Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions models/hospital/access-control-old.adoc
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
[role=enterprise-edition]
[[auth-access-control]]
= Fine-grained access control
:description: Describes an example that illustrates various aspects of security and fine-grained access control.
:description: Describes an example that illustrates various aspects of security and fine-grained access control.

When creating a database, administrators may want to establish which users have the ability to access certain information.

As described in xref:authentication-authorization/built-in-roles/auth-built-in-roles[Built-in roles], Neo4j already offers preset roles configured to specific permissions (i.e. read, edit, or write).
As described in xref:authentication-authorization/built-in-roles.adoc[Built-in roles], Neo4j already offers preset roles configured to specific permissions (i.e. read, edit, or write).
While these built-in roles cover many common daily scenarios, it is also possible to create custom roles for specific needs.

This page contains an example that illustrates various aspects of security and fine-grained access control.
Expand Down Expand Up @@ -35,7 +35,7 @@ They can be described using the properties:
* `description`

`(:Disease)`::
Known illnesses mapped in a catalog found in the database.
Known illnesses mapped in a catalog found in the database.
They can be described using the properties:
+
* `name`
Expand Down Expand Up @@ -82,10 +82,10 @@ This same database would be used by a number of different users, each with diffe

Unlike applications which often require users to be modeled within the application itself, databases provide user management resources such as roles and privileges.
This allows users to be created entirely within the database security model, a strategy that allows the separation of access to the data and the data itself.
For more information, see link:/docs/cypher-manual/{neo4j-version}/access-control/[Cypher Manual -> Access control].
For more information, see link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/[Cypher Manual -> Access control].

The following examples show two different approaches to using Neo4j security features to support the _healthcare_ database application.
The first approach uses xref:authentication-authorization/built-in-roles/auth-built-in-roles[Built-in roles], whereas the second uses more advanced resources with fine-grained privileges for <<auth-access-control-using-privileges, sub-graph access control>>.
The first approach uses xref:authentication-authorization/built-in-roles.adoc[Built-in roles], whereas the second uses more advanced resources with fine-grained privileges for <<auth-access-control-using-privileges, sub-graph access control>>.

In this example, consider five users of the _healthcare_ database:

Expand Down Expand Up @@ -128,13 +128,13 @@ Neo4j comes with built-in roles that cover a number of common needs:
* `architect` - Has all the capabilities of the publisher as well as the ability to manage indexes and constraints.
* `admin` - Can perform architect actions as well as manage databases, users, roles, and privileges.

Consider Charlie from the example of users.
Consider Charlie from the example of users.
As a researcher, they do not need write access to the database, so they are assigned the `reader` role.

On the other hand, Alice (the doctor), Daniel (the nurse), and Bob (the receptionist) all need to update the database with new patient information, but do not need to expand the schema with new labels, relationship types, property names or indexes.
On the other hand, Alice (the doctor), Daniel (the nurse), and Bob (the receptionist) all need to update the database with new patient information, but do not need to expand the schema with new labels, relationship types, property names or indexes.
For this reason, they are all assigned the `editor` role.

Tina, the IT administrator who installs and manages the database, needs to be assigned the `admin` role.
Tina, the IT administrator who installs and manages the database, needs to be assigned the `admin` role.

Here is how to grant roles to the users:

Expand Down Expand Up @@ -183,11 +183,11 @@ Has the permission to save _diagnoses_ to the database, but not expand the schem
Receptionist::
Should be able to read and write all patient data, but not be able to see the symptoms, diseases, or diagnoses.
Researcher::
Should be able to perform statistical analysis of all data, except patients’ personal information, to which they should have restricted access.
Should be able to perform statistical analysis of all data, except patients’ personal information, to which they should have restricted access.
To illustrate two different ways of setting up the same effective privileges, two roles are created for comparison.
Nurse::
Should be able to perform all tasks that both the doctor and the receptionist can do.
Granting both roles (doctor and receptionist) to the nurse does not work as expected.
Granting both roles (doctor and receptionist) to the nurse does not work as expected.
This is explained in the section dedicated to the creation of the `nurse` role.
Junior nurse::
While the senior nurse is able to save diagnoses just as a doctor can, some (junior) nurses might not be allowed to do that.
Expand Down Expand Up @@ -278,7 +278,7 @@ SHOW ROLE itadmin PRIVILEGES AS COMMANDS;

