LDAP integration
Enterprise Edition

Neo4j supports LDAP, which allows for integration with Active Directory (AD), OpenLDAP, or other LDAP-compatible authentication services. This means that you use the LDAP service for managing federated users, while the native Neo4j user and role administration are completely turned off.

The following configuration settings are important to consider when configuring LDAP. For a more detailed overview of the LDAP configuration options, see Configuration settings.

LDAP dynamic configuration settings

The following configuration settings can be updated while the database is running, see Update dynamic settings. Altering any of these settings clears the authentication and authorization cache.

Parameter name Default value Description

dbms.security.ldap.authentication.user_dn_template

uid={0},ou=users,dc=example,dc=com

Convert usernames into LDAP-specific fully qualified names required for logging in.

dbms.security.ldap.authorization.user_search_base

ou=users,dc=example,dc=com

Set the base object or named context to search for user objects.

dbms.security.ldap.authorization.user_search_filter

(&(objectClass=*)(uid={0}))

Set an LDAP search filter for a user principal.

dbms.security.ldap.authorization.group_membership_attributes

memberOf

List attribute names of a user object that contains groups to be used for mapping to roles. Common values: memberOf and gidNumber.

dbms.security.ldap.authorization.nested_groups_enabled

false

This setting determines whether multiple LDAP search results will be processed. This must be set to true in order to resolve nested group membership.

dbms.security.ldap.authorization.group_to_role_mapping

List an authorization mapping from groups to the pre-defined built-in roles admin, architect, publisher, editor, and reader, or to any other custom-defined roles.

dbms.security.ldap.authentication.attribute

samaccountname

Set the attribute to search for users with a system account.

dbms.security.ldap.authorization.access_permitted_group

Set an LDAP group of users with access rights. Users passing authentication are mapped to at least the PUBLIC role in addition to any roles assigned by the group to role mapping and have access to the database that those roles provide. If this attribute is set, users not part of this LDAP group will fail authentication, even if their credentials are correct.

dbms.security.logs.ldap.groups_at_debug_level_enabled

false

When set to true, it logs the result from the group lookup into the security log (provided the security log level is also set to DEBUG).

All settings are defined at server startup time in the default configuration file neo4j.conf or can be modified at runtime using dbms.setConfigValue().

Set Neo4j to use LDAP

First, you configure Neo4j to use LDAP as an authentication and authorization provider.

  1. Uncomment the setting dbms.security.auth_enabled=false and change its value to true to turn on the security feature.

  2. Uncomment the settings dbms.security.authentication_providers and dbms.security.authorization_providers and change their value to ldap. This way, the LDAP connector is used as a security provider for both authentication and authorization.

    If you want, you can still use the native provider for mixed-mode authentication and authorization. The values are comma-separated and queried in the declared order.

    Example 1. Configure Neo4j to use LDAP and the native authentication and authorization provider
    dbms.security.authentication_providers=ldap,native
dbms.security.authorization_providers=ldap,native

Map the LDAP groups to the Neo4j roles

To assign privileges to users based on their LDAP groups, you have to map the LDAP groups to the Neo4j built-in and custom-defined roles. To do that, you need to know what privileges the Neo4j roles have, and based on these privileges, to create the mapping to the groups defined in the LDAP server. The map must be formatted as a semicolon separated list of key-value pairs, where the key is a LDAP group name and the value is a comma-separated list of the corresponding role names.

For example, group1=role1;group2=role2;group3=role3,role4,role5;group4=role6;group5=role6.

