Security of administration

The ACCESS privilege enables users to connect to a database. With ACCESS you can run calculations, for example, RETURN 2*5 AS answer or call functions RETURN timestamp() AS time.

For example, granting the ability to access the database neo4j to the role regularUsers is done using the following query.

The ACCESS privilege can also be denied.

For example, denying the ability to access to the database neo4j to the role regularUsers is done using the following query.

The privileges granted can be seen using the SHOW PRIVILEGES command:

The START privilege can be used to enable the ability to start a database.

For example, granting the ability to start the database neo4j to the role regularUsers is done using the following query.

The START privilege can also be denied.

For example, denying the ability to start to the database neo4j to the role regularUsers is done using the following query.

The STOP privilege can be used to enable the ability to stop a database.

For example, granting the ability to stop the database neo4j to the role regularUsers is done using the following query.

The STOP privilege can also be denied.

For example, denying the ability to stop to the database neo4j to the role regularUsers is done using the following query.

The privileges granted can be seen using the SHOW PRIVILEGES command:

Indexes can be created, deleted, or listed with the CREATE INDEX, DROP INDEX, and SHOW INDEXES commands. The privilege to do this can be granted with GRANT CREATE INDEX, GRANT DROP INDEX, and GRANT SHOW INDEX commands. The privilege to do all three can be granted with GRANT INDEX MANAGEMENT command.

For example, granting the ability to create indexes on the database neo4j to the role regularUsers is done using the following query.

The SHOW INDEXES privilege only affects the SHOW INDEXES command and not the old procedures for listing indexes, such as db.indexes.

Constraints can be created, deleted, or listed with the CREATE CONSTRAINT, DROP CONSTRAINT and SHOW CONSTRAINTS commands. The privilege to do this can be granted with GRANT CREATE CONSTRAINT, GRANT DROP CONSTRAINT, GRANT SHOW CONSTRAINT commands. The privilege to do all three can be granted with GRANT CONSTRAINT MANAGEMENT command.

For example, granting the ability to create constraints on the database neo4j to the role regularUsers is done using the following query.

The SHOW CONSTRAINTS privilege only affects the SHOW CONSTRAINTS command and not the old procedures for listing constraints, such as db.constraints.

The right to create new labels, relationship types, and property names is different from the right to create nodes, relationships, and properties. The latter is managed using database WRITE privileges, while the former is managed using specific GRANT/DENY CREATE NEW …​ commands for each type.

For example, granting the ability to create new properties on nodes or relationships in the database neo4j to the role regularUsers is done using the following query.

The right to access a database, create and drop indexes and constraints and create new labels, relationship types or property names can be achieved with a single command:

For example, granting the abilities above on the database neo4j to the role databaseAdminUsers is done using the following query.

The privileges granted can be seen using the SHOW PRIVILEGES command:

The right to run the procedures dbms.listTransactions, dbms.listQueries, dbms.killQuery, dbms.killQueries, dbms.killTransaction and dbms.killTransactions are managed through the SHOW TRANSACTION and TERMINATE TRANSACTION privileges.

For example, granting the ability to list transactions for user jake in the database neo4j to the role regularUsers is done using the following query.

If it is desired to have an administrator with a subset of privileges that includes all DBMS privileges, but not all database privileges, this can be achieved in multiple ways. One way is to copy the admin role and revoking or denying the unwanted privileges. A second option is to build a custom administrator from scratch by granting the wanted privileges instead.

As an example, let’s create an administrator that can only manage users and roles by using the latter option.

First we create the new role:

Then we grant the privilege to manage users:

And to manage roles:

The resulting role has privileges that only allow user and role management:

Lists all privileges for role 'usermanager'

However, this role doesn’t allow all DBMS capabilities. For example, the role is missing privilege management, creating and dropping databases as well as executing admin procedures. We can make a more powerful administrator by granting a different set of privileges. Let’s create an administrator that can perform almost all DBMS capabilities, excluding database management, but also with some limited database capabilities, such as managing transactions.

Again, we start by creating a new role:

Then we grant the privilege for all DBMS capabilities:

And explicitly deny the privilege to manage databases:

Thereafter we grant the transaction management privilege:

The resulting role has privileges that allow all DBMS privileges except creating and dropping databases, as well as managing transactions:

Lists all privileges for role 'customAdministrator'

The dbms privileges for role management are assignable using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to add roles can be granted via the CREATE ROLE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow adding roles:

Lists all privileges for role 'roleAdder'

The ability to delete roles can be granted via the DROP ROLE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow deleting roles:

Lists all privileges for role 'roleDropper'

The ability to assign roles to users can be granted via the ASSIGN ROLE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow assigning/granting roles:

Lists all privileges for role 'roleAssigner'

The ability to remove roles from users can be granted via the REMOVE ROLE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow removing/revoking roles:

Lists all privileges for role 'roleRemover'

