From 19a35b96631db73c837f26c1fa81f8ce933979ea Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Mon, 10 Mar 2025 11:01:11 +0100 Subject: [PATCH 01/32] Updated images --- modules/ROOT/images/call-procedure.svg | 27 ++++ modules/ROOT/images/call_procedure.svg | 1 - modules/ROOT/images/case-graph.svg | 34 +++++ modules/ROOT/images/case_graph.svg | 1 - .../images/graph-aggregating-functions.svg | 39 ++++++ modules/ROOT/images/graph-limit-clause.svg | 32 +++++ modules/ROOT/images/graph-list-functions.svg | 34 +++++ modules/ROOT/images/graph-match-clause.svg | 37 ++++++ modules/ROOT/images/graph-merge-clause.svg | 37 ++++++ .../ROOT/images/graph-numeric-functions.svg | 34 +++++ .../images/graph-optional-match-clause.svg | 39 ++++++ modules/ROOT/images/graph-order-by-clause.svg | 15 +++ .../ROOT/images/graph-predicate-functions.svg | 39 ++++++ modules/ROOT/images/graph-remove-clause.svg | 22 ++++ .../ROOT/images/graph-scalar-functions.svg | 34 +++++ modules/ROOT/images/graph-set-clause.svg | 24 ++++ modules/ROOT/images/graph-skip-clause.svg | 32 +++++ modules/ROOT/images/graph-union-clause.svg | 18 +++ modules/ROOT/images/graph-where-clause.svg | 15 +++ .../images/graph_aggregating_functions.svg | 1 - modules/ROOT/images/graph_limit_clause.svg | 1 - modules/ROOT/images/graph_list_functions.svg | 1 - modules/ROOT/images/graph_match_clause.svg | 1 - .../images/graph_match_clause_backtick.svg | 1 - .../graph_match_clause_variable_length.svg | 1 - modules/ROOT/images/graph_merge_clause.svg | 1 - .../ROOT/images/graph_numeric_functions.svg | 1 - .../images/graph_optional_match_clause.svg | 1 - modules/ROOT/images/graph_order_by_clause.svg | 1 - .../ROOT/images/graph_predicate_functions.svg | 1 - modules/ROOT/images/graph_remove_clause.svg | 1 - .../ROOT/images/graph_scalar_functions.svg | 1 - modules/ROOT/images/graph_set_clause.svg | 1 - modules/ROOT/images/graph_skip_clause.svg | 1 - modules/ROOT/images/graph_union_clause.svg | 1 - modules/ROOT/images/graph_where_clause.svg | 1 - modules/ROOT/images/introduction-example1.svg | 54 ++++++++ modules/ROOT/images/introduction_example1.svg | 1 - modules/ROOT/images/introduction_example2.svg | 1 - .../images/patterns-equijoin-reference.svg | 9 ++ .../ROOT/images/patterns-equijoins-motif.svg | 25 ++++ .../ROOT/images/patterns-equijoins-motif2.svg | 25 ++++ .../images/patterns-equijoins-solution2.svg | 100 +++++++++++++++ modules/ROOT/images/patterns-equijoins.svg | 118 ++++++++++++++++++ modules/ROOT/images/patterns-qpp-motif1.svg | 18 +++ .../images/patterns-second-shortest-paths.svg | 65 ++++++++++ .../ROOT/images/patterns-shortest-graph.svg | 72 +++++++++++ modules/ROOT/images/patterns-shortest-tie.svg | 23 ++++ modules/ROOT/images/patterns_equijoins.svg | 1 - .../ROOT/images/patterns_equijoins_motif.svg | 1 - .../ROOT/images/patterns_equijoins_motif2.svg | 1 - .../ROOT/images/patterns_equijoins_motif3.svg | 1 - .../images/patterns_equijoins_solution.svg | 9 -- .../images/patterns_equijoins_solution2.svg | 1 - modules/ROOT/images/patterns_qpp_motif1.svg | 1 - .../images/patterns_second_shortest_paths.svg | 1 - .../ROOT/images/patterns_shortest_graph.svg | 1 - .../patterns_shortest_graph_pattern1.svg | 1 - .../patterns_shortest_graph_pattern2.svg | 1 - modules/ROOT/images/patterns_shortest_tie.svg | 1 - modules/ROOT/images/patterns_shortestpath.svg | 1 - .../images/predicate-function-example.svg | 12 ++ .../images/predicate_function_example.svg | 1 - .../images/values-and-types-lists-graph.svg | 47 +++++++ .../images/values_and_types_lists_graph.svg | 1 - modules/ROOT/pages/clauses/call.adoc | 2 +- modules/ROOT/pages/clauses/limit.adoc | 2 +- modules/ROOT/pages/clauses/match.adoc | 2 +- modules/ROOT/pages/clauses/merge.adoc | 2 +- .../ROOT/pages/clauses/optional-match.adoc | 2 +- modules/ROOT/pages/clauses/order-by.adoc | 2 +- modules/ROOT/pages/clauses/remove.adoc | 2 +- modules/ROOT/pages/clauses/set.adoc | 2 +- modules/ROOT/pages/clauses/skip.adoc | 2 +- modules/ROOT/pages/clauses/where.adoc | 2 +- .../expressions/conditional-expressions.adoc | 2 +- modules/ROOT/pages/functions/aggregating.adoc | 2 +- modules/ROOT/pages/functions/list.adoc | 2 +- .../pages/functions/mathematical-numeric.adoc | 2 +- modules/ROOT/pages/functions/predicate.adoc | 7 +- modules/ROOT/pages/functions/scalar.adoc | 2 +- .../pages/patterns/non-linear-patterns.adoc | 8 +- .../ROOT/pages/patterns/shortest-paths.adoc | 6 +- .../patterns/variable-length-patterns.adoc | 2 +- modules/ROOT/pages/queries/basic.adoc | 2 +- .../composed-queries/combined-queries.adoc | 2 +- .../ROOT/pages/values-and-types/lists.adoc | 2 +- 87 files changed, 1109 insertions(+), 74 deletions(-) create mode 100644 modules/ROOT/images/call-procedure.svg delete mode 100644 modules/ROOT/images/call_procedure.svg create mode 100644 modules/ROOT/images/case-graph.svg delete mode 100644 modules/ROOT/images/case_graph.svg create mode 100644 modules/ROOT/images/graph-aggregating-functions.svg create mode 100644 modules/ROOT/images/graph-limit-clause.svg create mode 100644 modules/ROOT/images/graph-list-functions.svg create mode 100644 modules/ROOT/images/graph-match-clause.svg create mode 100644 modules/ROOT/images/graph-merge-clause.svg create mode 100644 modules/ROOT/images/graph-numeric-functions.svg create mode 100644 modules/ROOT/images/graph-optional-match-clause.svg create mode 100644 modules/ROOT/images/graph-order-by-clause.svg create mode 100644 modules/ROOT/images/graph-predicate-functions.svg create mode 100644 modules/ROOT/images/graph-remove-clause.svg create mode 100644 modules/ROOT/images/graph-scalar-functions.svg create mode 100644 modules/ROOT/images/graph-set-clause.svg create mode 100644 modules/ROOT/images/graph-skip-clause.svg create mode 100644 modules/ROOT/images/graph-union-clause.svg create mode 100644 modules/ROOT/images/graph-where-clause.svg delete mode 100644 modules/ROOT/images/graph_aggregating_functions.svg delete mode 100644 modules/ROOT/images/graph_limit_clause.svg delete mode 100644 modules/ROOT/images/graph_list_functions.svg delete mode 100644 modules/ROOT/images/graph_match_clause.svg delete mode 100644 modules/ROOT/images/graph_match_clause_backtick.svg delete mode 100644 modules/ROOT/images/graph_match_clause_variable_length.svg delete mode 100644 modules/ROOT/images/graph_merge_clause.svg delete mode 100644 modules/ROOT/images/graph_numeric_functions.svg delete mode 100644 modules/ROOT/images/graph_optional_match_clause.svg delete mode 100644 modules/ROOT/images/graph_order_by_clause.svg delete mode 100644 modules/ROOT/images/graph_predicate_functions.svg delete mode 100644 modules/ROOT/images/graph_remove_clause.svg delete mode 100644 modules/ROOT/images/graph_scalar_functions.svg delete mode 100644 modules/ROOT/images/graph_set_clause.svg delete mode 100644 modules/ROOT/images/graph_skip_clause.svg delete mode 100644 modules/ROOT/images/graph_union_clause.svg delete mode 100644 modules/ROOT/images/graph_where_clause.svg create mode 100644 modules/ROOT/images/introduction-example1.svg delete mode 100644 modules/ROOT/images/introduction_example1.svg delete mode 100644 modules/ROOT/images/introduction_example2.svg create mode 100644 modules/ROOT/images/patterns-equijoin-reference.svg create mode 100644 modules/ROOT/images/patterns-equijoins-motif.svg create mode 100644 modules/ROOT/images/patterns-equijoins-motif2.svg create mode 100644 modules/ROOT/images/patterns-equijoins-solution2.svg create mode 100644 modules/ROOT/images/patterns-equijoins.svg create mode 100644 modules/ROOT/images/patterns-qpp-motif1.svg create mode 100644 modules/ROOT/images/patterns-second-shortest-paths.svg create mode 100644 modules/ROOT/images/patterns-shortest-graph.svg create mode 100644 modules/ROOT/images/patterns-shortest-tie.svg delete mode 100644 modules/ROOT/images/patterns_equijoins.svg delete mode 100644 modules/ROOT/images/patterns_equijoins_motif.svg delete mode 100644 modules/ROOT/images/patterns_equijoins_motif2.svg delete mode 100644 modules/ROOT/images/patterns_equijoins_motif3.svg delete mode 100644 modules/ROOT/images/patterns_equijoins_solution.svg delete mode 100644 modules/ROOT/images/patterns_equijoins_solution2.svg delete mode 100644 modules/ROOT/images/patterns_qpp_motif1.svg delete mode 100644 modules/ROOT/images/patterns_second_shortest_paths.svg delete mode 100644 modules/ROOT/images/patterns_shortest_graph.svg delete mode 100644 modules/ROOT/images/patterns_shortest_graph_pattern1.svg delete mode 100644 modules/ROOT/images/patterns_shortest_graph_pattern2.svg delete mode 100644 modules/ROOT/images/patterns_shortest_tie.svg delete mode 100644 modules/ROOT/images/patterns_shortestpath.svg create mode 100644 modules/ROOT/images/predicate-function-example.svg delete mode 100644 modules/ROOT/images/predicate_function_example.svg create mode 100644 modules/ROOT/images/values-and-types-lists-graph.svg delete mode 100644 modules/ROOT/images/values_and_types_lists_graph.svg diff --git a/modules/ROOT/images/call-procedure.svg b/modules/ROOT/images/call-procedure.svg new file mode 100644 index 000000000..e244a4122 --- /dev/null +++ b/modules/ROOT/images/call-procedure.svg @@ -0,0 +1,27 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/call_procedure.svg b/modules/ROOT/images/call_procedure.svg deleted file mode 100644 index 7cb856c93..000000000 --- a/modules/ROOT/images/call_procedure.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSDevelopername:'Andy'born:1991Administratorname:'David'born:1994nationality:'Swedish'Developername:'Beatrice'born:1985Administratorname:'Charlotte'born:1990 \ No newline at end of file diff --git a/modules/ROOT/images/case-graph.svg b/modules/ROOT/images/case-graph.svg new file mode 100644 index 000000000..f07b7cab8 --- /dev/null +++ b/modules/ROOT/images/case-graph.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/case_graph.svg b/modules/ROOT/images/case_graph.svg deleted file mode 100644 index 98bfc6ba1..000000000 --- a/modules/ROOT/images/case_graph.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSMARRIEDPersonname:'Alice'age:38eyes:'brown'Personname:'Charlie'age:53eyes:'green'Personname:'Bob'age:25eyes:'blue'Personname:'Daniel'eyes:'brown'Personname:'Eskil'age:41eyes:'blue' diff --git a/modules/ROOT/images/graph-aggregating-functions.svg b/modules/ROOT/images/graph-aggregating-functions.svg new file mode 100644 index 000000000..241f4e533 --- /dev/null +++ b/modules/ROOT/images/graph-aggregating-functions.svg @@ -0,0 +1,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-limit-clause.svg b/modules/ROOT/images/graph-limit-clause.svg new file mode 100644 index 000000000..98315ea57 --- /dev/null +++ b/modules/ROOT/images/graph-limit-clause.svg @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-list-functions.svg b/modules/ROOT/images/graph-list-functions.svg new file mode 100644 index 000000000..25c412407 --- /dev/null +++ b/modules/ROOT/images/graph-list-functions.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-match-clause.svg b/modules/ROOT/images/graph-match-clause.svg new file mode 100644 index 000000000..605b5c7e6 --- /dev/null +++ b/modules/ROOT/images/graph-match-clause.svg @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-merge-clause.svg b/modules/ROOT/images/graph-merge-clause.svg new file mode 100644 index 000000000..52c21c583 --- /dev/null +++ b/modules/ROOT/images/graph-merge-clause.svg @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-numeric-functions.svg b/modules/ROOT/images/graph-numeric-functions.svg new file mode 100644 index 000000000..2f8442fa0 --- /dev/null +++ b/modules/ROOT/images/graph-numeric-functions.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-optional-match-clause.svg b/modules/ROOT/images/graph-optional-match-clause.svg new file mode 100644 index 000000000..30d557bc7 --- /dev/null +++ b/modules/ROOT/images/graph-optional-match-clause.svg @@ -0,0 +1,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-order-by-clause.svg b/modules/ROOT/images/graph-order-by-clause.svg new file mode 100644 index 000000000..3817840e9 --- /dev/null +++ b/modules/ROOT/images/graph-order-by-clause.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-predicate-functions.svg b/modules/ROOT/images/graph-predicate-functions.svg new file mode 100644 index 000000000..12f5b3f19 --- /dev/null +++ b/modules/ROOT/images/graph-predicate-functions.svg @@ -0,0 +1,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-remove-clause.svg b/modules/ROOT/images/graph-remove-clause.svg new file mode 100644 index 000000000..9d3eaaebc --- /dev/null +++ b/modules/ROOT/images/graph-remove-clause.svg @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-scalar-functions.svg b/modules/ROOT/images/graph-scalar-functions.svg new file mode 100644 index 000000000..e8e64fffe --- /dev/null +++ b/modules/ROOT/images/graph-scalar-functions.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-set-clause.svg b/modules/ROOT/images/graph-set-clause.svg new file mode 100644 index 000000000..52fc7173b --- /dev/null +++ b/modules/ROOT/images/graph-set-clause.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-skip-clause.svg b/modules/ROOT/images/graph-skip-clause.svg new file mode 100644 index 000000000..036c103b9 --- /dev/null +++ b/modules/ROOT/images/graph-skip-clause.svg @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-union-clause.svg b/modules/ROOT/images/graph-union-clause.svg new file mode 100644 index 000000000..56a3619bd --- /dev/null +++ b/modules/ROOT/images/graph-union-clause.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-where-clause.svg b/modules/ROOT/images/graph-where-clause.svg new file mode 100644 index 000000000..6a1b83c80 --- /dev/null +++ b/modules/ROOT/images/graph-where-clause.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph_aggregating_functions.svg b/modules/ROOT/images/graph_aggregating_functions.svg deleted file mode 100644 index a2ec6323e..000000000 --- a/modules/ROOT/images/graph_aggregating_functions.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSKNOWSACTED_INPersonname:'Guy Pearce'age:55Personname:'Carrie Anne Moss'age:55Personname:'Keanu Reeves'age:58Personname:'Liam Neeson'age:70Personname:'Kathryn Bigelow'age:71Movietitle:'Speed' \ No newline at end of file diff --git a/modules/ROOT/images/graph_limit_clause.svg b/modules/ROOT/images/graph_limit_clause.svg deleted file mode 100644 index 5a21cdd1b..000000000 --- a/modules/ROOT/images/graph_limit_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSPersonname:'Erika'Personname:'Andy'Personname:'David'Personname:'Charlotte'Personname:'Bernard' \ No newline at end of file diff --git a/modules/ROOT/images/graph_list_functions.svg b/modules/ROOT/images/graph_list_functions.svg deleted file mode 100644 index 82ad32e38..000000000 --- a/modules/ROOT/images/graph_list_functions.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSMARRIEDAdministratorname:'Charlie'age:53eyes:'Green'Administratorname:'Bob'age:25eyes:'Blue'Developername:'Alice'age:38eyes:'Brown'Administratorname:'Daniel'age:53eyes:'Brown'Designername:'Eskil'age:41eyes:'Blue'likedColors:['Pink', 'Yellow', 'Black'] \ No newline at end of file diff --git a/modules/ROOT/images/graph_match_clause.svg b/modules/ROOT/images/graph_match_clause.svg deleted file mode 100644 index 393b3fe23..000000000 --- a/modules/ROOT/images/graph_match_clause.svg +++ /dev/null @@ -1 +0,0 @@ -DIRECTEDACTED_INrole:'Gordon Gekko'ACTED_INrole:'Carl Fox'ACTED_INrole:'President Andrew Shepherd'ACTED_INrole:'A.J. MacInerney'ACTED_INrole:'Bud Fox'DIRECTEDPersonDirectorname:'Oliver Stone'Movietitle:'Wall Street'PersonActorname:'Michael Douglas'PersonActorname:'Martin Sheen'Movietitle:'The American President'PersonActorname:'Charlie Sheen'PersonDirectorname:'Rob Reiner' \ No newline at end of file diff --git a/modules/ROOT/images/graph_match_clause_backtick.svg b/modules/ROOT/images/graph_match_clause_backtick.svg deleted file mode 100644 index 3c379d15c..000000000 --- a/modules/ROOT/images/graph_match_clause_backtick.svg +++ /dev/null @@ -1 +0,0 @@ -DIRECTEDACTED_INrole:'Gordon Gekko'ACTED_INrole:'Carl Fox'ACTED_INrole:'President Andrew Shepherd'ACTED_INrole:'A.J. MacInerney'ACTED_INrole:'Bud Fox'DIRECTEDFATHER_OFOLD FRIENDSPersonname:'Oliver Stone'Movietitle:'Wall Street'Personname:'Michael Douglas'Personname:'Martin Sheen'Movietitle:'The American President'Personname:'Charlie Sheen'Personname:'Rob Reiner' \ No newline at end of file diff --git a/modules/ROOT/images/graph_match_clause_variable_length.svg b/modules/ROOT/images/graph_match_clause_variable_length.svg deleted file mode 100644 index 8c79b6f6d..000000000 --- a/modules/ROOT/images/graph_match_clause_variable_length.svg +++ /dev/null @@ -1 +0,0 @@ -DIRECTEDACTED_INrole:'Gordon Gekko'ACTED_INrole:'Carl Fox'ACTED_INrole:'President Andrew Shepherd'ACTED_INrole:'A.J. MacInerney'ACTED_INrole:'Bud Fox'DIRECTEDACTED_INrole:'Bud'lead:trueACTED_INrole:'New Warden'lead:falseACTED_INrole:'Bill Peterson'lead:trueACTED_INrole:'Jake Peterson'lead:trueFATHER_OFOLD FRIENDSPersonname:'Oliver Stone'Movietitle:'Wall Street'Personname:'Michael Douglas'Personname:'Martin Sheen'Movietitle:'The American President'Personname:'Charlie Sheen'Personname:'Rob Reiner'Movietitle:'Free Money'Movietitle:'No Code of Conduct' \ No newline at end of file diff --git a/modules/ROOT/images/graph_merge_clause.svg b/modules/ROOT/images/graph_merge_clause.svg deleted file mode 100644 index ac3e96690..000000000 --- a/modules/ROOT/images/graph_merge_clause.svg +++ /dev/null @@ -1 +0,0 @@ -ACTED_INACTED_INACTED_INDIRECTEDDIRECTEDACTED_INACTED_INPersonname:'Charlie Sheen'bornIn:'New York'chauffeurName:'John Brown'Personname:'Martin Sheen'bornIn:'Ohio'chauffeurName:'Bob Brown'Movietitle:'Wall Street'Personname:'Michael Douglas'bornIn:'New Jersey'chauffeurName:'John Brown'Personname:'Oliver Stone'bornIn:'New York'chauffeurName:'Bill White'Personname:'Rob Reiner'bornIn:'New York'chauffeurName:'Ted Green'Movietitle:'The American President' \ No newline at end of file diff --git a/modules/ROOT/images/graph_numeric_functions.svg b/modules/ROOT/images/graph_numeric_functions.svg deleted file mode 100644 index 82ad32e38..000000000 --- a/modules/ROOT/images/graph_numeric_functions.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSMARRIEDAdministratorname:'Charlie'age:53eyes:'Green'Administratorname:'Bob'age:25eyes:'Blue'Developername:'Alice'age:38eyes:'Brown'Administratorname:'Daniel'age:53eyes:'Brown'Designername:'Eskil'age:41eyes:'Blue'likedColors:['Pink', 'Yellow', 'Black'] \ No newline at end of file diff --git a/modules/ROOT/images/graph_optional_match_clause.svg b/modules/ROOT/images/graph_optional_match_clause.svg deleted file mode 100644 index d5373d409..000000000 --- a/modules/ROOT/images/graph_optional_match_clause.svg +++ /dev/null @@ -1 +0,0 @@ -DIRECTEDACTED_INACTED_INACTED_INACTED_INACTED_INDIRECTEDFATHER_OFPersonname:'Oliver Stone'Movietitle:'Wall Street'Personname:'Michael Douglas'Personname:'Martin Sheen'Movietitle:'The American President'Personname:'Charlie Sheen'Personname:'Rob Reiner' \ No newline at end of file diff --git a/modules/ROOT/images/graph_order_by_clause.svg b/modules/ROOT/images/graph_order_by_clause.svg deleted file mode 100644 index a42046fcc..000000000 --- a/modules/ROOT/images/graph_order_by_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSPersonname:'Charlotte'age:32length:185Personname:'Bernard'age:36Personname:'Andy'age:34length:170 \ No newline at end of file diff --git a/modules/ROOT/images/graph_predicate_functions.svg b/modules/ROOT/images/graph_predicate_functions.svg deleted file mode 100644 index 9b8a6a64d..000000000 --- a/modules/ROOT/images/graph_predicate_functions.