Example 2. Example of LDAP groups to Neo4j roles mapping
dbms.security.ldap.authorization.group_to_role_mapping=\
    "cn=Neo4j Read Only,cn=users,dc=example,dc=com"      = reader;    \ (1)
    "cn=Neo4j Read-Write,cn=users,dc=example,dc=com"     = editor,publisher; \ (2)
    "cn=Neo4j Read-Write,cn=users,dc=example,dc=com","cn=Neo4j Create Data,cn=users,dc=example,dc=com"     = publisher; \ (3)
    "cn=Neo4j Create Data,cn=users,dc=example,dc=com","cn=Neo4j Schema Manager,cn=users,dc=example,dc=com" = architect; \
    "cn=Neo4j Administrator,cn=users,dc=example,dc=com"  = admin; \
    "cn=Neo4j Procedures,cn=users,dc=neo4j,dc=com"       = rolename (4)
1 Mapping of an LDAP group to a Neo4j built-in role.
2 Mapping of an LDAP group to two Neo4j built-in roles.
3 Mapping of two LDAP groups to a Neo4j built-in role.
4 Mapping of an LDAP group to a custom-defined role. Custom-defined roles, such as rolename, must be explicitly created using the CREATE ROLE rolename command before they can be used to grant privileges. See Manage roles.

Configure Neo4j to use Active Directory

You configure Neo4j to use the LDAP security provider to access and manage your Active Directory. There are three alternative ways to do that depending on your specific use case.

Configure Neo4j to support LDAP user ID authentication

This option allows users to log in with their LDAP user ID.

In the neo4j.conf file, uncomment and configure the following settings:

  1. Configure LDAP to point to the AD server:

    dbms.security.ldap.host=ldap://myactivedirectory.example.com

  2. Provide details on the user structure of the LDAP directory:

    dbms.security.ldap.authentication.user_dn_template=cn={0},cn=Users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_base=cn=Users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_filter=(&(objectClass=*)(cn={0}))
dbms.security.ldap.authorization.group_membership_attributes=memberOf

  3. Map the groups in the LDAP system to the Neo4j built-in and custom roles. See Map the LDAP groups to the Neo4j roles.

Configure Neo4j to support attribute authentication

This is an alternative configuration for Active Directory that allows users to log in by providing an attribute to search for, by default sAMAccountName. The attribute has to be unique to be used as a lookup. You create a system account that has read-only access to the parts of the LDAP directory that you want. However, it does not need to have access rights to Neo4j or any other systems.

In the neo4j.conf file, uncomment and configure the following settings:

  1. Configure LDAP to point to the AD server:

    dbms.security.ldap.host=ldap://myactivedirectory.example.com

  2. Provide details on the user structure of the LDAP directory (replacing myattribute with the actual attribute name):

    dbms.security.ldap.authorization.user_search_base=cn=Users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_filter=(&(objectClass=*)(myattribute={0}))
dbms.security.ldap.authorization.group_membership_attributes=memberOf

  3. Map the groups in the LDAP system to the Neo4j built-in and custom roles. See Map the LDAP groups to the Neo4j roles.

  4. Configure Neo4j to use a system account with read access to all users and groups in the LDAP server.

    1. Set dbms.security.ldap.authorization.use_system_account value to true.

    2. Set dbms.security.ldap.authorization.system_username value to the full Distinguished Name (DN) as the dbms.security.ldap.authentication.user_dn_template will not be applied to this username. For example,

      dbms.security.ldap.authorization.system_username=cn=search-account,cn=Users,dc=example,dc=com

    3. Configure the LDAP system account password.

      dbms.security.ldap.authorization.system_password=your_password

    4. Configure which attribute to search for by adding the following lines to the neo4j.conf file (replacing myattribute with the actual attribute name):

      dbms.security.ldap.authentication.search_for_attribute=true
dbms.security.ldap.authentication.attribute=myattribute

    5. (Optional) Create an LDAP group to restrict authentication against the database to a subset of LDAP users:

      dbms.security.ldap.authorization.access_permitted_group=cn=Neo4j Access,cn=users,dc=example,dc=com

Configure Neo4j to support sAMAccountName authentication by setting user_dn_template

This is an alternative configuration for Active Directory that allows all users from the specified domain to log in using sAMAccountName. With this option, you do not have to create a system account and store a system username/password in the config file. Instead, you set {0}@example.com as a value of the user_dn_template to enable the authentication to start at the root domain. This way, the whole tree is checked to find the user, regardless of where it is located within the LDAP directory tree.