[NOTE]
====
Privileges that were granted or denied earlier can be revoked using link:/docs/cypher-manual/{neo4j-version}/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
Privileges that were granted or denied earlier can be revoked using link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
====

To provide the IT administrator `tina` these privileges, they must be assigned the new role `itadmin`:
Expand Down Expand Up @@ -500,7 +500,7 @@ If the `researcherB` role is revoked to Charlie, but `researcherW` is granted, w

[NOTE]
====
Privileges that were granted or denied earlier can be revoked using link:/docs/cypher-manual/{neo4j-version}/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
Privileges that were granted or denied earlier can be revoked using link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
====

=== Privileges of `doctor`
Expand Down Expand Up @@ -709,7 +709,7 @@ RETURN n.name, n.ssn, n.address, n.dateOfBirth;

[[detach-delete-restricted-user]]

With the `receptionist` role, Bob can delete any new patient nodes they have just created, but they are not able to delete patients that have already received diagnoses since those are connected to parts of the graph that Bob cannot see.
With the `receptionist` role, Bob can delete any new patient nodes they have just created, but they are not able to delete patients that have already received diagnoses since those are connected to parts of the graph that Bob cannot see.
Here is a demonstration of both scenarios:

[source, cypher]
Expand Down Expand Up @@ -787,7 +787,7 @@ GRANT DELETE ON GRAPH healthcare RELATIONSHIPS HAS, DIAGNOSIS TO receptionist;

[NOTE]
====
Privileges that were granted or denied earlier can be revoked using link:/docs/cypher-manual/{neo4j-version}/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
Privileges that were granted or denied earlier can be revoked using link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
====

=== Privileges of nurses
Expand Down Expand Up @@ -838,7 +838,7 @@ SHOW USER daniel PRIVILEGES AS COMMANDS;

[NOTE]
====
Privileges that were granted or denied earlier can be revoked using link:/docs/cypher-manual/{neo4j-version}/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
Privileges that were granted or denied earlier can be revoked using link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/manage-privileges/#access-control-revoke-privileges[the `REVOKE` command].
====

Now the intention is that a nurse can perform the actions of a receptionist, which means they should be able to read and write the `address` field of the `Patient` nodes.
Expand Down Expand Up @@ -1111,7 +1111,7 @@ neo4j@system> SHOW USER tina PRIVILEGES AS COMMANDS;
====
No other privilege management privileges were granted here.
How much power this role should have would depend on the requirements of the system.
Refer to the section link:/docs/cypher-manual/{neo4j-version}/access-control/built-in-roles/[Cypher Manual -> The `admin` role] for a complete list of privileges to consider.
Refer to the section link:{neo4j-docs-base-uri}/cypher-manual/current/access-control/built-in-roles/[Cypher Manual -> The `admin` role] for a complete list of privileges to consider.
====

Now Tina should be able to create new users and assign them to roles:
Expand Down
4 changes: 2 additions & 2 deletions modules/ROOT/pages/authentication-authorization/index.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ For more information, see xref:authentication-authorization/password-and-user-re
When triggered, Neo4j logs an error containing a timestamp and the message `failed to log in: too many failed attempts` in the _security.log_.
====
+
For the relevant Cypher commands, see xref:authentication-authorization/manage-users.adoc#access-control-user-syntax[Manage users syntax], xref:authentication-authorization/manage-roles.adoc#access-control-role-syntax[Manage roles syntax], and xref:authentication-authorization/manage-privileges.adoc#access-control-privileges-syntax[Manage privileges syntax].
For the relevant Cypher commands, see xref:authentication-authorization/manage-users.adoc#access-control-user-syntax[Manage users syntax], xref:authentication-authorization/manage-roles.adoc#access-control-role-syntax[Manage roles syntax], and xref:authentication-authorization/manage-privileges.adoc[Manage privileges syntax].
Various scenarios that illustrate the use of the native auth provider are available in xref:tutorial/access-control.adoc[].