The ability to show roles can be granted via the SHOW ROLE privilege. A user with this privilege is allowed to execute the SHOW ROLES and SHOW POPULATED ROLES administration commands. For the SHOW ROLES WITH USERS and SHOW POPULATED ROLES WITH USERS administration commands, both this privilege and the SHOW USER privilege are required. The following query shows an example of how to grant the SHOW ROLE privilege:

The resulting role should have privileges that only allow showing roles:

Lists all privileges for role 'roleShower'

The privileges to create, delete, assign, remove, and list roles can be granted via the ROLE MANAGEMENT privilege. The following query shows an example of this:

The resulting role should have all privileges to manage roles:

Lists all privileges for role 'roleManager'

The dbms privileges for user management are assignable using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to add users can be granted via the CREATE USER privilege. The following query shows an example of this:

The resulting role should have privileges that only allow adding users:

Lists all privileges for role 'userAdder'

The ability to delete users can be granted via the DROP USER privilege. The following query shows an example of this:

The resulting role should have privileges that only allow deleting users:

Lists all privileges for role 'userDropper'

The ability to modify users can be granted via the ALTER USER privilege. The following query shows an example of this:

The resulting role should have privileges that only allow modifying users:

Lists all privileges for role 'userModifier'

A user that is granted ALTER USER is allowed to run the ALTER USER administration command with one or several of the SET PASSWORD, SET PASSWORD CHANGE [NOT] REQUIRED and SET STATUS parts:

The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the SET PASSWORDS privilege. The following query shows an example of this:

The resulting role should have privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login:

Lists all privileges for role 'passwordModifier'

A user that is granted SET PASSWORDS is allowed to run the ALTER USER administration command with one or both of the SET PASSWORD and SET PASSWORD CHANGE [NOT] REQUIRED parts:

The ability to modify the account status of users can be granted via the SET USER STATUS privilege. The following query shows an example of this:

The resulting role should have privileges that only allow modifying the account status of users:

Lists all privileges for role 'statusModifier'

A user that is granted SET USER STATUS is allowed to run the ALTER USER administration command with only the SET STATUS part:

The ability to show users can be granted via the SHOW USER privilege. The following query shows an example of this:

The resulting role should have privileges that only allow showing users:

Lists all privileges for role 'userShower'

The privileges to create, delete, modify, and list users can be granted via the USER MANAGEMENT privilege. The following query shows an example of this:

The resulting role should have all privileges to manage users:

Lists all privileges for role 'userManager'

The dbms privileges for database management are assignable using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to create databases can be granted via the CREATE DATABASE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow creating databases:

Lists all privileges for role 'databaseAdder'

The ability to delete databases can be granted via the DROP DATABASE privilege. The following query shows an example of this:

The resulting role should have privileges that only allow deleting databases:

Lists all privileges for role 'databaseDropper'

The privileges to create and delete databases can be granted via the DATABASE MANAGEMENT privilege. The following query shows an example of this:

The resulting role should have all privileges to manage databases:

Lists all privileges for role 'databaseManager'

The dbms privileges for privilege management are assignable using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to list privileges can be granted via the SHOW PRIVILEGE privilege. A user with this privilege is allowed to execute the SHOW PRIVILEGES and SHOW ROLE roleName PRIVILEGES administration commands. For the SHOW USER username PRIVILEGES administration command, both this privilege and the SHOW USER privilege are required. The following query shows an example of how to grant the SHOW PRIVILEGE privilege:

The resulting role should have privileges that only allow showing privileges:

Lists all privileges for role 'privilegeShower'

The ability to assign privileges to roles can be granted via the ASSIGN PRIVILEGE privilege. A user with this privilege is allowed to execute GRANT and DENY administration commands. The following query shows an example of how to grant this privilege:

The resulting role should have privileges that only allow assigning privileges:

Lists all privileges for role 'privilegeAssigner'

The ability to remove privileges from roles can be granted via the REMOVE PRIVILEGE privilege. A user with this privilege is allowed to execute REVOKE administration commands. The following query shows an example of how to grant this privilege:

The resulting role should have privileges that only allow removing privileges:

Lists all privileges for role 'privilegeRemover'

The privileges to list, assign, and remove privileges can be granted via the PRIVILEGE MANAGEMENT privilege. The following query shows an example of this:

The resulting role should have all privileges to manage privileges:

Lists all privileges for role 'privilegeManager'

The dbms privileges for procedure and user defined function execution are assignable using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The EXECUTE BOOSTED privileges replace the dbms.security.procedures.default_allowed and dbms.security.procedures.roles configuration parameters for procedures and user defined functions. The configuration parameters are still honoured as a set of temporary privileges. These cannot be revoked, but will be updated on each restart with the current configuration values.

The right to perform the following privileges can be achieved with a single command:

For example, granting the abilities above to the role dbmsManager is done using the following query.

The privileges granted can be seen using the SHOW PRIVILEGES command: