This section provides an overview of authentication and authorization in Neo4j.
Authentication is the process of ensuring that a user is who the user claims to be, while authorization pertains to checking
whether the authenticated user is allowed to perform a certain action.
Authorization is managed using role-based access control (RBAC).
Permissions that define access control are assigned to roles, which are in turn assigned to users.
Neo4j has the following auth providers, that can perform user authentication and authorization:
- Native auth provider
- Neo4j provides a native auth provider that stores user and role information in the
This option is controlled by the parameter
dbms.security.auth_enabled, which is set to
true by default.
The Cypher commands to manage users, roles and permissions are described in detail in Cypher Manual → Administration.
Various scenarios that describe the use of the native auth provider are available in Section 10.3, “Fine-grained access control”.
- LDAP auth provider
- Another way of controlling authentication and authorization is through external security software such as Active Directory
or OpenLDAP, which is accessed via the built-in LDAP connector.
A description of the LDAP plugin using Active Directory is available in Section 10.4, “Integration with LDAP”.
- Custom-built plugin auth providers
- For clients with specific requirements not satisfied with either native or LDAP, Neo4j provides a plugin option for building
It is recommended that this option is used as part of a custom delivery as negotiated with Neo4j Professional Services.
The plugin is described in Java Reference → Authentication and authorization plugins.
- Kerberos authentication and single sign-on
- In addition to LDAP, Native and custom providers, Neo4j supports Kerberos for authentication and single sign-on.
Kerberos support is provided via the Neo4j Kerberos Add-On.