Skip to content

Add notifications for linked users #142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 17, 2024
Merged

Add notifications for linked users #142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions modules/ROOT/pages/changelogs.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@
-----
Neo.ClientNotification.Statement.RedundantOptionalProcedure
Neo.ClientNotification.Statement.RedundantOptionalSubquery
Neo.ClientNotification.Security.AuthProviderNotDefined
Neo.ClientNotification.Security.ExternalAuthNotEnabled
-----

== Neo4j 5.23
Expand Down
101 changes: 101 additions & 0 deletions modules/ROOT/pages/notifications/all-notifications.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2726,6 +2726,107 @@ Use `DATABASE *` without the parameter to revoke the privilege on all databases.
======
=====

[#_neo_clientnotification_security_authprovidernotdefined]
=== AuthProviderNotDefined

.Notification details
[cols="<1s,<4"]
|===
|Code
m|Neo.ClientNotification.Security.AuthProviderNotDefined
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This notification was covered by CIP-145.

|Title
a|The auth provider is not defined.
|Description
a|The auth provider `<provider>` is not defined in the configuration.
Verify that the spelling is correct or define `<provider>` in the configuration.
|Severity
m|INFORMATION
|Category
m|SECURITY
|===

.Create a user with an auth provider that is not defined in the configuration
====
Command::
+
[source, cypher]
----
CREATE USER foo SET AUTH 'unknownProvider' { SET ID 'idString' }
----

Description of the returned code::
The auth provider `unknownProvider` is not defined in the configuration.
Verify that the spelling is correct or define `unknownProvider` in the configuration.

Suggestions for improvement::
Make sure that the given provider is correct, or replace it if not.
If it is correct, make sure to add it as a known auth provider in one or both of `dbms.security.authentication_providers` and `dbms.security.authorization_providers`.
====

.Alter a user to add an auth provider that is not defined in the configuration
====
Command::
+
[source, cypher]
----
ALTER USER foo SET AUTH 'unknownProvider' { SET ID 'idString' }
----

Description of the returned code::
The auth provider `unknownProvider` is not defined in the configuration.
Verify that the spelling is correct or define `unknownProvider` in the configuration.

Suggestions for improvement::
Make sure that the given provider is correct, or replace it if not.
If it is correct, make sure to add it as a known auth provider in one or both of `dbms.security.authentication_providers` and `dbms.security.authorization_providers`.
====

[#_neo_clientnotification_security_externalauthnotenabled]
=== ExternalAuthNotEnabled

.Notification details
[cols="<1s,<4"]
|===
|Code
m|Neo.ClientNotification.Security.ExternalAuthNotEnabled
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This notification was an error in CIP-145 but was decided to be just a warning during implementation (to not lock out current external only users from being able to switch by first adding the new external only users to system before disabling their ways to log in)

|Title
a|External auth for user is not enabled.
|Description
a|Use setting `dbms.security.require_local_user` to enable external auth.
|Severity
m|WARNING
|Category
m|SECURITY
|===

.Create a user with an external auth provider when linked users are not enabled
====
Command::
+
[source, cypher]
----
CREATE USER foo SET AUTH 'exampleProvider' { SET ID 'idString' }
----

Suggestions for improvement::
Enable linked users through the `dbms.security.require_local_user` setting.
Until enabled, the new external auth will be ignored, and current external auth behaviors will continue to apply.
====

.Alter a user to add an external auth provider when linked users are not enabled
====
Command::
+
[source, cypher]
----
ALTER USER foo SET AUTH 'exampleProvider' { SET ID 'idString' }
----

Suggestions for improvement::
Enable linked users through the `dbms.security.require_local_user` setting.
Until enabled, the new external auth will be ignored, and current external auth behaviors will continue to apply.
====

[#_topology_notifications]
== `TOPOLOGY` category

Expand Down