
Like user management, they do not belong to one specific database or graph.
6969
For more details on the differences between graphs, databases, and the DBMS, refer to link:{neo4j-docs-base-uri}/cypher-manual/{page-version}/introduction/cypher_neo4j/[Cypher Manual -> Cypher and Neo4j].
7070

71-
image::privileges_grant_and_deny_syntax_dbms_privileges.svg[title="Syntax of GRANT and DENY DBMS Privileges"]
71+
image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="Syntax of GRANT and DENY DBMS Privileges"]
7272

73-
image::privileges_hierarchy_dbms.svg[title="DBMS privileges hierarchy"]
73+
image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarchy"]
7474

7575
The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges.
7676
These include:
@@ -577,7 +577,7 @@ SHOW ROLE userModifier PRIVILEGES AS COMMANDS
577577
a|Rows: 1
578578
|===
579579

580-
A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED` and `SET STATUS` parts:
580+
A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts:
581581

582582
[source, cypher, role=noplay]
583583
----
@@ -615,6 +615,14 @@ A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTE
615615
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
616616
----
617617

618+
A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
619+
620+
[source, cypher, role=noplay]
621+
----
622+
ALTER USER jake REMOVE AUTH 'native SET AUTH 'oidc' { SET id 'jakesUniqueOktaUserId' }
623+
----
624+
625+
618626
The ability to modify the account status of users can be granted via the `SET USER STATUS` privilege.
619627
See an example:
620628

@@ -685,7 +693,7 @@ ALTER USER jake REMOVE HOME DATABASE
685693

686694
[NOTE]
687695
====
688-
Note that the combination of the `SET PASSWORDS`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
696+
Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
689697
====
690698

691699
The ability to delete users can be granted via the `DROP USER` privilege.

0 commit comments

Comments
 (0)