*User auth providers*::
Expand All @@ -47,7 +47,7 @@ The configuration steps are described in xref:authentication-authorization/sso-i
*Custom-built plugin auth providers*::
A plugin option for building custom integrations.
It is recommended that this option is used as part of a custom delivery as negotiated with link:https://neo4j.com/professional-services/[Neo4j Professional Services].
For more information, see link:{neo4j-docs-base-uri}/java-reference/{page-version}/extending-neo4j/security-plugins#extending-neo4j-security-plugins[Java Reference -> Authentication and authorization plugins].
For more information, see link:{neo4j-docs-base-uri}/java-reference/{page-version}/extending-neo4j/security-plugins[Java Reference -> Authentication and authorization plugins].

*Kerberos authentication and single sign-on*::
In addition to LDAP, native, and custom providers, Neo4j supports Kerberos for authentication and single sign-on.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ this LDAP group will fail authentication, even if their credentials are correct.
|===

All settings are defined at server startup time in the default configuration file _xref:configuration/neo4j-conf.adoc[neo4j.conf]_ or can be modified at
runtime using xref:procedures.adoc#procedure_dbms_setconfigvalue[`dbms.setConfigValue()`].
runtime using xref:procedures.adoc#procedure_dbms_setConfigValue[`dbms.setConfigValue()`].


[[auth-ldap-configure-provider]]
Expand Down Expand Up @@ -469,7 +469,7 @@ SET AUTH 'ldap' { SET ID 'cn=alice,ou=sales,dc=example,dc=com' }
You can verify that your LDAP configuration is correct, and that the LDAP server responds, by using the LDAP command-line tool `ldapsearch`.

The `ldapsearch` command accepts the LDAP configuration setting values as input and verifies both the authentication (using the `simple` mechanism) and authorization of a user.
See the https://docs.ldap.com/ldap-sdk/docs/tool-usages/ldapsearch.html[ldapsearch official documentation^] for more advanced usage and how to use SASL authentication mechanisms.
See the link:https://docs.ldap.com/ldap-sdk/docs/tool-usages/ldapsearch.html[ldapsearch official documentation] for more advanced usage and how to use SASL authentication mechanisms.

. Verify the authentication and authorization of a user.
For example, `john`.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ The elevated privileges only apply within the procedure or user-defined function
--
The steps below assume that the procedure or user-defined function is already developed and installed.

Please refer to link:{neo4j-docs-base-uri}/java-reference/{page-version}/extending-neo4j#extending-neo4j[Java Reference -> Extending Neo4j] for a description of creating and using user-defined procedures and functions.
Please refer to link:{neo4j-docs-base-uri}/java-reference/{page-version}/extending-neo4j/[Java Reference -> Extending Neo4j] for a description of creating and using user-defined procedures and functions.
--


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -636,7 +636,7 @@ RETURN user AS adminUser
[[access-control-list-user-auth-providers]]
== Listing user auth providers

To inspect users' xref:authentication-authorization/auth-providers.adoc#access-control-list-user-auth-providers[auth providers], use `SHOW USERS WITH AUTH`.
To inspect available user auth providers, use `SHOW USERS WITH AUTH`.
The command produces a row per user per auth provider and yields the following two columns in addition to those output by `SHOW USERS`:

[options="header", width="100%", cols="1a,4,1m,^.^,^.^"]
Expand Down Expand Up @@ -745,6 +745,8 @@ WHERE provider = 'oidc1'

======

For more information about auth providers, see xref:authentication-authorization/auth-providers.adoc[User auth providers].

[[access-control-create-users]]
== Creating users

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ DENY DELETE ON GRAPH * RELATIONSHIPS bar TO regularUsers
[NOTE]
====
Users with `DELETE` privilege, but restricted `TRAVERSE` privileges, will not be able to do `DETACH DELETE` in all cases.
See href:tutorial/access-control.adoc#detach-delete-restricted-user[delete restricted user] for more info.
See xref:tutorial/access-control.adoc#detach-delete-restricted-user[delete restricted user] for more info.
====

[NOTE]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ This is essential when revoking property-based privileges containing evaluated f

[NOTE]
====
Not all temporal values are comparable, see link:{neo4j-docs-base-uri}/cypher-manual/current/syntax/operators/#cypher-ordering[Cypher Manual -> Syntax -> Operators -> Ordering and comparison of values].
Not all temporal values are comparable, see link:{neo4j-docs-base-uri}/cypher-manual/current/values-and-types/ordering-equality-comparison[Cypher Manual -> Equality, ordering, and comparison of value types].
====