In the neo4j.conf file, uncomment and configure the following settings:

  1. Configure LDAP to point to the AD server:

    dbms.security.ldap.host=ldap://myactivedirectory.example.com

  2. Provide details on the user structure of the LDAP directory:

    dbms.security.ldap.authentication.user_dn_template={0}@example.com
dbms.security.ldap.authorization.user_search_base=dc=example,dc=com
dbms.security.ldap.authorization.user_search_filter=(&(objectClass=user)(sAMAccountName={0}))
dbms.security.ldap.authorization.group_membership_attributes=memberOf

  3. Map the groups in the LDAP system to the Neo4j built-in and custom roles. For more information, see Map the LDAP groups to the Neo4j roles.

The setting dbms.security.ldap.authentication.search_for_attribute should be set to the default value of false.

Configure Neo4j to perform nested group lookup

When a user is a member of a group (e.g. engineers) and that group is a member of another group (e.g. employees), Active Directory can be configured to perform a nested search such that a user in the group engineers would also be a member of the group employees. This in turn means that it is possible to configure a group to role mapping for employees which will transitively apply to engineers.

Active Directory facilitates nested search via the extensible match operator LDAP_MATCHING_RULE_IN_CHAIN (whose Object Identifier is 1.2.840.113556.1.4.1941). This operator walks the chain of ancestry in objects all the way to the root.

To set up nested search in the neo4j.conf file, configure the following settings:

  1. Enable nested groups.

    dbms.security.ldap.authorization.nested_groups_enabled=true

  2. Provide details on the user structure of the LDAP directory:

    dbms.security.ldap.authentication.user_dn_template=cn={0},cn=users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_base=dc=example,dc=com
dbms.security.ldap.authorization.user_search_filter=(&(objectClass=*)(uid={0}))

  3. Provide the nested groups search filter.
    This is the filter which will be used to perform the nested lookup of the user’s groups. It should contain the placeholder token {0}, which will be substituted with the user’s Distinguished Name (which is found for the specified user principle using dbms.security.ldap.authorization.user_search_filter).
    This example features Active Directory’s LDAP_MATCHING_RULE_IN_CHAIN (aka 1.2.840.113556.1.4.1941) implementation:

    dbms.security.ldap.authorization.nested_groups_search_filter=(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={0}))

  4. Provide group to role mappings, including ancestor groups if required:

    dbms.security.ldap.authorization.group_to_role_mapping=\
"cn=engineers,cn=users,dc=example,dc=com"=procedures;\
"cn=employees,cn=users,dc=example,dc=com"=reader
In contrast to a non-nested-LDAP lookup, a nested group lookup does not perform an attribute-based lookup on the user object. Instead, the dbms.security.ldap.authorization.group_membership_attributes setting is ignored and the dbms.security.ldap.authorization.user_search_filter is only used to determine the Distinguished Name of the user. This is then substituted into the dbms.security.ldap.authorization.nested_groups_search_filter to perform a separate, nested lookup of the user’s groups.

Configure Neo4j to use OpenLDAP

You configure the LDAP security provider to access and manage your OpenLDAP directory service.

In the neo4j.conf file, uncomment and configure the following settings:

  1. Configure LDAP to point to the OpenLDAP server:

    dbms.security.ldap.host=myopenldap.example.com

  2. Provide details on the user structure of the LDAP directory:

    dbms.security.ldap.authentication.user_dn_template=cn={0},ou=users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_base=ou=users,dc=example,dc=com
dbms.security.ldap.authorization.user_search_filter=(&(objectClass=*)(uid={0}))
dbms.security.ldap.authorization.group_membership_attributes=gidNumber

  3. (Optional) Create an LDAP group to restrict authentication against the database to a subset of LDAP users:

    dbms.security.ldap.authorization.access_permitted_group=501

  4. Map the groups in the LDAP system to the Neo4j built-in and custom roles. For more information, see Map the LDAP groups to the Neo4j roles.

Configure authentication/authorization at the user level using auth providers

User auth providers can be used to determine which users can authenticate and authorize using the configured providers, including LDAP.

You must change the dbms.security.require_local_user configuration setting to true to use auth providers. This means that a user with a matching auth provider must exist in order to be able to authenticate and authorize. This applies to all providers.

Conversely, when dbms.security.require_local_user is set to false, users' auth providers have no bearing on the way that they are authenticated and authorized, instead authentication and authorization is controlled centrally (for all users) by the database configuration.

The following examples show how to configure users with auth provider ldap using Cypher.

Example 3. Create a user with an auth provider who can authenticate and authorize using LDAP
CREATE USER alice
SET AUTH PROVIDER 'ldap' { SET ID 'cn=alice,ou=engineering,dc=example,dc=com' }

The command creates the user alice who can authenticate and authorize using LDAP provided their LDAP dn is cn=alice,ou=engineering,dc=example,dc=com.

Example 4. Create a user with two auth providers allowing the user to authenticate and authorize with either LDAP or the mysso provider
CREATE USER alice
SET HOME DATABASE anotherDb
SET AUTH PROVIDER 'ldap' { SET ID 'cn=alice,ou=engineering,dc=example,dc=com' }
SET AUTH 'oidc-mysso' {SET ID 'alicesUniqueMySsoId'}

The command creates the user alice who can authenticate and authorize using ldap or mysso. See Configure SSO at the user level using auth providers for more information on setting up an OIDC provider. The example also illustrates that the user can have their home database set even when using only external auth providers.

Example 5. Alter a user to remove one of their auth providers
ALTER USER alice
REMOVE AUTH 'ldap'

The command prevents the user alice from being able to authenticate and authorize using ldap.

Example 6. Alter a user to allow them to authenticate and authorize using username and password
ALTER USER alice
SET AUTH 'native' {SET PASSWORD 'changeme' SET PASSWORD CHANGE REQUIRED}

The command allows the user alice to authenticate and authorize using the specified username and password (in addition to what they are already configured to use).

Example 7. Configure the database to allow authentication via ldap and authorization via the native provider

  1. Set the following database config:

    dbms.security.authentication_providers=ldap
dbms.security.authorization_providers=native

  2. Create a user with an ldap auth provider:

    CREATE USER alice
SET AUTH PROVIDER 'ldap' { SET ID 'cn=alice,ou=engineering,dc=example,dc=com' }

  3. Natively grant the READER role to the user:

    GRANT ROLE READER TO alice

    The command allows the user alice to authenticate using ldap and receive the READER role from the native provider.

  4. You can also give the user the union of roles from ldap and native roles by setting ldap as an authorization provider too:

    dbms.security.authentication_providers=ldap
dbms.security.authorization_providers=native,ldap
Example 8. Suspend a user
ALTER USER alice
SET STATUS SUSPENDED

The command completely prevents the user from being able to authenticate/authorize by any means.

Example 9. Disambiguate users with the same name in different LDAP trees

Suppose there are two users both with the name alice, one is part of the engineering tree (cn=alice,ou=engineering,dc=example,dc=com) and the other is part of the sales tree (cn=alice,ou=sales,dc=example,dc=com).

To disambiguate these users, you can create two users in the database, each with a different ID that corresponds to the dn of the user in the LDAP tree.

CREATE USER aliceEngineering
SET AUTH 'ldap' { SET ID 'cn=alice,ou=engineering,dc=example,dc=com' }

CREATE USER aliceSales
SET AUTH 'ldap' { SET ID 'cn=alice,ou=sales,dc=example,dc=com' }

You can verify that your LDAP configuration is correct, and that the LDAP server responds, by using the LDAP command-line tool ldapsearch.

The ldapsearch command accepts the LDAP configuration setting values as input and verifies both the authentication (using the simple mechanism) and authorization of a user. See the ldapsearch official documentation for more advanced usage and how to use SASL authentication mechanisms.

  1. Verify the authentication and authorization of a user. For example, john.

    • With dbms.security.ldap.authorization.use_system_account=false (default):

      # ldapsearch -v -H ldap://<dbms.security.ldap.host> -x -D <dbms.security.ldap.authentication.user_dn_template : replace {0}> -W -b <dbms.security.ldap.authorization.user_search_base> "<dbms.security.ldap.authorization.user_search_filter : replace {0}>" <dbms.security.ldap.authorization.group_membership_attributes>

ldapsearch -v -H ldap://myactivedirectory.example.com:389 -x -D cn=john,cn=Users,dc=example,dc=com -W -b cn=Users,dc=example,dc=com "(&(objectClass=*)(cn=john))" memberOf

    • With dbms.security.ldap.authorization.use_system_account=true:

      # ldapsearch -v -H ldap://<dbms.security.ldap.host> -x -D <dbms.security.ldap.authorization.system_username> -w <dbms.security.ldap.authorization.system_password> -b <dbms.security.ldap.authorization.user_search_base> "<dbms.security.ldap.authorization.user_search_filter>" <dbms.security.ldap.authorization.group_membership_attributes>

ldapsearch -v -H ldap://myactivedirectory.example.com:389 -x -D cn=search-account,cn=Users,dc=example,dc=com -w your_password -b cn=Users,dc=example,dc=com "(&(objectClass=*)(cn=john))" memberOf

  2. Verify that the value of the returned membership attribute is a group that is mapped to a role in dbms.security.ldap.authorization.group_to_role_mapping.

    # extended LDIF
#
# LDAPv3
# base <cn=Users,dc=example,dc=com> with scope subtree
# filter: (cn=john)
# requesting: memberOf
#

# john, Users, example.com
dn: CN=john,CN=Users,DC=example,DC=com
memberOf: CN=Neo4j Read Only,CN=Users,DC=example,DC=com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

The auth cache

The auth cache is the mechanism by which Neo4j caches the result of authentication via the LDAP server in order to aid performance. It is configured with the parameters dbms.security.ldap.authentication.cache_enabled, and dbms.security.auth_cache_ttl.

# Turn on authentication caching to ensure performance.

dbms.security.ldap.authentication.cache_enabled=true
dbms.security.auth_cache_ttl=10m
Table 1. Auth cache parameters
Parameter name Default value Description

dbms.security.ldap.authentication.cache_enabled

true

Determines whether or not to cache the result of authentication via the LDAP server.

Whether authentication caching should be enabled or not must be considered in view of your company’s security guidelines.

dbms.security.auth_cache_ttl

600 seconds

Is the time to live (TTL) for cached authentication and authorization info.

Setting the TTL to 0 disables all auth caching.

A short TTL requires more frequent re-authentication and re-authorization, which can impact performance.

A very long TTL means that changes to the users settings on an LDAP server may not be reflected in the Neo4j authorization behaviour in a timely manner.

Valid units are ms, s, m; default unit is s.

An administrator can clear the auth cache to force the re-querying of authentication and authorization information from the federated auth provider system. Use Neo4j Browser or Neo4j Cypher Shell to execute this statement:

CALL dbms.security.clearAuthCache()

Available methods of encryption

Specifying the dbms.security.ldap.host parameter configures using LDAP without encryption. Not specifying the protocol or port results in ldap being used over the default port 389.

dbms.security.ldap.host=myactivedirectory.example.com
dbms.security.ldap.host=myactivedirectory.example.com:389
dbms.security.ldap.host=ldap://myactivedirectory.example.com
dbms.security.ldap.host=ldap://myactivedirectory.example.com:389

Use LDAP with encryption via StartTLS

To configure Active Directory with encryption via StartTLS, set the following parameters:

dbms.security.ldap.use_starttls=true
dbms.security.ldap.host=ldap://myactivedirectory.example.com

Use LDAP with encrypted LDAPS

To configure Active Directory with encrypted LDAPS, set dbms.security.ldap.host to one of the following. If you do not specify the port, the default one 636 is used.

dbms.security.ldap.host=ldaps://myactivedirectory.example.com
dbms.security.ldap.host=ldaps://myactivedirectory.example.com:636

Use a self-signed certificate (SSL) in a test environment

Production environments should always use an SSL certificate issued by a Certificate Authority for secure access to the LDAP server. However, there are scenarios, for example in test environments, where you may want to use an SSL certificate on the LDAP server.

To configure an SSL certificate on LDAP server, enter the details of the certificate using server.jvm.additional in neo4j.conf. The path to the certificate file MyCert.jks is an absolute path to the Neo4j server.

server.jvm.additional=-Djavax.net.ssl.keyStore=/path/to/MyCert.jks
server.jvm.additional=-Djavax.net.ssl.keyStorePassword=mypasword
server.jvm.additional=-Djavax.net.ssl.trustStore=/path/to/MyCert.jks
server.jvm.additional=-Djavax.net.ssl.trustStorePassword=mypasword

Debug logging of group result

While setting up an LDAP integration, it is sometimes necessary to perform troubleshooting. In these cases, it can be useful to view the group result from the LDAP server. To enable the logging of these claims at DEBUG level in the security log, set dbms.security.logs.ldap.groups_at_debug_level_enabled to be true and the security log level to DEBUG.

Make sure to set dbms.security.logs.ldap.groups_at_debug_level_enabled back to false for production environments to avoid unwanted logging of potentially sensitive information. Also, bear in mind that the group result provided by the LDAP server can change over time.

Glossary

allocator

A component in the cluster that allocates databases to servers according to the topology constraints specified and an allocation strategy.

asynchronous replication

Asynchronous replication is used by secondary copies to poll for new transactions, which means they cannot be guaranteed to have received the most recent transactions. This enables efficient scale-out of read-performance.

Aura instance

A fully-managed DBMS represented by a single instance ID, that is running in the Neo4j Aura cloud.

auto-commit transaction

An automatically committed transaction that contains a single query.

Bolt protocol

Bolt is a protocol used for interaction between Neo4j instances and drivers.

bookmark

A marker the client can request from the cluster to ensure that it is able to read its own writes so that the application’s state is consistent and only databases that have a copy of the bookmark are permitted to respond.

category (Bloom)

A category is based on a node label and is defined in a Perspective as a way of visually distinguishing nodes with the same label(s).

causal consistency

All servers in a cluster agree on the order in which transactions take place. The position of a server on the causal chain can be guaranteed using a bookmark.

cluster

A Neo4j DBMS that spans multiple servers working together to increase fault tolerance and/or read scalability. Databases on a cluster may be configured to replicate across servers in the cluster thus achieving read scalability or high availability.

client application

Software that interacts with a Neo4j server.

commit

A commit is the successful completion of a transaction, which ensures durability of any changes made. For more details, visit Operations Manual → Transaction management.

composite database

Composite databases are the means to access partitioned graph data with a single Cypher query.

constraint

Constraints are sets of data modeling rules that ensure the data is consistent and reliable.

Cypher®

Neo4j’s graph query language.

data model

A data model defines how information is organized in a database. A good data model will make querying and understanding your data easier. In Neo4j, the data models have a graph structure.

database

A database is a container used by the DBMS to manage and store graph data. The physical structure of data is controlled by the database.

database vs graph

Databases are the physical containers of graph data. Graphs are the logical structure of data in Neo4j.

Database Management System

Database Management System, or DBMS, capable of managing multiple databases. A DBMS may run on a single server, or span several servers configured as a cluster.

database schema

The prescribed property existence and datatypes for nodes and relationships.

deallocate

An act of removing a database from a server or a server from a cluster without loss of data or reduced fault tolerance.

degree (of a node)

The number of relationships of a specific node; loops are counted twice.

disaster recovery

A manual intervention to restore availability of a cluster, or databases within a cluster.

driver

A software library that provides access to Neo4j from a particular programming language.

election

In the event that the Raft leader becomes unresponsive, followers automatically trigger an election and vote for a new leader.

entity

A node or a relationship.

expression (Cypher)

A component of a Cypher query which produces values. It may be used in projections, as a predicate, or when setting properties on graph elements.

fabric

Fabric is the architectural design of a unified system that provides a single access point to local or distributed graph data.

fault tolerance

A guarantee that a cluster can maintain a database’s persistence and availability in the event of one or more servers failing.

follower

A primary copy of a database acting as a follower, receives and acknowledges synchronous writes from the leader.

Generative AI (GenAI)

A type of artificial intelligence (AI) system that generates text, images, or other media in response to prompts.

graph

A logical representation of a set of nodes where some pairs are connected by relationships.

index

Data structure that improves read performance of a database.

knowledge graph

A specific type of graph that has an organizing principle so that a user (or a computer system) can reason about the underlying data. The organizing principle provides an additional layer of structure that adds context to support knowledge discovery.

label

Marks a node as a member of a named and indexed subset. A node may be assigned zero or more labels.

leader

A single primary copy of a database is designated as the leader. It receives all write transactions from clients and replicates writes synchronously to followers and asynchronously to secondary copies of the database.

main database

In terms of Neo4j Enterprise Studio, the database(s) containing the user’s data. Can exist in the same Neo4j deployment as the tool asset database.

motif

A description of a specific pattern within a graph.

node

A node represents an entity or discrete object in your graph data model. Nodes can be connected by relationships, hold data in properties, and are classified by labels.

operator

A symbol representing a mathematical or logical operation.

parameter

Named value provided when running a Cypher statement.

path

A sequence of nodes and the relationships connecting them, that does not contain duplicate relationships. Several paths can match a pattern.

pattern

A specific arrangement of nodes and relationships that can be matched in a graph. A pattern follows a motif.

perspective (Bloom)

A Perspective defines a certain business view or domain that can be found in the target Neo4j graph. A single Neo4j graph can be viewed through different Perspectives, each tailored for a different business purpose.

primary

A copy of the database that is able to process write transactions and is eligible to be elected as a leader. It participates in fault tolerant writes as it is part of the majority required to acknowledge and commit write transactions.

primary vs secondary

In a cluster, databases can operate in either primary or secondary mode. Primary databases are able to process write and read transactions, ensuring fault tolerance. Secondary databases are replicated asynchronously from primaries, and their main purpose is to provide read scaling within the cluster.

project (Aura)

An isolated environment in the unified Aura console that contains its own database instances, configurations, and resources. Preceded by tenant in the classic Aura console.

property

Properties are key-value pairs that are used for storing data on nodes and relationships.

query (Cypher)

A statement that retrieves or writes information to a database.

Raft group

A group of servers that are participating in hosting a particular database in primary mode.

Raft group member

A server that is participating in a Raft group. A server can be a member of one or more groups.

Raft log

A shared log between all Raft group members that is guaranteed to be consistently updated and viewed by those members. The log contains both database data and operational state of the Raft group.

Raft protocol

The networking mechanism that enables a database to replicate its data across multiple servers to give high availability for accessing the data and high durability to the data stored.

read scaling

Distributing query load by creating additional database copies hosted in secondary mode (read-only).

relationship

A relationship represents a connection between nodes in your graph data model. Relationships connect a source node to a target node, hold data in properties, and are classified by type.

secondary

An asynchronously replicated copy of the database that provides read scaling within the cluster.

seed

A seed is a database dump or a full backup used to create a database on a cluster. This is sometimes called seeding.

server

A physical machine, a virtual machine, or a container running an instance of Neo4j. Servers can be standalone or part of a cluster.

session

A causally linked sequence of transactions.

session consistency

An alternative name for Neo4j’s causal consistency.

standalone

A single server running Neo4j and not part of a cluster.

synchronous replication

Synchronous replication requires the leader primary to replicate a transaction and block the commit until a quorum of the follower primaries acknowledges that the transaction is successfully replicated. Once the transaction is replicated, the commit is allowed to proceed. This ensures data durability and consistency within the cluster.

system database

A database used by Neo4j to store system information.

tenant (Aura)

An isolated environment in the classic Aura console that contains its own database instances, configurations, and resources. Replaced by project in the unified Aura console.

tool asset database

In terms of Neo4j Enterprise Studio, the database where tools' assets are stored. This can be in the same Neo4j deployment as the main database(s) or in a separate deployment.

topology

A configuration that describes how the copies of a database should be spread across the servers in a cluster, see primary mode and secondary mode.

transaction

A transaction comprises a unit of work performed against a database. It is treated in a coherent and reliable way, independent of other transactions. Transactions comply with the ACID consistency model (atomic, consistent, isolated, and durable).