This section provides an overview of authentication and authorization in Neo4j.
Authentication is the process of ensuring that a user is who the user claims to be, while authorization pertains to checking whether the authenticated user is allowed to perform a certain action. Authorization is managed using role-based access control (RBAC). Permissions that define access control are assigned to roles, which are in turn assigned to users.
Neo4j has the following auth providers, that can perform user authentication and authorization:
- Native auth provider
Neo4j provides a native auth provider that stores user and role information in the
systemdatabase. This option is controlled by the parameter
dbms.security.auth_enabled, which is set to
trueby default. The Cypher commands to manage users, roles and permissions are described in detail in Cypher Manual → Administration. Various scenarios that describe the use of the native auth provider are available in Fine-grained access control.
- LDAP auth provider
Another way of controlling authentication and authorization is through external security software such as Active Directory or OpenLDAP, which is accessed via the built-in LDAP connector. A description of the LDAP plugin using Active Directory is available in Integration with LDAP directory services.
- Custom-built plugin auth providers
For clients with specific requirements not satisfied with either native or LDAP, Neo4j provides a plugin option for building custom integrations. It is recommended that this option is used as part of a custom delivery as negotiated with Neo4j Professional Services. The plugin is described in Java Reference → Authentication and authorization plugins.
- Kerberos authentication and single sign-on
In addition to LDAP, Native and custom providers, Neo4j supports Kerberos for authentication and single sign-on. Kerberos support is provided via the Neo4j Kerberos Add-On.
Was this page helpful?