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSKNOWSACTED_INACTED_INKNOWSPersonname:'Guy Pearce'age:55nationality:'Australian'Personname:'Carrie Anne Moss'age:55nationality:'American'Personname:'Keanu Reeves'age:58nationality:'Canadian'Personname:'Liam Neeson'age:70nationality:'Northern Irish'Personname:'Kathryn Bigelow'age:71nationality:'American'Movietitle:'The Matrix'Personname:'Jessica Chastain'age:45address:'' \ No newline at end of file diff --git a/modules/ROOT/images/graph_remove_clause.svg b/modules/ROOT/images/graph_remove_clause.svg deleted file mode 100644 index 534698e78..000000000 --- a/modules/ROOT/images/graph_remove_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSSwedishname:'Andy'age:36propTestValue2:42Swedishname:'Timothy'age:25propTestValue2:42SwedishGermanname:'Peter'age:34 \ No newline at end of file diff --git a/modules/ROOT/images/graph_scalar_functions.svg b/modules/ROOT/images/graph_scalar_functions.svg deleted file mode 100644 index 82ad32e38..000000000 --- a/modules/ROOT/images/graph_scalar_functions.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSMARRIEDAdministratorname:'Charlie'age:53eyes:'Green'Administratorname:'Bob'age:25eyes:'Blue'Developername:'Alice'age:38eyes:'Brown'Administratorname:'Daniel'age:53eyes:'Brown'Designername:'Eskil'age:41eyes:'Blue'likedColors:['Pink', 'Yellow', 'Black'] \ No newline at end of file diff --git a/modules/ROOT/images/graph_set_clause.svg b/modules/ROOT/images/graph_set_clause.svg deleted file mode 100644 index 61126d48d..000000000 --- a/modules/ROOT/images/graph_set_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSname:'Stefan'Swedishname:'Andy'age:36hungry:truename:'George'name:'Peter'age:34 \ No newline at end of file diff --git a/modules/ROOT/images/graph_skip_clause.svg b/modules/ROOT/images/graph_skip_clause.svg deleted file mode 100644 index 5a21cdd1b..000000000 --- a/modules/ROOT/images/graph_skip_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSKNOWSKNOWSKNOWSPersonname:'Erika'Personname:'Andy'Personname:'David'Personname:'Charlotte'Personname:'Bernard' \ No newline at end of file diff --git a/modules/ROOT/images/graph_union_clause.svg b/modules/ROOT/images/graph_union_clause.svg deleted file mode 100644 index 17a159aec..000000000 --- a/modules/ROOT/images/graph_union_clause.svg +++ /dev/null @@ -1 +0,0 @@ -ACTED_INACTED_INActorname:'Johnny Depp'Actorname:'Sarah Jessica Parker'Movietitle:'Ed woodActorDirectorname:'Ed Wood' \ No newline at end of file diff --git a/modules/ROOT/images/graph_where_clause.svg b/modules/ROOT/images/graph_where_clause.svg deleted file mode 100644 index f15e25ef6..000000000 --- a/modules/ROOT/images/graph_where_clause.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSsince:2012KNOWSsince:1999KNOWSsince:2005KNOWSsince:2010KNOWSsince:2021SwedishPersonname:'Andy'age:36Personname:'Timothy'age:38Personname:'Peter'age:35Personname:'Lisa'age:48Personname:'John'age:40Personname:'Susan'age:32 \ No newline at end of file diff --git a/modules/ROOT/images/introduction-example1.svg b/modules/ROOT/images/introduction-example1.svg new file mode 100644 index 000000000..9ffe1ae4e --- /dev/null +++ b/modules/ROOT/images/introduction-example1.svg @@ -0,0 +1,54 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/introduction_example1.svg b/modules/ROOT/images/introduction_example1.svg deleted file mode 100644 index 82738cb33..000000000 --- a/modules/ROOT/images/introduction_example1.svg +++ /dev/null @@ -1 +0,0 @@ -Neo4j Graph VisualizationCreated using Neo4j (http://www.neo4j.com/)ACTED_INACTED_INACTED_INACTED_INDIRECTEDACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_IN Tom Hanks Apollo 13 You've M… A LeagueO… Joe VersusVo… That Thing You Do The Da Vinci Code Cloud Atlas Cast Away The Green Mile Sleepless in Seattl The Polar Express Charlie Wilson's Wa \ No newline at end of file diff --git a/modules/ROOT/images/introduction_example2.svg b/modules/ROOT/images/introduction_example2.svg deleted file mode 100644 index bb0636913..000000000 --- a/modules/ROOT/images/introduction_example2.svg +++ /dev/null @@ -1 +0,0 @@ -Neo4j Graph VisualizationCreated using Neo4j (http://www.neo4j.com/)ACTED_INREVIEWEDREVIEWEDACTED_IN Keanu Reeves Tom Hanks The Repla… Jessica Thom… The Da Vinci Code \ No newline at end of file diff --git a/modules/ROOT/images/patterns-equijoin-reference.svg b/modules/ROOT/images/patterns-equijoin-reference.svg new file mode 100644 index 000000000..c8ae9a7f9 --- /dev/null +++ b/modules/ROOT/images/patterns-equijoin-reference.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoins-motif.svg b/modules/ROOT/images/patterns-equijoins-motif.svg new file mode 100644 index 000000000..eeb84153c --- /dev/null +++ b/modules/ROOT/images/patterns-equijoins-motif.svg @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoins-motif2.svg b/modules/ROOT/images/patterns-equijoins-motif2.svg new file mode 100644 index 000000000..5c2d34a68 --- /dev/null +++ b/modules/ROOT/images/patterns-equijoins-motif2.svg @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoins-solution2.svg b/modules/ROOT/images/patterns-equijoins-solution2.svg new file mode 100644 index 000000000..66d37acc8 --- /dev/null +++ b/modules/ROOT/images/patterns-equijoins-solution2.svg @@ -0,0 +1,100 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoins.svg b/modules/ROOT/images/patterns-equijoins.svg new file mode 100644 index 000000000..5729fbb6a --- /dev/null +++ b/modules/ROOT/images/patterns-equijoins.svg @@ -0,0 +1,118 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-motif1.svg b/modules/ROOT/images/patterns-qpp-motif1.svg new file mode 100644 index 000000000..94e9aa930 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-motif1.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-second-shortest-paths.svg b/modules/ROOT/images/patterns-second-shortest-paths.svg new file mode 100644 index 000000000..8345677fc --- /dev/null +++ b/modules/ROOT/images/patterns-second-shortest-paths.svg @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-shortest-graph.svg b/modules/ROOT/images/patterns-shortest-graph.svg new file mode 100644 index 000000000..a02e83e2b --- /dev/null +++ b/modules/ROOT/images/patterns-shortest-graph.svg @@ -0,0 +1,72 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-shortest-tie.svg b/modules/ROOT/images/patterns-shortest-tie.svg new file mode 100644 index 000000000..d0113abad --- /dev/null +++ b/modules/ROOT/images/patterns-shortest-tie.svg @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns_equijoins.svg b/modules/ROOT/images/patterns_equijoins.svg deleted file mode 100644 index 0a2c996be..000000000 --- a/modules/ROOT/images/patterns_equijoins.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ATCALLS_ATNEXTCALLS_ATCALLS_ATCALLS_ATNEXTNEXTCALLS_ATname:Coventrydeparts:15:54name:London Eustonname:Birmingham Int'ldeparts:08:40departs:14:45arrives:09:34departs:11:33departs:12:03 \ No newline at end of file diff --git a/modules/ROOT/images/patterns_equijoins_motif.svg b/modules/ROOT/images/patterns_equijoins_motif.svg deleted file mode 100644 index b67a84c16..000000000 --- a/modules/ROOT/images/patterns_equijoins_motif.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ATNEXTCALLS_ATCALLS_ATNEXTCALLS_ATname:Coventrynname:London Eustonname:London Euston \ No newline at end of file diff --git a/modules/ROOT/images/patterns_equijoins_motif2.svg b/modules/ROOT/images/patterns_equijoins_motif2.svg deleted file mode 100644 index 145afe3f7..000000000 --- a/modules/ROOT/images/patterns_equijoins_motif2.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ATNEXTCALLS_ATCALLS_ATNEXTCALLS_ATname:Coventrynname:London Eustonn \ No newline at end of file diff --git a/modules/ROOT/images/patterns_equijoins_motif3.svg b/modules/ROOT/images/patterns_equijoins_motif3.svg deleted file mode 100644 index 145afe3f7..000000000 --- a/modules/ROOT/images/patterns_equijoins_motif3.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ATNEXTCALLS_ATCALLS_ATNEXTCALLS_ATname:Coventrynname:London Eustonn \ No newline at end of file diff --git a/modules/ROOT/images/patterns_equijoins_solution.svg b/modules/ROOT/images/patterns_equijoins_solution.svg deleted file mode 100644 index b750a9c6e..000000000 --- a/modules/ROOT/images/patterns_equijoins_solution.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_equijoins_solution2.svg b/modules/ROOT/images/patterns_equijoins_solution2.svg deleted file mode 100644 index a199ab2f0..000000000 --- a/modules/ROOT/images/patterns_equijoins_solution2.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_qpp_motif1.svg b/modules/ROOT/images/patterns_qpp_motif1.svg deleted file mode 100644 index 513f6d125..000000000 --- a/modules/ROOT/images/patterns_qpp_motif1.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ ATCALLS_ATNEXTNEXTNEXTCallingPointCallingPointCallingPointCallingPoint \ No newline at end of file diff --git a/modules/ROOT/images/patterns_second_shortest_paths.svg b/modules/ROOT/images/patterns_second_shortest_paths.svg deleted file mode 100644 index 80b0db29f..000000000 --- a/modules/ROOT/images/patterns_second_shortest_paths.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_shortest_graph.svg b/modules/ROOT/images/patterns_shortest_graph.svg deleted file mode 100644 index 0f946e38e..000000000 --- a/modules/ROOT/images/patterns_shortest_graph.svg +++ /dev/null @@ -1 +0,0 @@ -6.030.655.763.715.646.1631.147.2511.2914.7512.64.16HartleburyDroitwichSpaWorcestershireParkwayPershoreWorcesterForegateStreetWorcesterShrub HillBromsgroveCheltenhamSpaAshchurch \ No newline at end of file diff --git a/modules/ROOT/images/patterns_shortest_graph_pattern1.svg b/modules/ROOT/images/patterns_shortest_graph_pattern1.svg deleted file mode 100644 index b1f8982bd..000000000 --- a/modules/ROOT/images/patterns_shortest_graph_pattern1.svg +++ /dev/null @@ -1 +0,0 @@ -DroitwichSpaWorcestershireParkwayWorcesterShrub HillBromsgroveCheltenhamSpa \ No newline at end of file diff --git a/modules/ROOT/images/patterns_shortest_graph_pattern2.svg b/modules/ROOT/images/patterns_shortest_graph_pattern2.svg deleted file mode 100644 index f19ab73aa..000000000 --- a/modules/ROOT/images/patterns_shortest_graph_pattern2.svg +++ /dev/null @@ -1 +0,0 @@ -DroitwichSpaWorcestershireParkwayWorcesterShrub HillBromsgroveCheltenhamSpa \ No newline at end of file diff --git a/modules/ROOT/images/patterns_shortest_tie.svg b/modules/ROOT/images/patterns_shortest_tie.svg deleted file mode 100644 index 99d2f9240..000000000 --- a/modules/ROOT/images/patterns_shortest_tie.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_shortestpath.svg b/modules/ROOT/images/patterns_shortestpath.svg deleted file mode 100644 index 2bb3d06ed..000000000 --- a/modules/ROOT/images/patterns_shortestpath.svg +++ /dev/null @@ -1 +0,0 @@ -Neo4j Graph VisualizationCreated using Neo4j (http://www.neo4j.com/)CALLS_ATNEXTCALLS_ATCALLS_ATNEXTCALLS_AT Clapham High Street Elephant Cas… "11:41:0… "11:37:0… Denmark Hill "11:47:0… "11:54:0… \ No newline at end of file diff --git a/modules/ROOT/images/predicate-function-example.svg b/modules/ROOT/images/predicate-function-example.svg new file mode 100644 index 000000000..7c0fe2032 --- /dev/null +++ b/modules/ROOT/images/predicate-function-example.svg @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/modules/ROOT/images/predicate_function_example.svg b/modules/ROOT/images/predicate_function_example.svg deleted file mode 100644 index 8b6919eb0..000000000 --- a/modules/ROOT/images/predicate_function_example.svg +++ /dev/null @@ -1 +0,0 @@ -Neo4j Graph VisualizationCreated using Neo4j (http://www.neo4j.com/)KNOWSKNOWS Keanu Reeves Guy Pearce Carrie Anne Moss \ No newline at end of file diff --git a/modules/ROOT/images/values-and-types-lists-graph.svg b/modules/ROOT/images/values-and-types-lists-graph.svg new file mode 100644 index 000000000..3fde574ac --- /dev/null +++ b/modules/ROOT/images/values-and-types-lists-graph.svg @@ -0,0 +1,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/values_and_types_lists_graph.svg b/modules/ROOT/images/values_and_types_lists_graph.svg deleted file mode 100644 index 8c71adee4..000000000 --- a/modules/ROOT/images/values_and_types_lists_graph.svg +++ /dev/null @@ -1 +0,0 @@ -ACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INMovietitle:'The Matrix Reloaded'released:2003Movietitle:'Johnny Mnemonic'released:1995Personname:'Keanu Reeves'Movietitle:'The Matrix'released:1999Movietitle:'The Matrix Revolutions'released:2003Movietitle:'The Matrix Resurrections'released:2021Movietitle:'The Replacements'released:2000Movietitle:'The Devil's Advocate'released:1997 \ No newline at end of file diff --git a/modules/ROOT/pages/clauses/call.adoc b/modules/ROOT/pages/clauses/call.adoc index 4431598e6..4f9b473dc 100644 --- a/modules/ROOT/pages/clauses/call.adoc +++ b/modules/ROOT/pages/clauses/call.adoc @@ -21,7 +21,7 @@ See link:{neo4j-docs-base-uri}/java-reference/current/extending-neo4j/procedures The following graph is used for the examples below: -image::call_procedure.svg[width="400",role="middle"] +image::call-procedure.svg[Example graph connecting people in the roles of developer and administrator,role=popup,width=400] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/limit.adoc b/modules/ROOT/pages/clauses/limit.adoc index 443012915..ae1f64d36 100644 --- a/modules/ROOT/pages/clauses/limit.adoc +++ b/modules/ROOT/pages/clauses/limit.adoc @@ -16,7 +16,7 @@ The only clause that guarantees a specific row order is xref:clauses/order-by.ad The following graph is used for the examples below: -image::graph_limit_clause.svg[width="600", role="middle"] +image::graph-limit-clause.svg[Example graph connecting Person nodes,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/match.adoc b/modules/ROOT/pages/clauses/match.adoc index 207483bde..e385744dd 100644 --- a/modules/ROOT/pages/clauses/match.adoc +++ b/modules/ROOT/pages/clauses/match.adoc @@ -11,7 +11,7 @@ The `MATCH` clause can specify the nodes, relationships, and properties in a pat The following graph is used for the examples below: -image::graph_match_clause.svg[width="500",role="middle"] +image::graph-match-clause.svg[Example graph connecting Person and Movie nodes,role=popup,width=600] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/merge.adoc b/modules/ROOT/pages/clauses/merge.adoc index afb4b7533..8e8067020 100644 --- a/modules/ROOT/pages/clauses/merge.adoc +++ b/modules/ROOT/pages/clauses/merge.adoc @@ -39,7 +39,7 @@ These allow a query to express additional changes to the properties of a node or The following graph is used for the examples below: -image::graph_merge_clause.svg[] +image::graph-merge-clause.svg[Example graph connecting Person and Movie nodes,role=popup,width=600] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/optional-match.adoc b/modules/ROOT/pages/clauses/optional-match.adoc index 44e2dba20..01db6c62a 100644 --- a/modules/ROOT/pages/clauses/optional-match.adoc +++ b/modules/ROOT/pages/clauses/optional-match.adoc @@ -23,7 +23,7 @@ To understand the patterns used in the `OPTIONAL MATCH` clause, read xref::patte The following graph is used for the examples below: -image::graph_optional_match_clause.svg[width="600",role="middle"] +image::graph-optional-match-clause.svg[Example graph connecting Person and Movie nodes,width=600,role=popup] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/order-by.adoc b/modules/ROOT/pages/clauses/order-by.adoc index 90ce90bb1..01e9a1956 100644 --- a/modules/ROOT/pages/clauses/order-by.adoc +++ b/modules/ROOT/pages/clauses/order-by.adoc @@ -19,7 +19,7 @@ Unless `ORDER BY` is used, Neo4j does not guarantee the row order of a query res The following graph is used for the examples below: -image::graph_order_by_clause.svg[width="600", role="middle"] +image::graph-order-by-clause.svg[Example graph connecting Person nodes,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/remove.adoc b/modules/ROOT/pages/clauses/remove.adoc index 3168bc8e3..5104b26b2 100644 --- a/modules/ROOT/pages/clauses/remove.adoc +++ b/modules/ROOT/pages/clauses/remove.adoc @@ -20,7 +20,7 @@ The query statistics will tell you if something needed to be done or not. The following graph is used for the examples below: -image::graph_remove_clause.svg[width="600", role="middle"] +image::graph-remove-clause.svg[Example graph connecting people after their nationality as nodes,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/set.adoc b/modules/ROOT/pages/clauses/set.adoc index f87390304..eec7df755 100644 --- a/modules/ROOT/pages/clauses/set.adoc +++ b/modules/ROOT/pages/clauses/set.adoc @@ -17,7 +17,7 @@ The query statistics will state whether any updates actually took place. The following graph is used for the examples below: -image::graph_set_clause.svg[[width="500", role="middle"] +image::graph-set-clause.svg[Example graph connecting people through know relationships,width=300,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/skip.adoc b/modules/ROOT/pages/clauses/skip.adoc index b4c4ecbee..5544f058e 100644 --- a/modules/ROOT/pages/clauses/skip.adoc +++ b/modules/ROOT/pages/clauses/skip.adoc @@ -17,7 +17,7 @@ The only clause that guarantees a specific row order is xref:clauses/order-by.ad The following graph is used for the examples below: -image::graph_skip_clause.svg[width="600", role="middle"] +image::graph-skip-clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/where.adoc b/modules/ROOT/pages/clauses/where.adoc index cf976e4b7..01ac8e202 100644 --- a/modules/ROOT/pages/clauses/where.adoc +++ b/modules/ROOT/pages/clauses/where.adoc @@ -20,7 +20,7 @@ For more uses of `WHERE`, see xref:expressions/predicates/index.adoc[]. The following graph is used for the examples below: -image::graph_where_clause.svg[width="700",role="middle"] +image::graph-where-clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/expressions/conditional-expressions.adoc b/modules/ROOT/pages/expressions/conditional-expressions.adoc index 8a775bcb6..87f134370 100644 --- a/modules/ROOT/pages/expressions/conditional-expressions.adoc +++ b/modules/ROOT/pages/expressions/conditional-expressions.adoc @@ -15,7 +15,7 @@ Two variants of `CASE` exist within Cypher: the _simple_ form, to compare a sing The following graph is used for the examples below: -image::case_graph.svg[width="400",role="middle"] +image::case-graph.svg[Example graph connecting Person nodes via knows relationships,width=400,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/functions/aggregating.adoc b/modules/ROOT/pages/functions/aggregating.adoc index af4f631f5..58be16e53 100644 --- a/modules/ROOT/pages/functions/aggregating.adoc +++ b/modules/ROOT/pages/functions/aggregating.adoc @@ -17,7 +17,7 @@ To learn more about how Cypher handles aggregations performed on zero rows, refe The following graph is used for the examples below: -image::graph_aggregating_functions.svg[role="middle", width="700"] +image::graph-aggregating-functions.svg[Graph example connecting Person and Movie nodes,role=popup,width=500] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/functions/list.adoc b/modules/ROOT/pages/functions/list.adoc index 7dc9e3fd7..e2dd64108 100644 --- a/modules/ROOT/pages/functions/list.adoc +++ b/modules/ROOT/pages/functions/list.adoc @@ -13,7 +13,7 @@ Further details and examples of lists may be found in xref::values-and-types/lis The following graph is used for the examples below: -image::graph_list_functions.svg[role="middle", width="700"] +image::graph-list-functions.svg[Example graph connecting people after their roles as administrator, designer, and developer,role=popup,width=600] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/functions/mathematical-numeric.adoc b/modules/ROOT/pages/functions/mathematical-numeric.adoc index fb0ecabe7..31af7c65e 100644 --- a/modules/ROOT/pages/functions/mathematical-numeric.adoc +++ b/modules/ROOT/pages/functions/mathematical-numeric.adoc @@ -12,7 +12,7 @@ See also xref::syntax/operators.adoc#query-operators-mathematical[Mathematical o The following graph is used for the examples below: -image::graph_numeric_functions.svg[role="middle", width="700"] +image::graph-numeric-functions.svg[Example graph connecting people people after their roles as administrator, designer, and developer,role=popup,width=600] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/functions/predicate.adoc b/modules/ROOT/pages/functions/predicate.adoc index 08e39bc8e..120c3f0f5 100644 --- a/modules/ROOT/pages/functions/predicate.adoc +++ b/modules/ROOT/pages/functions/predicate.adoc @@ -13,7 +13,7 @@ They are most commonly used to filter out paths in the `WHERE` part of a query. The following graph is used for the examples below: -image::graph_predicate_functions.svg[[width="600",role="middle"] +image::graph-predicate-functions.svg[Graph example connecting Person nodes among themselves and with a Movie node,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: @@ -75,7 +75,7 @@ RETURN p All nodes in the returned paths will have a property `age` with a value lower than `60`: -image::predicate_function_example.svg[width="300",role="middle"] +image::predicate-function-example.svg[Actor nodes connected via knows relationships,width=300,role=popup] .Result [role="queryresult",options="header,footer",cols="1* Date: Wed, 12 Mar 2025 10:40:48 +0100 Subject: [PATCH 02/32] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Jens Pryce-Ã…klundh <112686610+JPryce-Aklundh@users.noreply.github.com> --- modules/ROOT/pages/patterns/non-linear-patterns.