You can show the privilege created by the command in the previous example as a revoke command by running:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ dbms.security.authorization_providers=oidc-newsso,oidc-oldsso,native
. Check connectivity.
Neo4j needs to connect to the identity provider to discover settings and fetch public keys to verify tokens.
Check firewall settings and security controls, and, if necessary, logs to ensure that the Neo4j server is able to connect to the identity provider using HTTPS.
If a proxy is required, this can be https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#Proxies[configured] in the Java virtual machine using the configuration setting xref:configuration/configuration-settings.adoc#config_server.jvm.additional[server.jvm.additional].
If a proxy is required, this can be link:https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#Proxies[configured] in the Java virtual machine using the configuration setting xref:configuration/configuration-settings.adoc#config_server.jvm.additional[server.jvm.additional].
Proxies that require credentials are not supported.

[[auth-sso-map-idp-roles]]
Expand Down
2 changes: 1 addition & 1 deletion modules/ROOT/pages/backup-restore/consistency-checker.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ Value can be plain numbers, like `10000000` or e.g. `20G` for 20 gigabytes, or e

|--from-path-data=<path>
|Path to the databases directory, containing the database directory to source from.
| xref:configuration/configuration-settings.adoc#config_server.directories.data, [`server.directories.data`]/databases
| xref:configuration/configuration-settings.adoc#config_server.directories.data[`server.directories.data`]/databases

|--from-path-txn=<path>
|Path to the transactions directory, containing the transaction directory for the database to source from.
Expand Down
6 changes: 3 additions & 3 deletions modules/ROOT/pages/backup-restore/online-backup.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ For more information, see xref:backup-restore/online-backup.adoc#online-backup-c

[NOTE]
====
`neo4j-admin database backup` is not supported in https://neo4j.com/cloud/aura/[Neo4j Aura].
`neo4j-admin database backup` is not supported in link:https://neo4j.com/cloud/aura/[Neo4j Aura].
====

[[backup-command-syntax]]
Expand Down Expand Up @@ -465,9 +465,9 @@ bin/neo4j-admin database backup --to-path=azb://myStorageAccount/myContainer/myD
[[diff-backup-as-parent]]
=== Perform a differential backup using the `--prefer-diff-as-parent` option

By default, a differential backup (`--type=DIFF`) uses the *most recent non-empty* backup -- whether full or differential -- in the directory as its parent.
By default, a differential backup (`--type=DIFF`) uses the *most recent non-empty* backup -- whether full or differential -- in the directory as its parent.

The `--prefer-diff-as-parent` option changes this behavior and forces the backup job to use the *latest differential* backup as the parent, even if a newer full backup exists.
The `--prefer-diff-as-parent` option changes this behavior and forces the backup job to use the *latest differential* backup as the parent, even if a newer full backup exists.

This approach allows you to maintain a chain of differential backups for all transactions and restore to any point in time.
Without this option, the transactions between the last full backup and a previous differential backup cannot be backed up as individual transactions.
Expand Down
4 changes: 2 additions & 2 deletions modules/ROOT/pages/backup-restore/restore-backup.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@

A database backup artifact (full or differential) can be restored within the same or to a later Neo4j version using the `restore` command of `neo4j-admin`.

You can also load a **full** database backup artifact using the xref:backup-restore/restore-dump.adoc#restore-dump-command[`neo4j-admin database load`] command.
You can also load a **full** database backup artifact using the xref:backup-restore/restore-dump.adoc[`neo4j-admin database load`] command.
This functionality is available in the Community Edition.

[NOTE]
Expand All @@ -23,7 +23,7 @@ For more information, see xref:database-administration/standard-databases/create
[NOTE]
====
If you are using CDC, make sure you create the new database with the same `txLogEnrichment` value and handle the potential loss or corruption of CDC data in your CDC application.
For more information, see the link:{neo4j-docs-base-uri}/cdc/{page-version}[Change Data Capture (CDC)] documentation.
For more information, see the link:https://neo4j.com/docs/cdc/current/[Change Data Capture (CDC)] documentation.
====

[NOTE]
Expand Down
Loading
Loading