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/patterns/non-linear-patterns.adoc b/modules/ROOT/pages/patterns/non-linear-patterns.adoc index eaf3845f0..97dfc23a6 100644 --- a/modules/ROOT/pages/patterns/non-linear-patterns.adoc +++ b/modules/ROOT/pages/patterns/non-linear-patterns.adoc @@ -42,7 +42,7 @@ image::patterns-equijoins-solution2.svg[Example graph showing a path with a cycl If unique properties exist on the node where the cycle "join" occurs in the path, then it is possible to repeat the node pattern with a predicate matching on the unique property. The following motif demonstrates how that can be achieved, repeating a `Station` node pattern with the name `London Euston`: -image::patterns-equijoins-motif.svg[Graph using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] +image::patterns-equijoins-motif.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] The path pattern equivalent is: @@ -57,7 +57,7 @@ There may be cases where a unique predicate is not available. In this case, an equijoin can be used to define the desired cycle by using a repeated node variable. In the current example, if you declare the same node variable `n` in both the first and last node patterns, then the node patterns _must_ match the same node: -image::patterns-equijoins-motif2.svg[Graph using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] +image::patterns-equijoins-motif2.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] Putting this path pattern with an equijoin in a query, the times of the outbound and return journeys can be returned: From 70485f62463bd3d0e78e723a4f83569858460991 Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 12 Mar 2025 10:50:08 +0100 Subject: [PATCH 03/32] Fixing line after review suggestion --- modules/ROOT/pages/queries/basic.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/queries/basic.adoc b/modules/ROOT/pages/queries/basic.adoc index 5352b8e95..78c7f6b74 100644 --- a/modules/ROOT/pages/queries/basic.adoc +++ b/modules/ROOT/pages/queries/basic.adoc @@ -678,7 +678,7 @@ RETURN type(r) AS type, m.title AS movie The result shows that he has 13 outgoing relationships connected to 12 different `Movie` nodes (12 have the `ACTED_IN` type and one has the `DIRECTED` type). -image::introduction-example1.svg[A Tom Hanks nodes connecting to Movie nodes via acted in relationships,width=600,role=popup] +image::introduction-example1.svg[A Tom Hanks Person node connecting to Movie nodes via acted in relationships,width=600,role=popup] .Result [role="queryresult",options="header,footer",cols="2* Date: Wed, 12 Mar 2025 14:24:57 +0100 Subject: [PATCH 04/32] reverting image --- modules/ROOT/images/graph-where-clause.svg | 15 --------------- modules/ROOT/images/graph_where_clause.svg | 1 + modules/ROOT/pages/clauses/where.adoc | 2 +- 3 files changed, 2 insertions(+), 16 deletions(-) delete mode 100644 modules/ROOT/images/graph-where-clause.svg create mode 100644 modules/ROOT/images/graph_where_clause.svg diff --git a/modules/ROOT/images/graph-where-clause.svg b/modules/ROOT/images/graph-where-clause.svg deleted file mode 100644 index 6a1b83c80..000000000 --- a/modules/ROOT/images/graph-where-clause.svg +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/graph_where_clause.svg b/modules/ROOT/images/graph_where_clause.svg new file mode 100644 index 000000000..b307c8355 --- /dev/null +++ b/modules/ROOT/images/graph_where_clause.svg @@ -0,0 +1 @@ +KNOWSsince:2012KNOWSsince:1999PersonSwedishname:'Andy'age:36belt:'white'Personname:'Timothy'age:25Personname:'Peter'age:35email:'peter_n@example.com' \ No newline at end of file diff --git a/modules/ROOT/pages/clauses/where.adoc b/modules/ROOT/pages/clauses/where.adoc index 01ac8e202..613232e36 100644 --- a/modules/ROOT/pages/clauses/where.adoc +++ b/modules/ROOT/pages/clauses/where.adoc @@ -20,7 +20,7 @@ For more uses of `WHERE`, see xref:expressions/predicates/index.adoc[]. The following graph is used for the examples below: -image::graph-where-clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] +image::graph_where_clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] To recreate the graph, run the following query in an empty Neo4j database: From 585dba3cdedafd17f9dee56a02c99efd8da12605 Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Thu, 20 Mar 2025 15:34:02 +0100 Subject: [PATCH 05/32] Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated --- modules/ROOT/.DS_Store | Bin 0 -> 8196 bytes .../images/cosine-similarity-equation.svg | 57 + .../images/cosine_similarity_equation.svg | 249 ---- .../images/euclidean-similarity-equation.svg | 38 + .../images/euclidean_similarity_equation.svg | 180 --- .../ROOT/images/graph-spatial-functions.svg | 10 + .../ROOT/images/graph_spatial_functions.svg | 1 - modules/ROOT/images/l2.svg | 40 +- modules/ROOT/images/l2norm-is-1.svg | 25 + modules/ROOT/images/l2norm_is_1.svg | 61 - modules/ROOT/images/path-pattern-motif.svg | 11 + .../ROOT/images/path-pattern-solutions.svg | 169 +++ modules/ROOT/images/path_pattern_motif.svg | 95 -- .../ROOT/images/path_pattern_solutions.svg | 9 - .../images/patterns-equijoin-reference.svg | 19 +- .../images/patterns-graph-patterns-graph1.svg | 151 +++ .../images/patterns-graph-patterns-graph2.svg | 103 ++ .../ROOT/images/patterns-qpp-illustration.svg | 7 + modules/ROOT/images/patterns-qpp-motif2.svg | 14 + .../images/patterns_equijoin_reference.svg | 9 - .../images/patterns_graph_patterns_graph1.svg | 1034 ----------------- .../images/patterns_graph_patterns_graph2.svg | 559 --------- .../ROOT/images/patterns_qpp_illustration.svg | 9 - modules/ROOT/images/patterns_qpp_motif2.svg | 1 - .../images/privileges-hierarchy-database.svg | 74 ++ .../ROOT/images/privileges-hierarchy-dbms.svg | 173 +++ modules/ROOT/images/privileges-hierarchy.svg | 47 + ...nt-and-deny-syntax-database-privileges.svg | 70 ++ ..._grant-and-deny-syntax-dbms-privileges.svg | 88 ++ ...nt_and_deny_syntax_database_privileges.svg | 99 -- ..._grant_and_deny_syntax_dbms_privileges.svg | 9 - modules/ROOT/images/privileges_hierarchy.svg | 9 - .../images/privileges_hierarchy_database.svg | 9 - .../ROOT/images/privileges_hierarchy_dbms.svg | 10 - .../type-predicate-expression-graph.svg | 11 + .../type_predicate_expression_graph.svg | 1 - ...values-and-types-converting-data-graph.svg | 10 + .../images/values-and-types-maps-graph.svg | 41 + ...values_and_types_converting_data_graph.svg | 1 - .../images/values_and_types_maps_graph.svg | 1 - .../type-predicate-expressions.adoc | 2 +- modules/ROOT/pages/functions/spatial.adoc | 2 +- .../semantic-indexes/vector-indexes.adoc | 4 +- .../pages/patterns/fixed-length-patterns.adoc | 4 +- .../pages/patterns/non-linear-patterns.adoc | 8 +- modules/ROOT/pages/patterns/reference.adoc | 36 +- .../patterns/variable-length-patterns.adoc | 4 +- .../pages/values-and-types/casting-data.adoc | 2 +- modules/ROOT/pages/values-and-types/maps.adoc | 2 +- 49 files changed, 1157 insertions(+), 2411 deletions(-) create mode 100644 modules/ROOT/.DS_Store create mode 100644 modules/ROOT/images/cosine-similarity-equation.svg delete mode 100644 modules/ROOT/images/cosine_similarity_equation.svg create mode 100644 modules/ROOT/images/euclidean-similarity-equation.svg delete mode 100644 modules/ROOT/images/euclidean_similarity_equation.svg create mode 100644 modules/ROOT/images/graph-spatial-functions.svg delete mode 100644 modules/ROOT/images/graph_spatial_functions.svg create mode 100644 modules/ROOT/images/l2norm-is-1.svg delete mode 100644 modules/ROOT/images/l2norm_is_1.svg create mode 100644 modules/ROOT/images/path-pattern-motif.svg create mode 100644 modules/ROOT/images/path-pattern-solutions.svg delete mode 100644 modules/ROOT/images/path_pattern_motif.svg delete mode 100644 modules/ROOT/images/path_pattern_solutions.svg create mode 100644 modules/ROOT/images/patterns-graph-patterns-graph1.svg create mode 100644 modules/ROOT/images/patterns-graph-patterns-graph2.svg create mode 100644 modules/ROOT/images/patterns-qpp-illustration.svg create mode 100644 modules/ROOT/images/patterns-qpp-motif2.svg delete mode 100644 modules/ROOT/images/patterns_equijoin_reference.svg delete mode 100644 modules/ROOT/images/patterns_graph_patterns_graph1.svg delete mode 100644 modules/ROOT/images/patterns_graph_patterns_graph2.svg delete mode 100644 modules/ROOT/images/patterns_qpp_illustration.svg delete mode 100644 modules/ROOT/images/patterns_qpp_motif2.svg create mode 100644 modules/ROOT/images/privileges-hierarchy-database.svg create mode 100644 modules/ROOT/images/privileges-hierarchy-dbms.svg create mode 100644 modules/ROOT/images/privileges-hierarchy.svg create mode 100644 modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg create mode 100644 modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg delete mode 100644 modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg delete mode 100644 modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg delete mode 100644 modules/ROOT/images/privileges_hierarchy.svg delete mode 100644 modules/ROOT/images/privileges_hierarchy_database.svg delete mode 100644 modules/ROOT/images/privileges_hierarchy_dbms.svg create mode 100644 modules/ROOT/images/type-predicate-expression-graph.svg delete mode 100644 modules/ROOT/images/type_predicate_expression_graph.svg create mode 100644 modules/ROOT/images/values-and-types-converting-data-graph.svg create mode 100644 modules/ROOT/images/values-and-types-maps-graph.svg delete mode 100644 modules/ROOT/images/values_and_types_converting_data_graph.svg delete mode 100644 modules/ROOT/images/values_and_types_maps_graph.svg diff --git a/modules/ROOT/.DS_Store b/modules/ROOT/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..7c5b1de36dcb2fde441e669938568fdd96c1cdcd GIT binary patch literal 8196 zcmeHMU2GIp6u#f|hgmwdQ>b=ZcfvwTkfxOKV_Fc*_D?C$7TDHq3sQD>#&&RartIu) z%a3tm;)@E#_@MEhCyhoP45;zN2Nlsrtq&OE15u;CV4^Q751u=BO6-=t8G|x6x%b<9 z?m73)J@-3vd!~#rbm#R=jD;CvGF6Uh6*V^~e4N)sMe-$Ogdlsy4CY#Hp(kZIsYTj> zAn-uofxrWS2LcZS9=I7iKzBAT@)GyH7!BIM1Azx_Ne}S%LzF7Vn2$w)-m8NeF9jeh zC$U%PH{}7IP1MJjk41r=Da|Re2l%G&Qw#`m8jo^y!kCXmfx?_Ym^1h*!_QFQtxk4P zPn{tqFlYl01RhxI0iL^8GLvOkl1(nm-^=2uY0GqT?d@MfDl4z3TqcK>S1Gq?qlvNc zgUW=uqF@>`L(@6avE2uZtV=kd*0@v7On=(3_hk(}KALu{e8zSs)Y^2?O6RR)&ginN zxOu`LS&f^{I+nH1aZNtWSR!Z4=J?p6p~SfBWOF^6EH#FWE(X^#h6Zw>REN|wHt4*@(tr1heb*(=A&SZNy5Z3`^BR zVx7)yiZ)sh{#W<-!ku-BmPk993~kZ%WnJBxc9<`_H|gevrVX1O>5{+peKa=iP9?L( z(2Q+led%tJdPhofZq%onIma6$Zw%5d#`ttyy6)|vG2Bq2#kCPx{X(8lRnsn*IXW0R zDuTQ#H^rWv^G>HJ)*?=+Y5uT0M>oaVML$HBfyOqoUbdGVVOe&Poo3Iov+O+kgk5A` zv2WQ=>?->mKqW$0jw;ll5zT1D-RM9kwxJtC*pCB<;}E7`;wW6q;sj3O6duPDcnYU+ z2G8MTyo%Rw7H{GmoW}*ciw|)LpW$`&t=lN8;4uu{$2gM_xyLl z?Q*pUu-osbkFIUmxV3X<*L5Na=FXG#?;+svenGT&y!Uuf!r3_yiOQ<^C@l@i5egV% zR_1Z5E)&{olxCR%My(Ltb;^2~LPf0<-PTB(Ou?y2URT)^*%G14uf|G*u@3FT?|ZQegT!#o z?-3lv1d>QWM+P>gag4Zr3XkAX6!93IB(9&q(|86i;6=QISMWOCAilqaw~6iV;eC97 zkMJ=r;!~gZ-w^A6#;+wz9$3g^{8q~3LOg3*jy*~8dG;?f33@k~2l(AjCCu~xzNNqa zdrCnQcp&h=|I-5~?~V6%)83YPZ}VI`O7#d;UbtRSpl3pjmyQ#9={Vu_e;Cs5D5-Lr cn2$w)B%$)Je+b}z#s~L*aQ}PkyLFqt01$opEC2ui literal 0 HcmV?d00001 diff --git a/modules/ROOT/images/cosine-similarity-equation.svg b/modules/ROOT/images/cosine-similarity-equation.svg new file mode 100644 index 000000000..748e6f3c5 --- /dev/null +++ b/modules/ROOT/images/cosine-similarity-equation.svg @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/cosine_similarity_equation.svg b/modules/ROOT/images/cosine_similarity_equation.svg deleted file mode 100644 index 200ec44dd..000000000 --- a/modules/ROOT/images/cosine_similarity_equation.svg +++ /dev/null @@ -1,249 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/euclidean-similarity-equation.svg b/modules/ROOT/images/euclidean-similarity-equation.svg new file mode 100644 index 000000000..6f6948729 --- /dev/null +++ b/modules/ROOT/images/euclidean-similarity-equation.svg @@ -0,0 +1,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/euclidean_similarity_equation.svg b/modules/ROOT/images/euclidean_similarity_equation.svg deleted file mode 100644 index a89f3e74c..000000000 --- a/modules/ROOT/images/euclidean_similarity_equation.svg +++ /dev/null @@ -1,180 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/graph-spatial-functions.svg b/modules/ROOT/images/graph-spatial-functions.svg new file mode 100644 index 000000000..39e5b05ba --- /dev/null +++ b/modules/ROOT/images/graph-spatial-functions.svg @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/modules/ROOT/images/graph_spatial_functions.svg b/modules/ROOT/images/graph_spatial_functions.svg deleted file mode 100644 index 180186928..000000000 --- a/modules/ROOT/images/graph_spatial_functions.svg +++ /dev/null @@ -1 +0,0 @@ -TRAVEL_ROUTETrainStationlatitude:55.672874longitude:12.564590city:'Copenhagen'Officelatitude:55.611784longitude:12.994341city:'Malmö' \ No newline at end of file diff --git a/modules/ROOT/images/l2.svg b/modules/ROOT/images/l2.svg index 922e8eb61..399aac66c 100644 --- a/modules/ROOT/images/l2.svg +++ b/modules/ROOT/images/l2.svg @@ -1,32 +1,16 @@ - - - - - - - - - - - - - - - - + + + + + + + + + - - + + + - - - - - - - - - - diff --git a/modules/ROOT/images/l2norm-is-1.svg b/modules/ROOT/images/l2norm-is-1.svg new file mode 100644 index 000000000..b10d51037 --- /dev/null +++ b/modules/ROOT/images/l2norm-is-1.svg @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/l2norm_is_1.svg b/modules/ROOT/images/l2norm_is_1.svg deleted file mode 100644 index ca0396b5e..000000000 --- a/modules/ROOT/images/l2norm_is_1.svg +++ /dev/null @@ -1,61 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/path-pattern-motif.svg b/modules/ROOT/images/path-pattern-motif.svg new file mode 100644 index 000000000..c04027bef --- /dev/null +++ b/modules/ROOT/images/path-pattern-motif.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/modules/ROOT/images/path-pattern-solutions.svg b/modules/ROOT/images/path-pattern-solutions.svg new file mode 100644 index 000000000..b9cccd9d2 --- /dev/null +++ b/modules/ROOT/images/path-pattern-solutions.svg @@ -0,0 +1,169 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/path_pattern_motif.svg b/modules/ROOT/images/path_pattern_motif.svg deleted file mode 100644 index 00298f29f..000000000 --- a/modules/ROOT/images/path_pattern_motif.svg +++ /dev/null @@ -1,95 +0,0 @@ - - - - - - - - - - - (:Stop) - (:Station {name: "Denmark Hill"}) - -[:CALLS_AT]-> - name: Denmark Hill - - - diff --git a/modules/ROOT/images/path_pattern_solutions.svg b/modules/ROOT/images/path_pattern_solutions.svg deleted file mode 100644 index a5b0efa9b..000000000 --- a/modules/ROOT/images/path_pattern_solutions.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns-equijoin-reference.svg b/modules/ROOT/images/patterns-equijoin-reference.svg index c8ae9a7f9..ae892dc5e 100644 --- a/modules/ROOT/images/patterns-equijoin-reference.svg +++ b/modules/ROOT/images/patterns-equijoin-reference.svg @@ -1,9 +1,12 @@ - - - - - - - - + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-graph-patterns-graph1.svg b/modules/ROOT/images/patterns-graph-patterns-graph1.svg new file mode 100644 index 000000000..1c5399ef3 --- /dev/null +++ b/modules/ROOT/images/patterns-graph-patterns-graph1.svg @@ -0,0 +1,151 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-graph-patterns-graph2.svg b/modules/ROOT/images/patterns-graph-patterns-graph2.svg new file mode 100644 index 000000000..eb7fa3908 --- /dev/null +++ b/modules/ROOT/images/patterns-graph-patterns-graph2.svg @@ -0,0 +1,103 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-illustration.svg b/modules/ROOT/images/patterns-qpp-illustration.svg new file mode 100644 index 000000000..5810702f3 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-illustration.svg @@ -0,0 +1,7 @@ + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-motif2.svg b/modules/ROOT/images/patterns-qpp-motif2.svg new file mode 100644 index 000000000..e65ae4861 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-motif2.svg @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns_equijoin_reference.svg b/modules/ROOT/images/patterns_equijoin_reference.svg deleted file mode 100644 index c8ae9a7f9..000000000 --- a/modules/ROOT/images/patterns_equijoin_reference.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_graph_patterns_graph1.svg b/modules/ROOT/images/patterns_graph_patterns_graph1.svg deleted file mode 100644 index 57af7e178..000000000 --- a/modules/ROOT/images/patterns_graph_patterns_graph1.svg +++ /dev/null @@ -1,1034 +0,0 @@ - - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - CALLS_AT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - - NEXT - - - - - - - - - - - - 11:17 - - - - - - - - - - - - 11:20 - - - - - - - - - - - - 11:39 - - - - - - - - - - - - Weeton - - - - - - - - - - - - 11:43 - - - - - - - - - - - - 11:45 - - - - - - - - - - - - Harrogate - - - - - - - - - - - - 11:45 - - - - - - - - - - - - Hornbeam Park - - - - - - - - - - - - Starbeck - - - - - - - - - - - - 11:11 - - - - - - - - - - - - 11:30 - - - - - - - - - - - - 11:20 - - - - - - - - - - - - Headingley - - - - - - - - - - - - Horsforth - - - - - - - - - - - - Burley Park - - - - - - - - - - - - Leeds - - - - - - - - - - - - 11:53 - - - - - - - - - - - - 12:05 - - - - - - - - - - - - 11:40 - - - - - - - - - - - - Pannal - - - - - - - - - - - - 11:25 - - - - - - - - - - - - Stop - - - - - - - - - - - - Station - - - - - - - - - - - - 11:25 - - - - - - - - - - - - 11:00 - - - - - - - - - - - - 11:50 - - - - - - - - - - - - 12:20 - - - - - - - - - - - - Huddersfield - - - - - - - - - - - - 12:07 - - - - - - - - - - - - 12:37 - - - - - - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_graph_patterns_graph2.svg b/modules/ROOT/images/patterns_graph_patterns_graph2.svg deleted file mode 100644 index 1ec5d1775..000000000 --- a/modules/ROOT/images/patterns_graph_patterns_graph2.svg +++ /dev/null @@ -1,559 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - b - - - - - - - - - - - - m - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - l - - - - - - - - - - - - n - - - - - - - - - - - - - - - - - sbe - - - - - - - - - - - - a - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - lds - - - - - - - - - - - - c - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - x - - - - - - - - - - - - - - - - - hud - - - - - - - - - - - - y - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_qpp_illustration.svg b/modules/ROOT/images/patterns_qpp_illustration.svg deleted file mode 100644 index 49c8c6902..000000000 --- a/modules/ROOT/images/patterns_qpp_illustration.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_qpp_motif2.svg b/modules/ROOT/images/patterns_qpp_motif2.svg deleted file mode 100644 index c46eece4a..000000000 --- a/modules/ROOT/images/patterns_qpp_motif2.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ ATCALLS_ATNEXTCallingPointCallingPoint \ No newline at end of file diff --git a/modules/ROOT/images/privileges-hierarchy-database.svg b/modules/ROOT/images/privileges-hierarchy-database.svg new file mode 100644 index 000000000..7d1010281 --- /dev/null +++ b/modules/ROOT/images/privileges-hierarchy-database.svg @@ -0,0 +1,74 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges-hierarchy-dbms.svg b/modules/ROOT/images/privileges-hierarchy-dbms.svg new file mode 100644 index 000000000..82449b516 --- /dev/null +++ b/modules/ROOT/images/privileges-hierarchy-dbms.svg @@ -0,0 +1,173 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges-hierarchy.svg b/modules/ROOT/images/privileges-hierarchy.svg new file mode 100644 index 000000000..e5a23185c --- /dev/null +++ b/modules/ROOT/images/privileges-hierarchy.svg @@ -0,0 +1,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg b/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg new file mode 100644 index 000000000..fafda3630 --- /dev/null +++ b/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg b/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg new file mode 100644 index 000000000..fb41882b8 --- /dev/null +++ b/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg deleted file mode 100644 index 4e0babc35..000000000 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg +++ /dev/null @@ -1,99 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg deleted file mode 100644 index f713d5d6f..000000000 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/privileges_hierarchy.svg b/modules/ROOT/images/privileges_hierarchy.svg deleted file mode 100644 index ce7ef40b1..000000000 --- a/modules/ROOT/images/privileges_hierarchy.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg deleted file mode 100644 index 0ccfd067d..000000000 --- a/modules/ROOT/images/privileges_hierarchy_database.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/privileges_hierarchy_dbms.svg b/modules/ROOT/images/privileges_hierarchy_dbms.svg deleted file mode 100644 index 025c39d36..000000000 --- a/modules/ROOT/images/privileges_hierarchy_dbms.svg +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - diff --git a/modules/ROOT/images/type-predicate-expression-graph.svg b/modules/ROOT/images/type-predicate-expression-graph.svg new file mode 100644 index 000000000..9d9ad4edd --- /dev/null +++ b/modules/ROOT/images/type-predicate-expression-graph.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/modules/ROOT/images/type_predicate_expression_graph.svg b/modules/ROOT/images/type_predicate_expression_graph.svg deleted file mode 100644 index 200d41d07..000000000 --- a/modules/ROOT/images/type_predicate_expression_graph.svg +++ /dev/null @@ -1 +0,0 @@ -Personname:'Alice'age:18Personname:'Bob'age:'20'Personname:'Charlie'age:21 \ No newline at end of file diff --git a/modules/ROOT/images/values-and-types-converting-data-graph.svg b/modules/ROOT/images/values-and-types-converting-data-graph.svg new file mode 100644 index 000000000..74ff99b1d --- /dev/null +++ b/modules/ROOT/images/values-and-types-converting-data-graph.svg @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/modules/ROOT/images/values-and-types-maps-graph.svg b/modules/ROOT/images/values-and-types-maps-graph.svg new file mode 100644 index 000000000..4812b4f20 --- /dev/null +++ b/modules/ROOT/images/values-and-types-maps-graph.svg @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/values_and_types_converting_data_graph.svg b/modules/ROOT/images/values_and_types_converting_data_graph.svg deleted file mode 100644 index 97ce2ecff..000000000 --- a/modules/ROOT/images/values_and_types_converting_data_graph.svg +++ /dev/null @@ -1 +0,0 @@ -KNOWSsince:1999Personname:'Keanu Reeves'age:58active:truePersonname:'Carrie-Anne Moss'age:55active:true \ No newline at end of file diff --git a/modules/ROOT/images/values_and_types_maps_graph.svg b/modules/ROOT/images/values_and_types_maps_graph.svg deleted file mode 100644 index 9d0bef557..000000000 --- a/modules/ROOT/images/values_and_types_maps_graph.svg +++ /dev/null @@ -1 +0,0 @@ -ACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INACTED_INMovietitle:'The Matrix Reloaded'released:2003Personname:'Keanu Reeves'nationality:'Canadian'Movietitle:'The Matrix'released:1999Movietitle:'The Matrix Revolutions'released:2003Movietitle:'The Matrix Resurrections'released:2021Movietitle:'The Devil's Advocate'released:1997Personname:'Carrie-Anne Moss' \ No newline at end of file diff --git a/modules/ROOT/pages/expressions/predicates/type-predicate-expressions.adoc b/modules/ROOT/pages/expressions/predicates/type-predicate-expressions.adoc index ae276e739..25cee3c81 100644 --- a/modules/ROOT/pages/expressions/predicates/type-predicate-expressions.adoc +++ b/modules/ROOT/pages/expressions/predicates/type-predicate-expressions.adoc @@ -149,7 +149,7 @@ CREATE ---- //// -image::type_predicate_expression_graph.svg[] +image::type-predicate-expression-graph.svg[Example graph with three nodes for three different people,width=400,role=popup] The following query finds all `Person` nodes with an `age` property that is an `INTEGER` with a value greater than `18`. diff --git a/modules/ROOT/pages/functions/spatial.adoc b/modules/ROOT/pages/functions/spatial.adoc index 3c9cce94d..86fdc2bef 100644 --- a/modules/ROOT/pages/functions/spatial.adoc +++ b/modules/ROOT/pages/functions/spatial.adoc @@ -11,7 +11,7 @@ Spatial functions are used to specify 2D or 3D `POINT` values in a Coordinate Re The following graph is used for some of the examples below. -image::graph_spatial_functions.svg[role="middle", width="500"] +image::graph-spatial-functions.svg[Example graph connecting a train station node to an office node via a travel route relationship,role=popup,width=600] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc b/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc index 6322ff0ce..798acc01f 100644 --- a/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc +++ b/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc @@ -439,7 +439,7 @@ However, an angle can be described in many units, sign conventions, and periods. The trigonometric cosine of this angle is both agnostic to the aforementioned angle conventions and bounded. Cosine similarity rebounds the trigonometric cosine. -image::cosine_similarity_equation.svg["The cosine of vector v and vector u is defined as half of the quanity 1 plus the scalar product of v hat u hat, which equals half of the quantity 1 plus the scalar product of vector v vector u over the product of the l2-norm of vector v and the l2 norm ov vector u, which exists in the bounded set of real numbers between 0 inclusive and 1 inclusive."] +image::cosine-similarity-equation.svg["The cosine of vector v and vector u is defined as half of the quanity 1 plus the scalar product of v hat u hat, which equals half of the quantity 1 plus the scalar product of vector v vector u over the product of the l2-norm of vector v and the l2 norm ov vector u, which exists in the bounded set of real numbers between 0 inclusive and 1 inclusive."] In the above equation the trigonometric cosine is given by the scalar product of the two unit vectors. ==== @@ -455,7 +455,7 @@ The measure is related to the Euclidean distance, i.e., how far two points are f However, that distance is unbounded and less useful as a similarity score. Euclidean similarity bounds the square of the Euclidean distance. -image::euclidean_similarity_equation.svg["The Euclidean of vector v and vector u is defined as 1 over the quantity 1 plus the square of the l2-norm of vector v subtract vector u, which exists in the bounded set of real numbers between 0 exclusive and 1 inclusive."] +image::euclidean-similarity-equation.svg["The Euclidean of vector v and vector u is defined as 1 over the quantity 1 plus the square of the l2-norm of vector v subtract vector u, which exists in the bounded set of real numbers between 0 exclusive and 1 inclusive."] ==== [[procedures]] diff --git a/modules/ROOT/pages/patterns/fixed-length-patterns.adoc b/modules/ROOT/pages/patterns/fixed-length-patterns.adoc index bd1ac5799..7b8ecd4da 100644 --- a/modules/ROOT/pages/patterns/fixed-length-patterns.adoc +++ b/modules/ROOT/pages/patterns/fixed-length-patterns.adoc @@ -194,11 +194,11 @@ Each of these services calls at the `Station` with the name `Denmark Hill`. To return all `Stops` that call at the `Station` `Denmark Hill`, the following _motif_ is used (the term motif is used to describe the pattern looked for in the graph): -image::path_pattern_motif.svg[width="600",role="middle"] +image::path-pattern-motif.svg[Motif showing how a query to retrieve all stops nodes that are connected to the station node Denmark Hill via a calls at relationship,width=600,role=popup] In this case, three paths in the graph match the structure of the motif (plus the predicate anchoring to the `Station` `Denmark Hill`): -image::path_pattern_solutions.svg[width="700",role="middle"] +image::path-pattern-solutions.svg[Graphic representation of the structure of the previously mentioned motif,width=600,role=popup] In order to return the name of each `Stop` that calls at a `Station`, declare a variable in the `Stop` node pattern. The results will then have a row containing the departs value of each `Stop` for each match shown above: diff --git a/modules/ROOT/pages/patterns/non-linear-patterns.adoc b/modules/ROOT/pages/patterns/non-linear-patterns.adoc index 97dfc23a6..f7ff89e06 100644 --- a/modules/ROOT/pages/patterns/non-linear-patterns.adoc +++ b/modules/ROOT/pages/patterns/non-linear-patterns.adoc @@ -37,7 +37,7 @@ The graph has three different services, two of which would compose the desired r The solution is the following path with a cycle: -image::patterns-equijoins-solution2.svg[Example graph showing a path with a cycle,width=600,role=popup] +image::patterns-equijoins-solution2.svg[Example graph showing a path with a cycle,width=400,role=popup] If unique properties exist on the node where the cycle "join" occurs in the path, then it is possible to repeat the node pattern with a predicate matching on the unique property. The following motif demonstrates how that can be achieved, repeating a `Station` node pattern with the name `London Euston`: @@ -106,7 +106,7 @@ Deletes the graph used in the previous example. This section uses the following graph, showing the train services the passenger can use: -image::patterns_graph_patterns_graph1.svg[width="400", role="middle"] +image::patterns-graph-patterns-graph1.svg[Graph showing the train services the passenger can use,width=400,role=popup] To recreate the graph, run the following query against an empty Neo4j database: @@ -142,9 +142,9 @@ The solution to the problem assembles a set of path patterns matching the follow Each changeover, from stopping to express service and from express to onward service, has to respect the fact that the arrival time of a previous leg has to be before the departure time of the next leg. This will be encoded in a single `WHERE` clause. -The following visualizes the three legs with different colors, and identifies the node variables used to create the equijoins and anchoring: +The following image visualizes the three legs with different colors, and identifies the node variables used to create the equijoins and anchoring: -image::patterns_graph_patterns_graph2.svg[width="300", role="middle"] +image::patterns-graph-patterns-graph2.svg[Graph showing three legs with different colors, and node variables used to create equijoins and anchoring,width=400,role=popup] For the stopping service, it is assumed that the station the passenger needs to change at is unknown. As a result, the pattern needs to match a variable number of stops before and after the `Stop` `b`, the `Stop` that calls at the changeover station `l`. diff --git a/modules/ROOT/pages/patterns/reference.adoc b/modules/ROOT/pages/patterns/reference.adoc index c469e8529..59e4d3070 100644 --- a/modules/ROOT/pages/patterns/reference.adoc +++ b/modules/ROOT/pages/patterns/reference.adoc @@ -2,6 +2,12 @@ [[syntax-and-semantics]] = Syntax and semantics +//Check Mark +:check-mark: icon:check[] + +//Cross Mark +:cross-mark: icon:times[] + This section contains reference material for looking up the syntax and semantics of specific elements of graph pattern matching. [[node-patterns]] @@ -252,37 +258,37 @@ In the following table, a tick is shown where the label expression matches the n |`(:B:C)` |`(:A:B:C)` -|`()` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ +|`()` | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} -|`(:A)` | | ✅ | | | ✅ | ✅ | | ✅ +|`(:A)` | | {check-mark} | | | {check-mark} | {check-mark} | | {check-mark} -|`(:A&B)` | | | | | ✅ | | | ✅ +|`(:A&B)` | | | | | {check-mark} | | | {check-mark} -|`(:A|B)` | | ✅ | ✅ | | ✅ | ✅ | ✅ | ✅ +|`(:A|B)` | | {check-mark} | {check-mark} | | {check-mark} | {check-mark} | {check-mark} | {check-mark} -|`(:!A)` | ✅ | | ✅ | ✅| | | ✅ | +|`(:!A)` | {check-mark} | | {check-mark} | {check-mark}| | | {check-mark} | -|`(:!!A)` | | ✅ | | | ✅ | ✅ | | ✅ +|`(:!!A)` | | {check-mark} | | | {check-mark} | {check-mark} | | {check-mark} |`(:A&!A)` | | | | | | | | -| `(:A|!A)` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ +| `(:A|!A)` | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} -|`(:%)` | | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ +|`(:%)` | | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} -|`(:!%)` | ✅ | | | | | | | +|`(:!%)` | {check-mark} | | | | | | | -|`(:%|!%)` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ +|`(:%|!%)` | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | `(:%&!%)` | | | | | | | | -| `(:A&%)` | | ✅ | | | ✅ | ✅ | | ✅ +| `(:A&%)` | | {check-mark} | | | {check-mark} | {check-mark} | | {check-mark} -| `(:A|%)` | | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ +| `(:A|%)` | | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} | {check-mark} -| `(:(A&B)&!(B&C))` | | | | | ✅ | | | +| `(:(A&B)&!(B&C))` | | | | | {check-mark} | | | -| `(:!A&%)` | | | ✅ | ✅ | | | ✅ | +| `(:!A&%)` | | | {check-mark} | {check-mark} | | | {check-mark} | |=== @@ -954,7 +960,7 @@ This is the same as the xref:patterns/reference.adoc#graph-patterns-rules-equijo This section uses the following graph: -image::patterns_equijoin_reference.svg[width="500", role="middle"] +image::patterns-equijoin-reference.svg[Example of nodes with equijoins,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/patterns/variable-length-patterns.adoc b/modules/ROOT/pages/patterns/variable-length-patterns.adoc index 2e1e81675..425d609d5 100644 --- a/modules/ROOT/pages/patterns/variable-length-patterns.adoc +++ b/modules/ROOT/pages/patterns/variable-length-patterns.adoc @@ -57,7 +57,7 @@ image::patterns-qpp-motif1.svg[Example of a fixed-length path pattern that match To match the second train service, leaving `Denmark Hill` at `17:10`, a shorter path pattern is needed: -image::patterns_qpp_motif2.svg[width="400",role="middle"] +image::patterns-qpp-motif2.svg[Example of a shorter path pattern using the London railway dataset,width=600,role=popup] Translating the motifs into Cypher, and adding predicates to match the origin and destination `Stations`, yields the following two path patterns respectively: @@ -143,7 +143,7 @@ Where two node patterns are next to each other in the expansion above, they must As such they can be rewritten as a single node pattern with any filtering condition combined conjunctively. In this example this is trivial, because the filtering applied to those nodes is just the label `Stop`: -image::patterns_qpp_illustration.svg[width="400",role="middle"] +image::patterns-qpp-illustration.svg[Cypher statement showing how the query can be rewritten as a single node pattern with any filtering condition combined conjunctively,width=600,role=popup] With this, the union of path patterns simplifies to: diff --git a/modules/ROOT/pages/values-and-types/casting-data.adoc b/modules/ROOT/pages/values-and-types/casting-data.adoc index d53a0153d..818b8c917 100644 --- a/modules/ROOT/pages/values-and-types/casting-data.adoc +++ b/modules/ROOT/pages/values-and-types/casting-data.adoc @@ -53,7 +53,7 @@ More information about these, and many other functions, can be found in the sect The following graph is used for the examples below: -image::values_and_types_converting_data_graph.svg[] +image::values-and-types-converting-data-graph.svg[width=400,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/values-and-types/maps.adoc b/modules/ROOT/pages/values-and-types/maps.adoc index a3e005a04..01ccffe79 100644 --- a/modules/ROOT/pages/values-and-types/maps.adoc +++ b/modules/ROOT/pages/values-and-types/maps.adoc @@ -69,7 +69,7 @@ The following conditions apply: The following graph is used for the examples below: -image::values_and_types_maps_graph.svg[] +image::values-and-types-maps-graph.svg[Example graph connecting person nodes to movie nodes via acted in relationships,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: From 1f9ec934ed6437ffea9fcbc13e988f1d02cda106 Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 2 Apr 2025 12:23:42 +0200 Subject: [PATCH 06/32] Final batch of updated images --- modules/ROOT/images/call-subquery-graph.svg | 12 + modules/ROOT/images/call_subquery_graph.svg | 9 - modules/ROOT/images/full-text-graph.svg | 18 ++ modules/ROOT/images/full_text_graph.svg | 1 - modules/ROOT/images/genai-graph.svg | 17 ++ modules/ROOT/images/genai_graph.svg | 9 - modules/ROOT/images/graph-delete-clause.svg | 23 ++ modules/ROOT/images/graph-foreach-clause.svg | 20 ++ modules/ROOT/images/graph-return-clause.svg | 12 + modules/ROOT/images/graph-with-clause.svg | 24 ++ modules/ROOT/images/graph1.svg | 81 ------- modules/ROOT/images/graph2.svg | 51 ----- modules/ROOT/images/graph4.svg | 91 -------- modules/ROOT/images/graph_delete_clause.svg | 1 - modules/ROOT/images/graph_foreach_clause.svg | 66 ------ .../ROOT/images/graph_label_expressions.svg | 75 ------- .../graph_relationship_type_expressions.svg | 85 -------- modules/ROOT/images/graph_return_clause.svg | 9 - modules/ROOT/images/graph_with_clause.svg | 85 -------- modules/ROOT/images/introduction-schema.svg | 20 ++ modules/ROOT/images/introduction_schema.svg | 9 - .../images/path-pattern-example-graph.svg | 206 ++++++++++++++++++ .../images/path_pattern_example_graph.svg | 1 - .../patterns-graph-pattern-reference.svg | 11 + .../images/patterns-group-variables-graph.svg | 85 ++++++++ .../patterns-group-variables-graph2.svg | 73 +++++++ .../patterns-group-variables-graph3.svg | 46 ++++ .../images/patterns-node-pattern-pairs.svg | 24 ++ modules/ROOT/images/patterns-primer.svg | 133 +++++++++++ .../images/patterns-qpp-calling-points.svg | 90 ++++++++ .../ROOT/images/patterns-qpp-predicates.svg | 86 ++++++++ .../images/patterns-qpp-query-breakdown.svg | 11 + .../images/patterns-qpp-reference-example.svg | 28 +++ .../ROOT/images/patterns-qpp-reference.svg | 11 + .../ROOT/images/patterns-qpp-solutions.svg | 104 +++++++++ .../patterns_graph_pattern_reference.svg | 9 - .../images/patterns_group_variables_graph.svg | 1 - .../patterns_group_variables_graph2.svg | 1 - .../patterns_group_variables_graph3.svg | 1 - .../images/patterns_node_pattern_pairs.svg | 9 - modules/ROOT/images/patterns_primer.svg | 1 - .../images/patterns_qpp_calling_points.svg | 1 - .../ROOT/images/patterns_qpp_predicates.svg | 1 - .../images/patterns_qpp_query_breakdown.svg | 9 - .../ROOT/images/patterns_qpp_reference.svg | 9 - .../images/patterns_qpp_reference_example.svg | 9 - .../ROOT/images/patterns_qpp_solutions.svg | 14 -- .../privileges_grant_and_deny_syntax.svg | 1 - ..._grant_and_deny_syntax_load_privileges.svg | 1 - .../images/privileges_on_graph_syntax.svg | 1 - .../ROOT/images/runtimes-cypher-lifecycle.svg | 30 +++ .../ROOT/images/runtimes-execution-graph1.svg | 91 ++++++++ .../ROOT/images/runtimes-execution-graph2.svg | 191 ++++++++++++++++ .../ROOT/images/runtimes_cypher_lifecycle.svg | 41 ---- .../ROOT/images/runtimes_execution_graph1.svg | 9 - .../ROOT/images/runtimes_execution_graph2.svg | 9 - modules/ROOT/images/subqueries-graph.svg | 36 +++ modules/ROOT/images/subqueries_graph.svg | 1 - .../images/using-indexes-example-graph.svg | 14 ++ .../images/using_indexes_example_graph.svg | 9 - modules/ROOT/images/vector-index-graph.svg | 17 ++ modules/ROOT/images/vector_index_graph.svg | 9 - modules/ROOT/pages/clauses/delete.adoc | 2 +- modules/ROOT/pages/clauses/foreach.adoc | 2 +- modules/ROOT/pages/clauses/return.adoc | 2 +- modules/ROOT/pages/clauses/with.adoc | 2 +- modules/ROOT/pages/genai-integrations.adoc | 2 +- .../using-indexes.adoc | 2 +- .../semantic-indexes/full-text-indexes.adoc | 2 +- .../semantic-indexes/vector-indexes.adoc | 2 +- .../pages/patterns/fixed-length-patterns.adoc | 2 +- .../pages/patterns/non-linear-patterns.adoc | 6 +- modules/ROOT/pages/patterns/primer.adoc | 2 +- modules/ROOT/pages/patterns/reference.adoc | 8 +- .../patterns/variable-length-patterns.adoc | 14 +- .../planning-and-tuning/execution-plans.adoc | 6 +- .../runtimes/concepts.adoc | 6 +- modules/ROOT/pages/queries/basic.adoc | 2 +- .../ROOT/pages/subqueries/call-subquery.adoc | 2 +- modules/ROOT/pages/subqueries/collect.adoc | 2 +- modules/ROOT/pages/subqueries/count.adoc | 2 +- .../ROOT/pages/subqueries/existential.adoc | 2 +- 82 files changed, 1468 insertions(+), 754 deletions(-) create mode 100644 modules/ROOT/images/call-subquery-graph.svg delete mode 100644 modules/ROOT/images/call_subquery_graph.svg create mode 100644 modules/ROOT/images/full-text-graph.svg delete mode 100644 modules/ROOT/images/full_text_graph.svg create mode 100644 modules/ROOT/images/genai-graph.svg delete mode 100644 modules/ROOT/images/genai_graph.svg create mode 100644 modules/ROOT/images/graph-delete-clause.svg create mode 100644 modules/ROOT/images/graph-foreach-clause.svg create mode 100644 modules/ROOT/images/graph-return-clause.svg create mode 100644 modules/ROOT/images/graph-with-clause.svg delete mode 100644 modules/ROOT/images/graph1.svg delete mode 100644 modules/ROOT/images/graph2.svg delete mode 100644 modules/ROOT/images/graph4.svg delete mode 100644 modules/ROOT/images/graph_delete_clause.svg delete mode 100644 modules/ROOT/images/graph_foreach_clause.svg delete mode 100644 modules/ROOT/images/graph_label_expressions.svg delete mode 100644 modules/ROOT/images/graph_relationship_type_expressions.svg delete mode 100644 modules/ROOT/images/graph_return_clause.svg delete mode 100644 modules/ROOT/images/graph_with_clause.svg create mode 100644 modules/ROOT/images/introduction-schema.svg delete mode 100644 modules/ROOT/images/introduction_schema.svg create mode 100644 modules/ROOT/images/path-pattern-example-graph.svg delete mode 100644 modules/ROOT/images/path_pattern_example_graph.svg create mode 100644 modules/ROOT/images/patterns-graph-pattern-reference.svg create mode 100644 modules/ROOT/images/patterns-group-variables-graph.svg create mode 100644 modules/ROOT/images/patterns-group-variables-graph2.svg create mode 100644 modules/ROOT/images/patterns-group-variables-graph3.svg create mode 100644 modules/ROOT/images/patterns-node-pattern-pairs.svg create mode 100644 modules/ROOT/images/patterns-primer.svg create mode 100644 modules/ROOT/images/patterns-qpp-calling-points.svg create mode 100644 modules/ROOT/images/patterns-qpp-predicates.svg create mode 100644 modules/ROOT/images/patterns-qpp-query-breakdown.svg create mode 100644 modules/ROOT/images/patterns-qpp-reference-example.svg create mode 100644 modules/ROOT/images/patterns-qpp-reference.svg create mode 100644 modules/ROOT/images/patterns-qpp-solutions.svg delete mode 100644 modules/ROOT/images/patterns_graph_pattern_reference.svg delete mode 100644 modules/ROOT/images/patterns_group_variables_graph.svg delete mode 100644 modules/ROOT/images/patterns_group_variables_graph2.svg delete mode 100644 modules/ROOT/images/patterns_group_variables_graph3.svg delete mode 100644 modules/ROOT/images/patterns_node_pattern_pairs.svg delete mode 100644 modules/ROOT/images/patterns_primer.svg delete mode 100644 modules/ROOT/images/patterns_qpp_calling_points.svg delete mode 100644 modules/ROOT/images/patterns_qpp_predicates.svg delete mode 100644 modules/ROOT/images/patterns_qpp_query_breakdown.svg delete mode 100644 modules/ROOT/images/patterns_qpp_reference.svg delete mode 100644 modules/ROOT/images/patterns_qpp_reference_example.svg delete mode 100644 modules/ROOT/images/patterns_qpp_solutions.svg delete mode 100644 modules/ROOT/images/privileges_grant_and_deny_syntax.svg delete mode 100644 modules/ROOT/images/privileges_grant_and_deny_syntax_load_privileges.svg delete mode 100644 modules/ROOT/images/privileges_on_graph_syntax.svg create mode 100644 modules/ROOT/images/runtimes-cypher-lifecycle.svg create mode 100644 modules/ROOT/images/runtimes-execution-graph1.svg create mode 100644 modules/ROOT/images/runtimes-execution-graph2.svg delete mode 100644 modules/ROOT/images/runtimes_cypher_lifecycle.svg delete mode 100644 modules/ROOT/images/runtimes_execution_graph1.svg delete mode 100644 modules/ROOT/images/runtimes_execution_graph2.svg create mode 100644 modules/ROOT/images/subqueries-graph.svg delete mode 100644 modules/ROOT/images/subqueries_graph.svg create mode 100644 modules/ROOT/images/using-indexes-example-graph.svg delete mode 100644 modules/ROOT/images/using_indexes_example_graph.svg create mode 100644 modules/ROOT/images/vector-index-graph.svg delete mode 100644 modules/ROOT/images/vector_index_graph.svg diff --git a/modules/ROOT/images/call-subquery-graph.svg b/modules/ROOT/images/call-subquery-graph.svg new file mode 100644 index 000000000..5604bea31 --- /dev/null +++ b/modules/ROOT/images/call-subquery-graph.svg @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/modules/ROOT/images/call_subquery_graph.svg b/modules/ROOT/images/call_subquery_graph.svg deleted file mode 100644 index 932cf79da..000000000 --- a/modules/ROOT/images/call_subquery_graph.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/full-text-graph.svg b/modules/ROOT/images/full-text-graph.svg new file mode 100644 index 000000000..a301543f5 --- /dev/null +++ b/modules/ROOT/images/full-text-graph.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/full_text_graph.svg b/modules/ROOT/images/full_text_graph.svg deleted file mode 100644 index bfae87e68..000000000 --- a/modules/ROOT/images/full_text_graph.svg +++ /dev/null @@ -1 +0,0 @@ -EMAILEDmessage:'I have booked a team meeting tomorrow'REVIEWEDmessage:'Nils-Erik is reportedly difficult to work with.'Employeename:'Maya Tanaka'position:'Senior Engineer'team:'Operations'Managername:'Lisa Danielsson'position:'Engineering manager'Employeename:'Nils-Erik Karlsson'position:'Engineer'team:'Kernel'peerReviews:['Nils-Erik is difficult to work with.', 'Nils-Erik is often late for work.']Employeename:'Nils Johansson'position:'Engineer'team:'Operations' \ No newline at end of file diff --git a/modules/ROOT/images/genai-graph.svg b/modules/ROOT/images/genai-graph.svg new file mode 100644 index 000000000..7d26bd9b4 --- /dev/null +++ b/modules/ROOT/images/genai-graph.svg @@ -0,0 +1,17 @@ + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/genai_graph.svg b/modules/ROOT/images/genai_graph.svg deleted file mode 100644 index 3caef2038..000000000 --- a/modules/ROOT/images/genai_graph.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/graph-delete-clause.svg b/modules/ROOT/images/graph-delete-clause.svg new file mode 100644 index 000000000..a8f6861d6 --- /dev/null +++ b/modules/ROOT/images/graph-delete-clause.svg @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-foreach-clause.svg b/modules/ROOT/images/graph-foreach-clause.svg new file mode 100644 index 000000000..ff5eefa5d --- /dev/null +++ b/modules/ROOT/images/graph-foreach-clause.svg @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-return-clause.svg b/modules/ROOT/images/graph-return-clause.svg new file mode 100644 index 000000000..8199fe6d6 --- /dev/null +++ b/modules/ROOT/images/graph-return-clause.svg @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-with-clause.svg b/modules/ROOT/images/graph-with-clause.svg new file mode 100644 index 000000000..39691d659 --- /dev/null +++ b/modules/ROOT/images/graph-with-clause.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph1.svg b/modules/ROOT/images/graph1.svg deleted file mode 100644 index a1374a53e..000000000 --- a/modules/ROOT/images/graph1.svg +++ /dev/null @@ -1,81 +0,0 @@ - - - - - - -L - - - -N0 - -Person - -name = 'John' - - - -N3 - -Person - -name = 'Sara' - - - -N0->N3 - - -FRIEND - - - -N1 - -Person - -name = 'Joe' - - - -N0->N1 - - -FRIEND - - - -N4 - -Person - -name = 'Maria' - - - -N3->N4 - - -FRIEND - - - -N2 - -Person - -name = 'Steve' - - - -N1->N2 - - -FRIEND - - - diff --git a/modules/ROOT/images/graph2.svg b/modules/ROOT/images/graph2.svg deleted file mode 100644 index 104947143..000000000 --- a/modules/ROOT/images/graph2.svg +++ /dev/null @@ -1,51 +0,0 @@ - - - - - - -L - - - -N0 - -User - -name = 'Adam' - - - -N1 - -User - -name = 'Pernilla' - - - -N0->N1 - - -FRIEND - - - -N2 - -User - -name = 'David' - - - -N1->N2 - - -FRIEND - - - diff --git a/modules/ROOT/images/graph4.svg b/modules/ROOT/images/graph4.svg deleted file mode 100644 index 91242d043..000000000 --- a/modules/ROOT/images/graph4.svg +++ /dev/null @@ -1,91 +0,0 @@ - - - - - - -L - - - -N0 - -name = 'Anders' - - - -N3 - -name = 'Dilshad' - - - -N0->N3 - - -KNOWS - - - -N2 - -name = 'Cesar' - - - -N0->N2 - - -KNOWS - - - -N1 - -name = 'Becky' - - - -N0->N1 - - -KNOWS - - - -N5 - -name = 'Filipa' - - - -N3->N5 - - -KNOWS - - - -N4 - -name = 'George' - - - -N2->N4 - - -KNOWS - - - -N1->N4 - - -KNOWS - - - diff --git a/modules/ROOT/images/graph_delete_clause.svg b/modules/ROOT/images/graph_delete_clause.svg deleted file mode 100644 index d24257759..000000000 --- a/modules/ROOT/images/graph_delete_clause.svg +++ /dev/null @@ -1 +0,0 @@ -ACTED_INACTED_INACTED_INPersonname:Keanu ReevesPersonname:Laurence FishburneMovietitle:The MatrixPersonname:Carrie-Anne MossPersonname:Tom Hanks \ No newline at end of file diff --git a/modules/ROOT/images/graph_foreach_clause.svg b/modules/ROOT/images/graph_foreach_clause.svg deleted file mode 100644 index 58550883c..000000000 --- a/modules/ROOT/images/graph_foreach_clause.svg +++ /dev/null @@ -1,66 +0,0 @@ - - - - - - -L - - - -N0 - -Person - -name = 'A' - - - -N1 - -Person - -name = 'B' - - - -N0->N1 - - -KNOWS - - - -N2 - -Person - -name = 'C' - - - -N1->N2 - - -KNOWS - - - -N3 - -Person - -name = 'D' - - - -N2->N3 - - -KNOWS - - - diff --git a/modules/ROOT/images/graph_label_expressions.svg b/modules/ROOT/images/graph_label_expressions.svg deleted file mode 100644 index d65f43bb3..000000000 --- a/modules/ROOT/images/graph_label_expressions.svg +++ /dev/null @@ -1,75 +0,0 @@ - - - - - - -L - - - -N0 - -A - -name = 'Alice' - - - -N1 - -B - -name = 'Bob' - - - -N2 - -C - -name = 'Charlie' - - - -N3 - -A, B - -name = 'Daniel' - - - -N4 - -A, C - -name = 'Eskil' - - - -N5 - -B, C - -name = 'Frank' - - - -N6 - -A, B, C - -name = 'George' - - - -N7 - -name = 'Henry' - - - diff --git a/modules/ROOT/images/graph_relationship_type_expressions.svg b/modules/ROOT/images/graph_relationship_type_expressions.svg deleted file mode 100644 index a5d89d565..000000000 --- a/modules/ROOT/images/graph_relationship_type_expressions.svg +++ /dev/null @@ -1,85 +0,0 @@ - - - - - - -L - - - -N0 - -A, B - - - - - -N1 - -B - - - - - -N0->N1 - - -R1 -name = 'Teaches' - - - -N2 - -C - - - - - -N3 - -D - - - - - -N2->N3 - - -R2 -name = 'Studies' - - - -N4 - -E - - - - - -N5 - -F - - - - - -N4->N5 - - -R3 -name = 'Parents' - - - diff --git a/modules/ROOT/images/graph_return_clause.svg b/modules/ROOT/images/graph_return_clause.svg deleted file mode 100644 index 8547a94d1..000000000 --- a/modules/ROOT/images/graph_return_clause.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/graph_with_clause.svg b/modules/ROOT/images/graph_with_clause.svg deleted file mode 100644 index 79b2ca715..000000000 --- a/modules/ROOT/images/graph_with_clause.svg +++ /dev/null @@ -1,85 +0,0 @@ - - - - - - -L - - - -N0 - -name = 'Anders' - - - -N2 - -name = 'Caesar' - - - -N0->N2 - - -BLOCKS - - - -N1 - -name = 'Bossman' - - - -N0->N1 - - -KNOWS - - - -N4 - -name = 'George' - - - -N2->N4 - - -KNOWS - - - -N1->N4 - - -KNOWS - - - -N3 - -name = 'David' - - - -N1->N3 - - -BLOCKS - - - -N3->N0 - - -KNOWS - - - diff --git a/modules/ROOT/images/introduction-schema.svg b/modules/ROOT/images/introduction-schema.svg new file mode 100644 index 000000000..01c094ba3 --- /dev/null +++ b/modules/ROOT/images/introduction-schema.svg @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/introduction_schema.svg b/modules/ROOT/images/introduction_schema.svg deleted file mode 100644 index d1ae4d9f4..000000000 --- a/modules/ROOT/images/introduction_schema.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/path-pattern-example-graph.svg b/modules/ROOT/images/path-pattern-example-graph.svg new file mode 100644 index 000000000..e9f90e8e6 --- /dev/null +++ b/modules/ROOT/images/path-pattern-example-graph.svg @@ -0,0 +1,206 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/path_pattern_example_graph.svg b/modules/ROOT/images/path_pattern_example_graph.svg deleted file mode 100644 index 1582c5d9f..000000000 --- a/modules/ROOT/images/path_pattern_example_graph.svg +++ /dev/null @@ -1 +0,0 @@ -CALLS_ATNEXTCALLS_ATCALLS_ATCALLS_ATNEXTCALLS_ATCALLS_ATNEXTCALLS_ATNEXTNEXTNEXTCALLS_ATCALLS_ATStopStationname:London VictoriaStationname:Clapham High StreetStationname:Elephant & CastleStopdeparts:11:37Stopdeparts:11:47Stationname:Denmark HillStationname:Peckham RyeStationStopdeparts:11:44Stopdeparts:11:40Stoparrives:11:55Stopdeparts:11:33Stopdeparts:11:41Stopdeparts:11:44Stopdeparts:11:54 \ No newline at end of file diff --git a/modules/ROOT/images/patterns-graph-pattern-reference.svg b/modules/ROOT/images/patterns-graph-pattern-reference.svg new file mode 100644 index 000000000..e7c65ec32 --- /dev/null +++ b/modules/ROOT/images/patterns-graph-pattern-reference.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-group-variables-graph.svg b/modules/ROOT/images/patterns-group-variables-graph.svg new file mode 100644 index 000000000..bca1cc8e7 --- /dev/null +++ b/modules/ROOT/images/patterns-group-variables-graph.svg @@ -0,0 +1,85 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-group-variables-graph2.svg b/modules/ROOT/images/patterns-group-variables-graph2.svg new file mode 100644 index 000000000..e56e93379 --- /dev/null +++ b/modules/ROOT/images/patterns-group-variables-graph2.svg @@ -0,0 +1,73 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-group-variables-graph3.svg b/modules/ROOT/images/patterns-group-variables-graph3.svg new file mode 100644 index 000000000..a318c845a --- /dev/null +++ b/modules/ROOT/images/patterns-group-variables-graph3.svg @@ -0,0 +1,46 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-node-pattern-pairs.svg b/modules/ROOT/images/patterns-node-pattern-pairs.svg new file mode 100644 index 000000000..6595df199 --- /dev/null +++ b/modules/ROOT/images/patterns-node-pattern-pairs.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-primer.svg b/modules/ROOT/images/patterns-primer.svg new file mode 100644 index 000000000..ed406bf67 --- /dev/null +++ b/modules/ROOT/images/patterns-primer.svg @@ -0,0 +1,133 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-calling-points.svg b/modules/ROOT/images/patterns-qpp-calling-points.svg new file mode 100644 index 000000000..bc79f6157 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-calling-points.svg @@ -0,0 +1,90 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-predicates.svg b/modules/ROOT/images/patterns-qpp-predicates.svg new file mode 100644 index 000000000..e831dd55a --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-predicates.svg @@ -0,0 +1,86 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-query-breakdown.svg b/modules/ROOT/images/patterns-qpp-query-breakdown.svg new file mode 100644 index 000000000..6b7dce00a --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-query-breakdown.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-reference-example.svg b/modules/ROOT/images/patterns-qpp-reference-example.svg new file mode 100644 index 000000000..b114edcc3 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-reference-example.svg @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-reference.svg b/modules/ROOT/images/patterns-qpp-reference.svg new file mode 100644 index 000000000..aca312049 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-reference.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-solutions.svg b/modules/ROOT/images/patterns-qpp-solutions.svg new file mode 100644 index 000000000..25fc97875 --- /dev/null +++ b/modules/ROOT/images/patterns-qpp-solutions.svg @@ -0,0 +1,104 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns_graph_pattern_reference.svg b/modules/ROOT/images/patterns_graph_pattern_reference.svg deleted file mode 100644 index 6f2c1530f..000000000 --- a/modules/ROOT/images/patterns_graph_pattern_reference.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_group_variables_graph.svg b/modules/ROOT/images/patterns_group_variables_graph.svg deleted file mode 100644 index 1800a32ed..000000000 --- a/modules/ROOT/images/patterns_group_variables_graph.svg +++ /dev/null @@ -1 +0,0 @@ -distance:0.76distance:0.3distance:1.2distance:0.34distance:1.4Stopdeparts:17:11Stationname:Denmark HillStopdeparts:17:13Stoparrives:17:19StationStationStationStationname:Clapham JunctionStopdeparts:17:01Stopdeparts:17:07Stopdeparts:17:10Stoparrives:17:17 \ No newline at end of file diff --git a/modules/ROOT/images/patterns_group_variables_graph2.svg b/modules/ROOT/images/patterns_group_variables_graph2.svg deleted file mode 100644 index cc586240b..000000000 --- a/modules/ROOT/images/patterns_group_variables_graph2.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/patterns_group_variables_graph3.svg b/modules/ROOT/images/patterns_group_variables_graph3.svg deleted file mode 100644 index 7aea9e784..000000000 --- a/modules/ROOT/images/patterns_group_variables_graph3.svg +++ /dev/null @@ -1 +0,0 @@ -r6r8distance:1.4r7n1name:Denmark Hilln6name:Clapham Junctionn7departs:17:10n8departs:17:17 \ No newline at end of file diff --git a/modules/ROOT/images/patterns_node_pattern_pairs.svg b/modules/ROOT/images/patterns_node_pattern_pairs.svg deleted file mode 100644 index e7bf0eec1..000000000 --- a/modules/ROOT/images/patterns_node_pattern_pairs.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_primer.svg b/modules/ROOT/images/patterns_primer.svg deleted file mode 100644 index 6d3cbb214..000000000 --- a/modules/ROOT/images/patterns_primer.svg +++ /dev/null @@ -1 +0,0 @@ -NEXTCALLS_ATNEXTNEXTCALLS_ATLINKdistance:1.45LINKdistance:1.24CALLS_ATCALLS_ATNEXTLINKdistance:0.7LINKdistance:0.39LINKdistance:1.96LINKdistance:0.86CALLS_ATCALLS_ATCALLS_ATNEXTNEXTLINKdistance:1.11LINKdistance:3.18CALLS_ATCALLS_ATNEXTCALLS_ATStopdeparts:22:41arrives:22:41StationDENMARK HILLStopdeparts:22:43arrives:22:43Stoparrives:22:48StationBATTERSEA PARKStationWANDSWORTHROADStationPECKHAM RYEStationCLAPHAMJUNCTIONStopdeparts:22:33Stopdeparts:22:37arrives:22:36Stoparrives:22:55StationLONDON VICTORIAStationCLAPHAMHIGH STREETStationBRIXTONStoparrives:22:50departs:22:50Stopdeparts:22:46Stoparrives:22:55Stopdeparts:22:44 \ No newline at end of file diff --git a/modules/ROOT/images/patterns_qpp_calling_points.svg b/modules/ROOT/images/patterns_qpp_calling_points.svg deleted file mode 100644 index 5682f303c..000000000 --- a/modules/ROOT/images/patterns_qpp_calling_points.svg +++ /dev/null @@ -1 +0,0 @@ -NEXTNEXTCALLS_ATCALLS_ATCALLS_ATCALLS_ATNEXTNEXTCALLS_ATCALLS_ATNEXTCALLS_ATdeparts:17:11name:Denmark Hilldeparts:17:13arrives:17:19name:Wandsworth Roadname:Clapham High Streetname:Peckham Ryename:Clapham Junctiondeparts:17:01departs:17:07departs:17:10arrives:17:17StationStop \ No newline at end of file diff --git a/modules/ROOT/images/patterns_qpp_predicates.svg b/modules/ROOT/images/patterns_qpp_predicates.svg deleted file mode 100644 index 70ddab06c..000000000 --- a/modules/ROOT/images/patterns_qpp_predicates.svg +++ /dev/null @@ -1 +0,0 @@ -2.60.860.711.210.530.840.951.131.81.291.082.010.881.110.51LondonBlackfriarsElephant& CastleQueens RdPeckhamDenmark HillPeckhamRyeSouthBermondseyNorthDulwichEast DulwichLondonBridgeLoughboroughJnTulse HillHerne HillBrixton \ No newline at end of file diff --git a/modules/ROOT/images/patterns_qpp_query_breakdown.svg b/modules/ROOT/images/patterns_qpp_query_breakdown.svg deleted file mode 100644 index a332ad16a..000000000 --- a/modules/ROOT/images/patterns_qpp_query_breakdown.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_qpp_reference.svg b/modules/ROOT/images/patterns_qpp_reference.svg deleted file mode 100644 index 9d6b72a54..000000000 --- a/modules/ROOT/images/patterns_qpp_reference.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_qpp_reference_example.svg b/modules/ROOT/images/patterns_qpp_reference_example.svg deleted file mode 100644 index bf52e0e69..000000000 --- a/modules/ROOT/images/patterns_qpp_reference_example.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/patterns_qpp_solutions.svg b/modules/ROOT/images/patterns_qpp_solutions.svg deleted file mode 100644 index ff002e8ed..000000000 --- a/modules/ROOT/images/patterns_qpp_solutions.svg +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax.svg deleted file mode 100644 index 156002d3a..000000000 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_load_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_load_privileges.svg deleted file mode 100644 index 8cf4a0eb4..000000000 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_load_privileges.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/privileges_on_graph_syntax.svg b/modules/ROOT/images/privileges_on_graph_syntax.svg deleted file mode 100644 index 321deeb2b..000000000 --- a/modules/ROOT/images/privileges_on_graph_syntax.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/modules/ROOT/images/runtimes-cypher-lifecycle.svg b/modules/ROOT/images/runtimes-cypher-lifecycle.svg new file mode 100644 index 000000000..1a34bc79c --- /dev/null +++ b/modules/ROOT/images/runtimes-cypher-lifecycle.svg @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/runtimes-execution-graph1.svg b/modules/ROOT/images/runtimes-execution-graph1.svg new file mode 100644 index 000000000..95bf0fd04 --- /dev/null +++ b/modules/ROOT/images/runtimes-execution-graph1.svg @@ -0,0 +1,91 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/runtimes-execution-graph2.svg b/modules/ROOT/images/runtimes-execution-graph2.svg new file mode 100644 index 000000000..da069544a --- /dev/null +++ b/modules/ROOT/images/runtimes-execution-graph2.svg @@ -0,0 +1,191 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/runtimes_cypher_lifecycle.svg b/modules/ROOT/images/runtimes_cypher_lifecycle.svg deleted file mode 100644 index 59e43075f..000000000 --- a/modules/ROOT/images/runtimes_cypher_lifecycle.svg +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/runtimes_execution_graph1.svg b/modules/ROOT/images/runtimes_execution_graph1.svg deleted file mode 100644 index f98891b76..000000000 --- a/modules/ROOT/images/runtimes_execution_graph1.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/runtimes_execution_graph2.svg b/modules/ROOT/images/runtimes_execution_graph2.svg deleted file mode 100644 index bc4e9c20a..000000000 --- a/modules/ROOT/images/runtimes_execution_graph2.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/subqueries-graph.svg b/modules/ROOT/images/subqueries-graph.svg new file mode 100644 index 000000000..7144f7014 --- /dev/null +++ b/modules/ROOT/images/subqueries-graph.svg @@ -0,0 +1,36 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/subqueries_graph.svg b/modules/ROOT/images/subqueries_graph.svg deleted file mode 100644 index d8f73da7d..000000000 --- a/modules/ROOT/images/subqueries_graph.svg +++ /dev/null @@ -1 +0,0 @@ -HAS_DOGsince:2016HAS_CATsince:2019HAS_DOGsince:2018HAS_DOGsince:2010HAS TOYPersonSwedishname:'Andy'age:36Dogname:'Andy'Personname:'Timothy'age:25nickname:'Tim'Catname:'Mittens'Personname:'Peter'age:35nickname:'Pete'Dogname:'Ozzy'Dogname:'Fido'Toyname:'Banana' \ No newline at end of file diff --git a/modules/ROOT/images/using-indexes-example-graph.svg b/modules/ROOT/images/using-indexes-example-graph.svg new file mode 100644 index 000000000..3ab10aa3a --- /dev/null +++ b/modules/ROOT/images/using-indexes-example-graph.svg @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/using_indexes_example_graph.svg b/modules/ROOT/images/using_indexes_example_graph.svg deleted file mode 100644 index f0c6251a6..000000000 --- a/modules/ROOT/images/using_indexes_example_graph.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/images/vector-index-graph.svg b/modules/ROOT/images/vector-index-graph.svg new file mode 100644 index 000000000..a277c5c08 --- /dev/null +++ b/modules/ROOT/images/vector-index-graph.svg @@ -0,0 +1,17 @@ + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/vector_index_graph.svg b/modules/ROOT/images/vector_index_graph.svg deleted file mode 100644 index 696d37a9b..000000000 --- a/modules/ROOT/images/vector_index_graph.svg +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/modules/ROOT/pages/clauses/delete.adoc b/modules/ROOT/pages/clauses/delete.adoc index b9caafe1a..948022d6c 100644 --- a/modules/ROOT/pages/clauses/delete.adoc +++ b/modules/ROOT/pages/clauses/delete.adoc @@ -20,7 +20,7 @@ For information about how to clear and reuse the space occupied by deleted objec The following graph is used for the examples below. It shows four actors, three of whom `ACTED_IN` the `Movie` `The Matrix` (`Keanu Reeves`, `Carrie-Anne Moss`, and `Laurence Fishburne`), and one actor who did not act in it (`Tom Hanks`). -image::graph_delete_clause.svg[width="500",role="middle"] +image::graph-delete-clause.svg[Example graph connecting person nodes to a movie node and an extra person node not connected to the movie node via an acted in relationship,width=400,role=popup] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/clauses/foreach.adoc b/modules/ROOT/pages/clauses/foreach.adoc index b594ecace..fda41a8e5 100644 --- a/modules/ROOT/pages/clauses/foreach.adoc +++ b/modules/ROOT/pages/clauses/foreach.adoc @@ -16,7 +16,7 @@ Within the `FOREACH` parentheses, you can do any of the updating commands -- `SE If you want to execute an additional `MATCH` for each element in a list then the xref::clauses/unwind.adoc[`UNWIND`] clause would be a more appropriate command. ==== -image:graph_foreach_clause.svg[] +image::graph-foreach-clause.svg[Person nodes connected between themselves via knows relationships,width=600,role=popup] //// CREATE diff --git a/modules/ROOT/pages/clauses/return.adoc b/modules/ROOT/pages/clauses/return.adoc index 323fc40cd..d7bb9d7c1 100644 --- a/modules/ROOT/pages/clauses/return.adoc +++ b/modules/ROOT/pages/clauses/return.adoc @@ -12,7 +12,7 @@ The `RETURN` clause defines the parts of a pattern (nodes, relationships, and/or The following graph is used for the examples below: -image::graph_return_clause.svg[width="600",role="middle"] +image::graph-return-clause.svg[Example graph connecting a person node to a movie node via acted in and directed relationships,width=400,role=popup] To recreate the graph, run the following query against an empty Neo4j database. diff --git a/modules/ROOT/pages/clauses/with.adoc b/modules/ROOT/pages/clauses/with.adoc index 42b4cd568..668f0cb33 100644 --- a/modules/ROOT/pages/clauses/with.adoc +++ b/modules/ROOT/pages/clauses/with.adoc @@ -25,7 +25,7 @@ Another use is to filter on aggregated values. `WITH` is used to introduce aggregates which can then be used in predicates in `WHERE`. These aggregate expressions create new bindings in the results. -image:graph_with_clause.svg[] +image::graph-with-clause.svg[Example graph connecting person nodes via knows and locks relationships,width=500,role=popup] //// [source, cypher, role=test-setup] diff --git a/modules/ROOT/pages/genai-integrations.adoc b/modules/ROOT/pages/genai-integrations.adoc index 896e94864..4834d1e6f 100644 --- a/modules/ROOT/pages/genai-integrations.adoc +++ b/modules/ROOT/pages/genai-integrations.adoc @@ -30,7 +30,7 @@ For more information, see link:{neo4j-docs-base-uri}/operations-manual/current/c The examples on this page use the link:https://github.com/neo4j-graph-examples/recommendations[Neo4j movie recommendations] dataset, focusing on the `plot` and `title` properties of `Movie` nodes. -image::genai_graph.svg[width="600",role="middle"] +image::genai-graph.svg[Example graph connecting person and actor nodes with a movie node via acted in and directed relationships,width=600,role=popup] The graph contains 28863 nodes and 332522 relationships. There are 9083 `Movie` nodes with a `plot` and `title` property. diff --git a/modules/ROOT/pages/indexes/search-performance-indexes/using-indexes.adoc b/modules/ROOT/pages/indexes/search-performance-indexes/using-indexes.adoc index 517d99e81..d4d0734ba 100644 --- a/modules/ROOT/pages/indexes/search-performance-indexes/using-indexes.adoc +++ b/modules/ROOT/pages/indexes/search-performance-indexes/using-indexes.adoc @@ -23,7 +23,7 @@ In addition to geospatial properties, these nodes also contain information about The data model also contains one relationship type: `ROUTE`, which specifies the distance in meters between the nodes in the graph. -image::using_indexes_example_graph.svg[width="600",role="middle"] +image::using-indexes-example-graph.svg[Graph showing two nodes being connected via a route relationship,width=600,role=popup] In total, the graph contains 69165 nodes (of which 188 have the label `PointOfInterest`) and 152077 `ROUTE` relationships. diff --git a/modules/ROOT/pages/indexes/semantic-indexes/full-text-indexes.adoc b/modules/ROOT/pages/indexes/semantic-indexes/full-text-indexes.adoc index ff18a4f06..b1c2db586 100644 --- a/modules/ROOT/pages/indexes/semantic-indexes/full-text-indexes.adoc +++ b/modules/ROOT/pages/indexes/semantic-indexes/full-text-indexes.adoc @@ -14,7 +14,7 @@ Full-text indexes are powered by the link:https://lucene.apache.org/[Apache Luce The following graph is used for the examples below: -image::full_text_graph.svg[width="700",role="middle"] +image::full-text-graph.svg[Example graph connecting an employee node to a manager node via an emailed relationship with the message as a property,width=600,role=popup] To recreate it, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc b/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc index 798acc01f..8aade1f04 100644 --- a/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc +++ b/modules/ROOT/pages/indexes/semantic-indexes/vector-indexes.adoc @@ -22,7 +22,7 @@ For more information, see link:http://dx.doi.org/10.1109/TPAMI.2018.2889473[Effi The examples on this page use the link:https://github.com/neo4j-graph-examples/recommendations[Neo4j movie recommendations] dataset, focusing on the `plot` and `embedding` properties of `Movie` nodes. The `embedding` property consists of a 1536-dimension vector embedding of the `plot` and `title` property combined. -image::vector_index_graph.svg[width="600",role="middle"] +image::vector-index-graph.svg[Graph example connecting movie to person nodes via acted in and directed relationships,width=500,role=popup] The graph contains 28863 nodes and 332522 relationships. diff --git a/modules/ROOT/pages/patterns/fixed-length-patterns.adoc b/modules/ROOT/pages/patterns/fixed-length-patterns.adoc index 7b8ecd4da..a0fea0d06 100644 --- a/modules/ROOT/pages/patterns/fixed-length-patterns.adoc +++ b/modules/ROOT/pages/patterns/fixed-length-patterns.adoc @@ -162,7 +162,7 @@ This section contains an example of matching a path pattern to paths in a proper It uses the following graph: -image::path_pattern_example_graph.svg[width="600",role="middle"] +image::path-pattern-example-graph.svg[Example graph for matching of a path pattern to paths,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/patterns/non-linear-patterns.adoc b/modules/ROOT/pages/patterns/non-linear-patterns.adoc index f7ff89e06..f90eae902 100644 --- a/modules/ROOT/pages/patterns/non-linear-patterns.adoc +++ b/modules/ROOT/pages/patterns/non-linear-patterns.adoc @@ -37,12 +37,12 @@ The graph has three different services, two of which would compose the desired r The solution is the following path with a cycle: -image::patterns-equijoins-solution2.svg[Example graph showing a path with a cycle,width=400,role=popup] +image::patterns-equijoins-solution2.svg[Example graph showing a path with a cycle,width=300,role=popup] If unique properties exist on the node where the cycle "join" occurs in the path, then it is possible to repeat the node pattern with a predicate matching on the unique property. The following motif demonstrates how that can be achieved, repeating a `Station` node pattern with the name `London Euston`: -image::patterns-equijoins-motif.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] +image::patterns-equijoins-motif.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=800,role=popup] The path pattern equivalent is: @@ -57,7 +57,7 @@ There may be cases where a unique predicate is not available. In this case, an equijoin can be used to define the desired cycle by using a repeated node variable. In the current example, if you declare the same node variable `n` in both the first and last node patterns, then the node patterns _must_ match the same node: -image::patterns-equijoins-motif2.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=600,role=popup] +image::patterns-equijoins-motif2.svg[Motif using the London railway example connecting stations via calls at and next relationships,width=800,role=popup] Putting this path pattern with an equijoin in a query, the times of the outbound and return journeys can be returned: diff --git a/modules/ROOT/pages/patterns/primer.adoc b/modules/ROOT/pages/patterns/primer.adoc index 30604a3ad..c2a0af229 100644 --- a/modules/ROOT/pages/patterns/primer.adoc +++ b/modules/ROOT/pages/patterns/primer.adoc @@ -8,7 +8,7 @@ This section contains a primer covering some fundamental features of graph patte The example graph used in this tutorial is a model of train `Stations`, and different train services with `Stops` that call at the `Stations`. -image::patterns_primer.svg[width="700",role="middle"] +image::patterns-primer.svg[Example graph using the London railway dataset,width=800,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/patterns/reference.adoc b/modules/ROOT/pages/patterns/reference.adoc index 59e4d3070..35aece12d 100644 --- a/modules/ROOT/pages/patterns/reference.adoc +++ b/modules/ROOT/pages/patterns/reference.adoc @@ -551,7 +551,7 @@ MATCH p = ()-[r WHERE r.q = n.q]-() A quantified path pattern represents a xref::patterns/reference.adoc#path-patterns[path pattern] repeated a number of times in a given range. It is composed of a path pattern, representing the path section to be repeated, followed by a xref::patterns/reference.adoc#quantifiers[quantifier], constraining the number of repetitions between a lower bound and an upper bound. -image::patterns_qpp_reference.svg[width="500", role="middle"] +image::patterns-qpp-reference.svg[Diagram showing how a quantified path pattern looks in Cypher,width=600,role=popup] For information about an alternative version of patterns for matching paths of variable length, see xref::patterns/reference.adoc#variable-length-relationships[variable-length relationships]. @@ -640,7 +640,7 @@ MATCH ((x)-[r]->(z) WHERE z.p > x.p){2,3} The mechanics of matching a quantified path pattern against paths is best explained with an example. For the example, the following simple graph will be used: -image::patterns_qpp_reference_example.svg[width="600", role=middle"] +image::patterns-qpp-reference-example.svg[Example graph for a matching of a quantified path pattern against paths,width=600,role=popup] First, consider the following simple path pattern: @@ -1495,7 +1495,7 @@ MATCH allShortestPaths((:A)-[:R*0..10]->(:B)) A graph pattern is a comma separated list of one or more path patterns. It is the top level construct provided to `MATCH`. -image::patterns_graph_pattern_reference.svg[width="500", role="middle"] +image::patterns-graph-pattern-reference.svg[Cypher example of a graph pattern including path patterns,width=600,role=popup] [[graph-patterns-syntax]] === Syntax @@ -1666,7 +1666,7 @@ During the matching process, each pair of node patterns will match the same node For example, in the first pair both `y1` and `x2` will bind to the same node, and that node must have labels `X` and `Y`. This expansion and binding is depicted in the following diagram: -image::patterns_node_pattern_pairs.svg[width="500", role="middle"] +image::patterns-node-pattern-pairs.svg[Diagram showing expansions and bindings of patterns,width=600,role=popup] [[node-pattern-pairs-simple-path-patterns-and-quantified-path-patterns]] === Simple path patterns and quantified path patterns diff --git a/modules/ROOT/pages/patterns/variable-length-patterns.adoc b/modules/ROOT/pages/patterns/variable-length-patterns.adoc index 425d609d5..7a7adba53 100644 --- a/modules/ROOT/pages/patterns/variable-length-patterns.adoc +++ b/modules/ROOT/pages/patterns/variable-length-patterns.adoc @@ -15,7 +15,7 @@ Quantified path patterns can be useful when, for example, searching for all node This example uses a new graph: -image::patterns_qpp_calling_points.svg[width="700",role="middle"] +image::patterns-qpp-calling-points.svg[Example graph for quantified path patterns,width=800,role=popup] To recreate the graph, run the following query against an empty Neo4j database: @@ -49,7 +49,7 @@ Following the `NEXT` relationship of a `Stop` will give the next `Stop` of the s For this example, a path pattern is constructed to match each of the services that allow passengers to travel from `Denmark Hill` to `Clapham Junction`. The following shows the two paths that the path pattern should match: -image::patterns_qpp_solutions.svg[width="700",role="middle"] +image::patterns-qpp-solutions.svg[Graph showing two patterns,width=600,role=popup] The following motif represents a fixed-length path pattern that matches the service that departs from `Denmark Hill` station at `17:07`: @@ -166,7 +166,7 @@ Here is what those segments look like when concatenated with the first repetitio The original `MATCH` clause now has the following three parts: -image::patterns_qpp_query_breakdown.svg[] +image::patterns-qpp-query-breakdown.svg[Diagram showing the Cypher code for the example,width=600,role=popup] Translating the union of fixed-length path patterns into a quantified path pattern results in a pattern that will return the correct paths. The following query adds a `RETURN` clause that yields the departure and arrival times of the two services: @@ -270,7 +270,7 @@ For more information, see the reference section on xref:patterns/reference.adoc# This section uses the example of `Stations` and `Stops` used in the previous section, but with an additional property `distance` added to the `NEXT` relationships: -image::patterns_group_variables_graph.svg[width="700", role="middle"] +image::patterns-group-variables-graph.svg[Example graph using the London railway dataset to show variable-length patterns,width=800,role=popup] As the name suggests, this property represents the distance between two `Stops`. To return the total distance for each service connecting a pair of `Stations`, a variable referencing each of the relationships traversed is needed. @@ -302,7 +302,7 @@ The following diagram shows the variable bindings of the path pattern with three It traces the node or relationship that each indexed variable is bound to. Note that the index increases from right to left as the path starts at `Denmark Hill`: -image::patterns_group_variables_graph2.svg[width="700", role="middle"] +image::patterns-group-variables-graph2.svg[Diagram showing variable bindings of the path pattern,width=800,role=popup] For this matched path, the group variables have the following bindings: @@ -315,7 +315,7 @@ m => [n3, n4, n5] The second solution is the following path: -image::patterns_group_variables_graph3.svg[width="700", role="middle"] +image::patterns-group-variables-graph3.svg[Diagram with a variation of the binding of the path pattern,width=800,role=popup] The following table shows the bindings for both matches, including the variable origin. In contrast to the group variables, `origin` is a singleton variable due to being declared outside the quantification. @@ -377,7 +377,7 @@ For example, all relationships must have the property `distance > 10`. To demonstrate the utility of predicates in quantified path patterns, this section considers an example of finding the shortest path by physical distance and compares that to the results yielded by using the xref:patterns/shortest-paths.adoc[`SHORTEST`] keyword. The graph in this example continues with `Station` nodes, but adds both a geospatial `location` property to the `Stations`, as well as `LINK` relationships with a `distance` property representing the distance between pairs of `Stations`: -image::patterns_qpp_predicates.svg[width="500",role="middle"] +image::patterns-qpp-predicates.svg[Example graph with station nodes and an additional geospatial location property,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/planning-and-tuning/execution-plans.adoc b/modules/ROOT/pages/planning-and-tuning/execution-plans.adoc index ec6c0cb5c..c5690053f 100644 --- a/modules/ROOT/pages/planning-and-tuning/execution-plans.adoc +++ b/modules/ROOT/pages/planning-and-tuning/execution-plans.adoc @@ -14,7 +14,7 @@ The Cypher planner uses this information to determine which access patterns will In the final phase, this logical plan is turned into an executable physical plan, which actually runs the query against the database. Executing this physical plan is the task of the xref:planning-and-tuning/runtimes/index.adoc[Cypher runtime]. -image::runtimes_cypher_lifecycle.svg[width="400", role="middle"] +image::runtimes-cypher-lifecycle.svg[Diagram showing the lifecycle of a Cypher query,width=600,role=popup] [[runtimes-example-graph]] == Example graph @@ -22,7 +22,7 @@ image::runtimes_cypher_lifecycle.svg[width="400", role="middle"] To explain how to understand a Cypher execution plan, a graph based on the UK national rail network is used. The data in the graph is taken from link:https://www.raildeliverygroup.com/our-services/rail-data/fares-timetable-data.html[publically available datasets]. -image::patterns_qpp_calling_points.svg[width="700",role="middle"] +image::patterns-qpp-calling-points.svg[Example graph for quantified path patterns,width=800,role=popup] The graph contains two types of nodes: `Stop` and `Station`. Each `Stop` on a train service `CALLS_AT` one `Station`, and has the properties `arrives` and `departs` that give the times the train is at the `Station`. @@ -67,7 +67,7 @@ RETURN count(*) As can be seen from the graph, two such patterns exist (one with a service departing `Denmark Hill` at `17:07` which stops at the Stations `Clapham High Street` and `Wandsworth Road`, and one direct service departing `Denmark Hill` at `17:10`): -image::patterns_qpp_solutions.svg[width="700",role="middle"] +image::patterns-qpp-solutions.svg[Graph showing two patterns,width=600,role=popup] For the purposes of understanding Cypher execution plans, however, the query result is less interesting than the planning that produces it. diff --git a/modules/ROOT/pages/planning-and-tuning/runtimes/concepts.adoc b/modules/ROOT/pages/planning-and-tuning/runtimes/concepts.adoc index 731799097..808768500 100644 --- a/modules/ROOT/pages/planning-and-tuning/runtimes/concepts.adoc +++ b/modules/ROOT/pages/planning-and-tuning/runtimes/concepts.adoc @@ -15,7 +15,7 @@ For readers not familiar with reading the execution plans produced by Cypher que The following graph is used for the queries on this page: -image::patterns_qpp_calling_points.svg[width="700",role="middle"] +image::patterns-qpp-calling-points.svg[Example graph for quantified path patterns,width=800,role=popup] The graph contains two types of nodes: `Stop` and `Station`. Each `Stop` on a train service `CALLS_AT` one `Station`, and has the properties `arrives` and `departs` that give the times the train is at the `Station`. @@ -212,7 +212,7 @@ A pipeline can, in turn, be defined as a sequence of operators which have been f The logical operators are thus not mapped to a corresponding physical operator when using the pipelined runtime. Instead, the logical operator tree is transformed into an execution graph containing pipelines and buffers: -image::runtimes_execution_graph1.svg[width="700",role="middle"] +image::runtimes-execution-graph1.svg[Diagram showing the logical operator tree transformed into an execution graph containing pipelines and buffers,width=600,role=popup] In this execution graph, query execution starts at `pipeline 0` which will eventually produce a morsel to be written into the buffer of `pipeline 1`. Once there is data for `pipeline 1` to process, it can begin executing and in turn write data for the next pipeline to process, and so on. @@ -330,7 +330,7 @@ Scheduling is decentralized, and each worker has its own scheduler instance. Consider the execution graph below, based on the same example query: -image::runtimes_execution_graph2.svg[width="900",role="middle"] +image::runtimes-execution-graph2.svg[Diagram showing the execution plan,width=800,role=popup] The execution graph shows that execution starts at `pipeline 0`, which consists of the operator `PartitionedNodeByLabelScan` and can be executed simultaneously on all available threads working on different morsels of data. Once pipeline `0` has produced at least one full morsel of data, any thread can then start executing `pipeline 1`, while other threads may continue to execute `pipeline 0`. diff --git a/modules/ROOT/pages/queries/basic.adoc b/modules/ROOT/pages/queries/basic.adoc index 78c7f6b74..16fc42896 100644 --- a/modules/ROOT/pages/queries/basic.adoc +++ b/modules/ROOT/pages/queries/basic.adoc @@ -15,7 +15,7 @@ This will provide structure to the data, and allow users of the graph to efficie The following data model is used for the Neo4j data model: -image::introduction_schema.svg[width="800",role="middle"] +image::introduction-schema.svg[Diagram showing the used data model,width=600,role=popup] It includes two types of node labels: diff --git a/modules/ROOT/pages/subqueries/call-subquery.adoc b/modules/ROOT/pages/subqueries/call-subquery.adoc index 8f97c82db..d2beedb93 100644 --- a/modules/ROOT/pages/subqueries/call-subquery.adoc +++ b/modules/ROOT/pages/subqueries/call-subquery.adoc @@ -14,7 +14,7 @@ For descriptions of the `CALL` clause in this context, refer to the xref::clause A graph with the following schema is used for the examples below: -image::call_subquery_graph.svg[] +image::call-subquery-graph.svg[Example graph showing a play node connecting to a team node via a plays for relationship and an owes relationship coming from and back to the team node,width=600,role=popup] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/subqueries/collect.adoc b/modules/ROOT/pages/subqueries/collect.adoc index fb54399e7..6403f473a 100644 --- a/modules/ROOT/pages/subqueries/collect.adoc +++ b/modules/ROOT/pages/subqueries/collect.adoc @@ -11,7 +11,7 @@ The `RETURN` clause must return exactly one column. The following graph is used for the examples below: -image::subqueries_graph.svg[width="700",role="middle"] +image::subqueries-graph.svg[Example graph connecting person nodes with cat and dog nodes,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/subqueries/count.adoc b/modules/ROOT/pages/subqueries/count.adoc index 083e843c5..36406d513 100644 --- a/modules/ROOT/pages/subqueries/count.adoc +++ b/modules/ROOT/pages/subqueries/count.adoc @@ -8,7 +8,7 @@ A `COUNT` subquery can be used to count the number of rows returned by the subqu The following graph is used for the examples below: -image::subqueries_graph.svg[width="700",role="middle"] +image::subqueries-graph.svg[Example graph connecting person nodes with cat and dog nodes,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/subqueries/existential.adoc b/modules/ROOT/pages/subqueries/existential.adoc index 6c7429da0..6a56f4022 100644 --- a/modules/ROOT/pages/subqueries/existential.adoc +++ b/modules/ROOT/pages/subqueries/existential.adoc @@ -9,7 +9,7 @@ It serves the same purpose as a xref::clauses/where.adoc#filter-patterns[path pa The following graph is used for the examples below: -image::subqueries_graph.svg[width="700",role="middle"] +image::subqueries-graph.svg[Example graph connecting person nodes with cat and dog nodes,width=600,role=popup] To recreate the graph, run the following query against an empty Neo4j database: From 049709a04dd0c7561e4eaccc94d4cd29342598a7 Mon Sep 17 00:00:00 2001 From: Lidia Zuin <102308961+lidiazuin@users.noreply.github.com> Date: Wed, 21 May 2025 09:44:05 +0200 Subject: [PATCH 07/32] Delete modules/ROOT/images/graph-with-clause.svg --- modules/ROOT/images/graph-with-clause.svg | 24 ----------------------- 1 file changed, 24 deletions(-) delete mode 100644 modules/ROOT/images/graph-with-clause.svg diff --git a/modules/ROOT/images/graph-with-clause.svg b/modules/ROOT/images/graph-with-clause.svg deleted file mode 100644 index 39691d659..000000000 --- a/modules/ROOT/images/graph-with-clause.svg +++ /dev/null @@ -1,24 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - From 11618f41389ce00b51a040543a3cd09075683917 Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Mon, 10 Mar 2025 11:01:11 +0100 Subject: [PATCH 08/32] Updated images --- modules/ROOT/images/graph-where-clause.svg | 15 +++++++++++++++ .../ROOT/images/patterns-equijoin-reference.svg | 11 +++++++++++ modules/ROOT/pages/clauses/where.adoc | 4 ++++ 3 files changed, 30 insertions(+) create mode 100644 modules/ROOT/images/graph-where-clause.svg diff --git a/modules/ROOT/images/graph-where-clause.svg b/modules/ROOT/images/graph-where-clause.svg new file mode 100644 index 000000000..6a1b83c80 --- /dev/null +++ b/modules/ROOT/images/graph-where-clause.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoin-reference.svg b/modules/ROOT/images/patterns-equijoin-reference.svg index ae892dc5e..ffb71317a 100644 --- a/modules/ROOT/images/patterns-equijoin-reference.svg +++ b/modules/ROOT/images/patterns-equijoin-reference.svg @@ -1,3 +1,4 @@ +<<<<<<< HEAD @@ -9,4 +10,14 @@ +======= + + + + + + + + +>>>>>>> a7b5b66 (Updated images) diff --git a/modules/ROOT/pages/clauses/where.adoc b/modules/ROOT/pages/clauses/where.adoc index af5cc28b9..ba4cedf6c 100644 --- a/modules/ROOT/pages/clauses/where.adoc +++ b/modules/ROOT/pages/clauses/where.adoc @@ -20,7 +20,11 @@ For more uses of `WHERE`, see xref:expressions/predicates/index.adoc[]. The following graph is used for the examples below: +<<<<<<< HEAD image::graph_where_clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] +======= +image::graph-where-clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] +>>>>>>> a7b5b66 (Updated images) To recreate the graph, run the following query in an empty Neo4j database: From 6772a863ebc723fb1303611ac130188356055edc Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Thu, 20 Mar 2025 15:34:02 +0100 Subject: [PATCH 09/32] Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated --- .../images/patterns-equijoin-reference.svg | 6 ++++ modules/ROOT/pages/values-and-types/maps.adoc | 35 ------------------- 2 files changed, 6 insertions(+), 35 deletions(-) delete mode 100644 modules/ROOT/pages/values-and-types/maps.adoc diff --git a/modules/ROOT/images/patterns-equijoin-reference.svg b/modules/ROOT/images/patterns-equijoin-reference.svg index ffb71317a..e5f5997b0 100644 --- a/modules/ROOT/images/patterns-equijoin-reference.svg +++ b/modules/ROOT/images/patterns-equijoin-reference.svg @@ -1,4 +1,7 @@ <<<<<<< HEAD +<<<<<<< HEAD +======= +>>>>>>> 1962a7f (Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated) @@ -10,6 +13,7 @@ +<<<<<<< HEAD ======= @@ -20,4 +24,6 @@ >>>>>>> a7b5b66 (Updated images) +======= +>>>>>>> 1962a7f (Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated) diff --git a/modules/ROOT/pages/values-and-types/maps.adoc b/modules/ROOT/pages/values-and-types/maps.adoc deleted file mode 100644 index 82c83944d..000000000 --- a/modules/ROOT/pages/values-and-types/maps.adoc +++ /dev/null @@ -1,35 +0,0 @@ -:description: This section describes how to use maps in Cyphers. - -[[cypher-maps]] -= Maps - -Cypher supports the construction of maps. - -[NOTE] -==== -For information about the property access operators `.` and `[]`, see xref:expressions/map-expressions#map-operators[Map expressions -> Map operators]. + -For information about how the `[]` operator behaves with respect to `null`, see xref::values-and-types/working-with-null.adoc#cypher-null-bracket-operator[Working with `null` -> The `[\]` operator and `null`]. -==== - - -[[cypher-literal-maps]] -== Literal maps - -The key names in a map must be literals. -If returned through an link:{neo4j-docs-base-uri}/http-api/current[HTTP API call], a JSON object will be returned. -If returned in Java, an object of type `java.util.Map` will be returned. - - -.Query -[source, cypher, indent=0] ----- -RETURN {key: 'Value', listKey: [{inner: 'Map1'}, {inner: 'Map2'}]} AS map ----- - -.Result -[role="queryresult",options="header,footer",cols="1* Date: Wed, 2 Apr 2025 12:23:42 +0200 Subject: [PATCH 10/32] Final batch of updated images --- modules/ROOT/images/graph-with-clause.svg | 24 +++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 modules/ROOT/images/graph-with-clause.svg diff --git a/modules/ROOT/images/graph-with-clause.svg b/modules/ROOT/images/graph-with-clause.svg new file mode 100644 index 000000000..39691d659 --- /dev/null +++ b/modules/ROOT/images/graph-with-clause.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + From cc20b5818d946fcb02283d1190e7b66ab59085cc Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 21 May 2025 10:37:07 +0200 Subject: [PATCH 11/32] Updated images after feedback on spreadsheet --- modules/ROOT/images/graph-set-clause.svg | 36 +-- modules/ROOT/images/graph-union-clause.svg | 34 +-- modules/ROOT/images/graph-where-clause.svg | 43 ++-- .../ROOT/images/path-pattern-solutions.svg | 234 +++++++++--------- .../images/patterns-equijoins-solution2.svg | 120 ++------- modules/ROOT/images/patterns-equijoins.svg | 156 +++--------- .../patterns-graph-pattern-reference.svg | 19 +- .../patterns-group-variables-graph3.svg | 54 ++-- .../images/patterns-node-pattern-pairs.svg | 46 ++-- .../ROOT/images/patterns-qpp-illustration.svg | 12 +- modules/ROOT/images/patterns-qpp-motif2.svg | 24 +- .../images/patterns-qpp-query-breakdown.svg | 18 +- .../images/patterns-qpp-reference-example.svg | 51 ++-- .../ROOT/images/patterns-qpp-reference.svg | 20 +- .../images/patterns-second-shortest-paths.svg | 88 ++----- .../images/privileges-hierarchy-database.svg | 74 ------ .../ROOT/images/privileges-hierarchy-dbms.svg | 173 ------------- modules/ROOT/images/privileges-hierarchy.svg | 47 ---- ...nt-and-deny-syntax-database-privileges.svg | 70 ------ ..._grant-and-deny-syntax-dbms-privileges.svg | 88 ------- 20 files changed, 387 insertions(+), 1020 deletions(-) delete mode 100644 modules/ROOT/images/privileges-hierarchy-database.svg delete mode 100644 modules/ROOT/images/privileges-hierarchy-dbms.svg delete mode 100644 modules/ROOT/images/privileges-hierarchy.svg delete mode 100644 modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg delete mode 100644 modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg diff --git a/modules/ROOT/images/graph-set-clause.svg b/modules/ROOT/images/graph-set-clause.svg index 52fc7173b..101ef3df7 100644 --- a/modules/ROOT/images/graph-set-clause.svg +++ b/modules/ROOT/images/graph-set-clause.svg @@ -1,24 +1,24 @@ - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + - - + + diff --git a/modules/ROOT/images/graph-union-clause.svg b/modules/ROOT/images/graph-union-clause.svg index 56a3619bd..3e20d96f9 100644 --- a/modules/ROOT/images/graph-union-clause.svg +++ b/modules/ROOT/images/graph-union-clause.svg @@ -1,18 +1,18 @@ - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/graph-where-clause.svg b/modules/ROOT/images/graph-where-clause.svg index 6a1b83c80..fc5c281e0 100644 --- a/modules/ROOT/images/graph-where-clause.svg +++ b/modules/ROOT/images/graph-where-clause.svg @@ -1,15 +1,30 @@ - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/path-pattern-solutions.svg b/modules/ROOT/images/path-pattern-solutions.svg index b9cccd9d2..11c9323ef 100644 --- a/modules/ROOT/images/path-pattern-solutions.svg +++ b/modules/ROOT/images/path-pattern-solutions.svg @@ -1,169 +1,169 @@ - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - + + + + + + + - - - - - - - - - - - - - - + + + + + + + + + + + + + + - + - - + + - + - - + + - + - - + + - + - - + + - + - - + + - + - - + + diff --git a/modules/ROOT/images/patterns-equijoins-solution2.svg b/modules/ROOT/images/patterns-equijoins-solution2.svg index 66d37acc8..7a58a87bb 100644 --- a/modules/ROOT/images/patterns-equijoins-solution2.svg +++ b/modules/ROOT/images/patterns-equijoins-solution2.svg @@ -1,100 +1,22 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-equijoins.svg b/modules/ROOT/images/patterns-equijoins.svg index 5729fbb6a..5dd50e280 100644 --- a/modules/ROOT/images/patterns-equijoins.svg +++ b/modules/ROOT/images/patterns-equijoins.svg @@ -1,118 +1,40 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-graph-pattern-reference.svg b/modules/ROOT/images/patterns-graph-pattern-reference.svg index e7c65ec32..947f06a16 100644 --- a/modules/ROOT/images/patterns-graph-pattern-reference.svg +++ b/modules/ROOT/images/patterns-graph-pattern-reference.svg @@ -1,11 +1,10 @@ - - - - - - - - - - + + + + + + + + + diff --git a/modules/ROOT/images/patterns-group-variables-graph3.svg b/modules/ROOT/images/patterns-group-variables-graph3.svg index a318c845a..6af584064 100644 --- a/modules/ROOT/images/patterns-group-variables-graph3.svg +++ b/modules/ROOT/images/patterns-group-variables-graph3.svg @@ -1,46 +1,48 @@ - - - - - - - - + + + + + + + + + + - - - - + + + + - - - - - - - - + + + + + + + + - + - - + + - + - - + + diff --git a/modules/ROOT/images/patterns-node-pattern-pairs.svg b/modules/ROOT/images/patterns-node-pattern-pairs.svg index 6595df199..ae47df8a8 100644 --- a/modules/ROOT/images/patterns-node-pattern-pairs.svg +++ b/modules/ROOT/images/patterns-node-pattern-pairs.svg @@ -1,24 +1,24 @@ - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-illustration.svg b/modules/ROOT/images/patterns-qpp-illustration.svg index 5810702f3..de71e9e1f 100644 --- a/modules/ROOT/images/patterns-qpp-illustration.svg +++ b/modules/ROOT/images/patterns-qpp-illustration.svg @@ -1,7 +1,7 @@ - - - - - - + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-motif2.svg b/modules/ROOT/images/patterns-qpp-motif2.svg index e65ae4861..07ec4b329 100644 --- a/modules/ROOT/images/patterns-qpp-motif2.svg +++ b/modules/ROOT/images/patterns-qpp-motif2.svg @@ -1,14 +1,12 @@ - - - - - - - - - - - - - + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-query-breakdown.svg b/modules/ROOT/images/patterns-qpp-query-breakdown.svg index 6b7dce00a..c8c699857 100644 --- a/modules/ROOT/images/patterns-qpp-query-breakdown.svg +++ b/modules/ROOT/images/patterns-qpp-query-breakdown.svg @@ -1,11 +1,11 @@ - - - - - - - - - + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-reference-example.svg b/modules/ROOT/images/patterns-qpp-reference-example.svg index b114edcc3..c38576f73 100644 --- a/modules/ROOT/images/patterns-qpp-reference-example.svg +++ b/modules/ROOT/images/patterns-qpp-reference-example.svg @@ -1,28 +1,27 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-reference.svg b/modules/ROOT/images/patterns-qpp-reference.svg index aca312049..a89af11d0 100644 --- a/modules/ROOT/images/patterns-qpp-reference.svg +++ b/modules/ROOT/images/patterns-qpp-reference.svg @@ -1,11 +1,13 @@ - - - - - - - - - + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-second-shortest-paths.svg b/modules/ROOT/images/patterns-second-shortest-paths.svg index 8345677fc..fb321cb13 100644 --- a/modules/ROOT/images/patterns-second-shortest-paths.svg +++ b/modules/ROOT/images/patterns-second-shortest-paths.svg @@ -1,65 +1,25 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/privileges-hierarchy-database.svg b/modules/ROOT/images/privileges-hierarchy-database.svg deleted file mode 100644 index 7d1010281..000000000 --- a/modules/ROOT/images/privileges-hierarchy-database.svg +++ /dev/null @@ -1,74 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges-hierarchy-dbms.svg b/modules/ROOT/images/privileges-hierarchy-dbms.svg deleted file mode 100644 index 82449b516..000000000 --- a/modules/ROOT/images/privileges-hierarchy-dbms.svg +++ /dev/null @@ -1,173 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges-hierarchy.svg b/modules/ROOT/images/privileges-hierarchy.svg deleted file mode 100644 index e5a23185c..000000000 --- a/modules/ROOT/images/privileges-hierarchy.svg +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg b/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg deleted file mode 100644 index fafda3630..000000000 --- a/modules/ROOT/images/privileges_grant-and-deny-syntax-database-privileges.svg +++ /dev/null @@ -1,70 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg b/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg deleted file mode 100644 index fb41882b8..000000000 --- a/modules/ROOT/images/privileges_grant-and-deny-syntax-dbms-privileges.svg +++ /dev/null @@ -1,88 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - From eeb82131e55c6a6c9317520fbdb23b396eb9517e Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 21 May 2025 10:39:18 +0200 Subject: [PATCH 12/32] rebase --- publish.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/publish.yml b/publish.yml index 63435ee87..cdd6ff792 100644 --- a/publish.yml +++ b/publish.yml @@ -53,4 +53,7 @@ asciidoc: cross-mark: icon:times[] neo4j-base-uri: '' neo4j-docs-base-uri: /docs - \ No newline at end of file +<<<<<<< HEAD + +======= +>>>>>>> 27306d3 (Update publish.yml) From bd70990695b807427d00ea57f051e301dabb9bbc Mon Sep 17 00:00:00 2001 From: Neil Dewhurst Date: Tue, 6 Dec 2022 16:56:07 +0000 Subject: [PATCH 13/32] Update publish.yml playbook (#244) Publish from all the branches --- publish.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/publish.yml b/publish.yml index cdd6ff792..a7dbe327c 100644 --- a/publish.yml +++ b/publish.yml @@ -53,7 +53,4 @@ asciidoc: cross-mark: icon:times[] neo4j-base-uri: '' neo4j-docs-base-uri: /docs -<<<<<<< HEAD -======= ->>>>>>> 27306d3 (Update publish.yml) From 90c853ad56046b24e6659926de544b01a4f61e8f Mon Sep 17 00:00:00 2001 From: Neil Dewhurst Date: Thu, 15 Dec 2022 16:29:08 +0000 Subject: [PATCH 14/32] 5.3 publish (#262) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: AlexicaWright <49636617+AlexicaWright@users.noreply.github.com> Co-authored-by: Jens Pryce-Ã…klundh <112686610+JPryce-Aklundh@users.noreply.github.com> Co-authored-by: David Oliver Co-authored-by: Arne Fischereit Co-authored-by: Tobias Johansson Co-authored-by: Gemma Lamont Co-authored-by: lidiazuin <102308961+lidiazuin@users.noreply.github.com> Co-authored-by: Therese Magnusson Co-authored-by: JPryce-Aklundh Co-authored-by: Louise Söderström Co-authored-by: Jack Waudby <33488812+jackwaudby@users.noreply.github.com> Co-authored-by: Satia Herfert Co-authored-by: Gustav Hedengran --- .../images/graph_expression_subqueries.svg | 119 ++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 modules/ROOT/images/graph_expression_subqueries.svg diff --git a/modules/ROOT/images/graph_expression_subqueries.svg b/modules/ROOT/images/graph_expression_subqueries.svg new file mode 100644 index 000000000..b037298a9 --- /dev/null +++ b/modules/ROOT/images/graph_expression_subqueries.svg @@ -0,0 +1,119 @@ + + + + + + +L + + + +Andy + +Swedish, Person + +age = 36 +name = 'Andy' + + + +DogAndy + +Dog + +name = 'Andy' + + + +Andy->DogAndy + + +  HAS_DOG +since = 2016 + + + +Timothy + +Person + +age = 25 +name = 'Timothy' + + + +Mittens + +Cat + +name = 'Mittens' + + + +Timothy->Mittens + + +  HAS_CAT +since = 2019 + + + +Peter + +Person + +age = 35 +name = 'Peter' + + + +Ozzy + +Dog + +name = 'Ozzy' + + + +Peter->Ozzy + + +  HAS_DOG +since = 2018 + + + +Fido + +Dog + +name = 'Fido' + + + +Peter->Fido + + +  HAS_DOG +since = 2010 + + + +Banana + +Toy + +name = 'Banana' + + + +Fido->Banana + + +  HAS_TOY + + + From 9e3d56a906a430e62791db58ccab0c230feb17a4 Mon Sep 17 00:00:00 2001 From: Therese Magnusson Date: Wed, 4 Jan 2023 13:48:34 +0100 Subject: [PATCH 15/32] Document relationship key and uniqueness constraints (#225) Feature merged in 5.3 but hidden behind feature flag, the flag was turned true by default in 5.4. --- modules/ROOT/pages/constraints/syntax.adoc | 2 +- ...ions-additions-removals-compatibility.adoc | 1604 +++++++++++++++++ 2 files changed, 1605 insertions(+), 1 deletion(-) diff --git a/modules/ROOT/pages/constraints/syntax.adoc b/modules/ROOT/pages/constraints/syntax.adoc index fcb83e9dc..79756e280 100644 --- a/modules/ROOT/pages/constraints/syntax.adoc +++ b/modules/ROOT/pages/constraints/syntax.adoc @@ -310,4 +310,4 @@ This means its default behavior is to throw an error if an attempt is made to dr With the `IF EXISTS` flag, no error is thrown and nothing happens should the constraint not exist. Instead, an informational notification is returned detailing that the constraint does not exist. -For examples on how to drop constraints, see xref:constraints/managing-constraints.adoc#drop-constraint[Create, show, and drop constraints -> DROP CONSTRAINT]. \ No newline at end of file +For examples on how to drop constraints, see xref:constraints/managing-constraints.adoc#drop-constraint[Create, show, and drop constraints -> DROP CONSTRAINT]. diff --git a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc index d5e8e7ddb..e91afe906 100644 --- a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc +++ b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc @@ -2454,6 +2454,29 @@ More information can be found xref::planning-and-tuning/operators/operators-deta [[cypher-deprecations-additions-removals-5.3]] == Neo4j 5.3 +=== Deprecated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +//not sure what category this should be, it is more information about a coming breaking change than actual deprecation +label:returnValues[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +SHOW NODE UNIQUENESS CONSTRAINTS YIELD type +---- +a| + +The current constraint type for node property uniqueness constraints, `UNIQUENESS`, will be updated to `NODE_UNIQUENESS` in Neo4j version 6.0. + +This will also be reflected in updates to some error messages and query statistics. + +|=== + === Updated features [cols="2", options="header"] @@ -4305,3 +4328,1584 @@ a| New syntax that enables inlining of `WHERE` clauses inside node patterns. |=== +<<<<<<< HEAD +======= + + +[[cypher-deprecations-additions-removals-4.3]] +== Neo4j 4.3 + +=== Deprecated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON (node:Label) +ASSERT exists(node.property) +---- +a| Replaced by: +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON (node:Label) +ASSERT node.property IS NOT NULL +---- + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON ()-[rel:REL]-() +ASSERT exists(rel.property) +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON ()-[rel:REL]-() +ASSERT rel.property IS NOT NULL +---- + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +exists(prop) +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +prop IS NOT NULL +---- + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +NOT exists(prop) +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +prop IS NULL +---- + +a| +label:syntax[] +label:deprecated[] + +`BRIEF [OUTPUT]` for `SHOW INDEXES` and `SHOW CONSTRAINTS`. +a| +Replaced by default output columns. + + +a| +label:syntax[] +label:deprecated[] + +`VERBOSE [OUTPUT]` for `SHOW INDEXES` and `SHOW CONSTRAINTS`. +a| +Replaced by: +[source, cypher, role="noheader"] +---- +YIELD * +---- + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +SHOW EXISTS CONSTRAINTS +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +SHOW [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +SHOW NODE EXISTS CONSTRAINTS +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +SHOW NODE [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +SHOW RELATIONSHIP EXISTS CONSTRAINTS +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +SHOW RELATIONSHIP [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. + +a| +label:syntax[] +label:deprecated[] + +For privilege commands: +[source, cypher, role="noheader"] +---- +ON DEFAULT DATABASE +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +ON HOME DATABASE +---- + + +a| +label:syntax[] +label:deprecated[] + +For privilege commands: +[source, cypher, role="noheader"] +---- +ON DEFAULT GRAPH +---- +a| +Replaced by: +[source, cypher, role="noheader"] +---- +ON HOME GRAPH +---- + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +MATCH (a) RETURN (a)--() +---- +a| +Pattern expressions producing lists of paths are deprecated, but they can still be used as existence predicates, for example in `WHERE` clauses. +Instead, use a pattern comprehension: +[source, cypher, role="noheader"] +---- +MATCH (a) RETURN [p=(a)--() \| p] +---- +|=== + +=== Updated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW INDEXES WHERE ... +---- +a| +Now allows filtering for: +[source, cypher, role="noheader"] +---- +SHOW INDEXES +---- + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW CONSTRAINTS WHERE ... +---- +a| +Now allows filtering for: +[source, cypher, role="noheader"] +---- +SHOW CONSTRAINTS +---- + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW INDEXES YIELD ... +[WHERE ...] +[RETURN ...] +---- +a| +Now allows `YIELD`, `WHERE`, and `RETURN` clauses to `SHOW INDEXES` to change the output. + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW CONSTRAINTS YIELD ... +[WHERE ...] +[RETURN ...] +---- +a| +Now allows `YIELD`, `WHERE`, and `RETURN` clauses to `SHOW CONSTRAINTS` to change the output. + + +a| +label:syntax[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +a| +New syntax for filtering `SHOW CONSTRAINTS` on property existence constraints. + +Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. + + +a| +label:syntax[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW NODE [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +a| +New syntax for filtering `SHOW CONSTRAINTS` on node property existence constraints. + +Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. + + +a| +label:syntax[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW REL[ATIONSHIP] [PROPERTY] EXIST[ENCE] CONSTRAINTS +---- +a| +New syntax for filtering `SHOW CONSTRAINTS` on relationship property existence constraints. + +Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW FULLTEXT INDEXES +---- +a| +Now allows easy filtering for `SHOW INDEXES` on fulltext indexes. + +Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW LOOKUP INDEXES +---- +a| +Now allows easy filtering for `SHOW INDEXES` on token lookup indexes. + +Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. +|=== + +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE DATABASE ... +[OPTIONS {...}] +---- +a| +New syntax to pass options to `CREATE DATABASE`. +This can be used to specify a specific cluster node to seed data from. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON (node:Label) +ASSERT node.property IS NOT NULL +---- +a| +New syntax for creating node property existence constraints. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] +ON ()-[rel:REL]-() +ASSERT rel.property IS NOT NULL +---- +a| +New syntax for creating relationship property existence constraints. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +ALTER USER name IF EXISTS ... +---- +a| +Makes altering users idempotent. +If the specified name does not exists, no error is thrown. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +ALTER USER ... +SET HOME DATABASE ... +---- +a| +Now allows setting home database for user. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +ALTER USER ... +REMOVE HOME DATABASE +---- +a| +Now allows removing home database for user. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE USER ... +SET HOME DATABASE ... +---- +a| +`CREATE USER` now allows setting home database for user. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW HOME DATABASE +---- +a| +New syntax for showing the home database of the current user. + + +a| +label:syntax[] +label:new[] + +New privilege: +[source, cypher, role="noheader"] +---- +SET USER HOME DATABASE +---- +a| +New Cypher command for administering privilege for changing users home database. + + +a| +label:syntax[] +label:new[] + +For privilege commands: +[source, cypher, role="noheader"] +---- +ON HOME DATABASE +---- +a| +New syntax for privileges affecting home database. + + +a| +label:syntax[] +label:new[] + +For privilege commands: +[source, cypher, role="noheader"] +---- +ON HOME GRAPH +---- +a| +New syntax for privileges affecting home graph. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE FULLTEXT INDEX ... +---- +a| +Allows creating fulltext indexes on nodes or relationships. +They can be dropped by using their name. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE INDEX FOR ()-[r:TYPE]-() ... +---- +a| +Allows creating indexes on relationships with a particular relationship type and property combination. +They can be dropped by using their name. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE LOOKUP INDEX ... +---- +a| +Create token lookup index for nodes with any labels or relationships with any relationship type. +They can be dropped by using their name. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +RENAME ROLE +---- +a| +New Cypher command for changing the name of a role. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +RENAME USER +---- +a| +New Cypher command for changing the name of a user. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW PROCEDURE[S] +[EXECUTABLE [BY {CURRENT USER \| username}]] +[YIELD ...] +[WHERE ...] +[RETURN ...] +---- +a| +New Cypher commands for listing procedures. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW [ALL \| BUILT IN \| USER DEFINED] FUNCTION[S] +[EXECUTABLE [BY {CURRENT USER \| username}]] +[YIELD ...] +[WHERE ...] +[RETURN ...] +---- +a| +New Cypher commands for listing functions. + +|=== + + +[[cypher-deprecations-additions-removals-4.2]] +== Neo4j 4.2 + +=== Deprecated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +0... +---- +a| +Replaced by `+0o...+`. + + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +0X... +---- +a| +Only `+0x...+` (lowercase x) is supported. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +CALL { RETURN 1 } +---- +a| +Unaliased expressions are deprecated in subquery `RETURN` clauses. Replaced by: +[source, cypher, role="noheader"] +---- +CALL { RETURN 1 AS one } +---- +|=== + +=== Updated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW ROLE name PRIVILEGES +---- +a| +Can now handle multiple roles. +[source, cypher, role="noheader"] +---- +SHOW ROLES n1, n2, ... PRIVILEGES +---- + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW USER name PRIVILEGES +---- +a| +Can now handle multiple users. +[source, cypher, role="noheader"] +---- +SHOW USERS n1, n2, ... PRIVILEGES +---- + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +round(expression, precision) +---- +a| +The `round()` function can now take an additional argument to specify rounding precision. + + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +round(expression, precision, mode) +---- +a| +The `round()` function can now take two additional arguments to specify rounding precision and rounding mode. +|=== + +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW PRIVILEGES [AS [REVOKE] COMMAND[S]] +---- +a| +Privileges can now be shown as Cypher commands. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +DEFAULT GRAPH +---- +a| +New optional part of the Cypher commands for database privileges. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +0o... +---- +a| +Cypher now interprets literals with prefix `0o` as an octal integer literal. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +SET [PLAINTEXT \| ENCRYPTED] PASSWORD +---- +a| +For `CREATE USER` and `ALTER USER`, it is now possible to set (or update) a password when the plaintext password is unknown, but the encrypted password is available. + + +a| +label:functionality[] +label:new[] + +New privilege: +[source, cypher, role="noheader"] +---- +EXECUTE +---- +a| +New Cypher commands for administering privileges for executing procedures and user defined functions. +See link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-execute[The DBMS `EXECUTE` privileges]. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE [BTREE] INDEX ... [OPTIONS {...}] +---- +a| +Allows setting index provider and index configuration when creating an index. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT ... IS NODE KEY [OPTIONS {...}] +---- +a| +Allows setting index provider and index configuration for the backing index when creating a node key constraint. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT ... IS UNIQUE [OPTIONS {...}] +---- +a| +Allows setting index provider and index configuration for the backing index when creating a property uniqueness constraint. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW CURRENT USER +---- +a| +New Cypher command for showing current logged-in user and roles. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW [ALL \| BTREE] INDEX[ES] [BRIEF \| VERBOSE [OUTPUT]] +---- +a| +New Cypher commands for listing indexes. + +Replaces the procedures `db.indexes`, `db.indexDetails` (verbose), and partially `db.schemaStatements` (verbose). + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW [ALL \| UNIQUE \| NODE EXIST[S] \| RELATIONSHIP EXIST[S] \| EXIST[S] \| NODE KEY] CONSTRAINT[S] [BRIEF \| VERBOSE [OUTPUT]] +---- +a| +New Cypher commands for listing constraints. + +Replaces the procedures `db.constraints` and partially `db.schemaStatements` (verbose). + +a| +label:functionality[] +label:new[] + +New privilege: +[source, cypher, role="noheader"] +---- +SHOW INDEX +---- +a| +New Cypher command for administering privilege for listing indexes. + + +a| +label:functionality[] +label:new[] + +New privilege: +[source, cypher, role="noheader"] +---- +SHOW CONSTRAINTS +---- +a| +New Cypher command for administering privilege for listing constraints. +|=== + + +[[cypher-deprecations-additions-removals-4.1.3]] +== Neo4j 4.1.3 + +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE INDEX [name] IF NOT EXISTS FOR ... +---- +a| +Makes index creation idempotent. If an index with the name or schema already exists no error will be thrown. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +DROP INDEX name IF EXISTS +---- +a| +Makes index deletion idempotent. If no index with the name exists no error will be thrown. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] IF NOT EXISTS ON ... +---- +a| +Makes constraint creation idempotent. If a constraint with the name or type and schema already exists no error will be thrown. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT name IF EXISTS +---- +a| +Makes constraint deletion idempotent. If no constraint with the name exists no error will be thrown. + +|=== + + +[[cypher-deprecations-additions-removals-4.1]] +== Neo4j 4.1 + +=== Restricted features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:restricted[] +[source, cypher, role="noheader"] +---- +REVOKE ... +---- +a| +No longer revokes sub-privileges when revoking a compound privilege, e.g. when revoking `INDEX MANAGEMENT`, any `CREATE INDEX` and `DROP INDEX` privileges will no longer be revoked. + +a| +label:functionality[] +label:restricted[] +[source, cypher, role="noheader"] +---- +ALL DATABASE PRIVILEGES +---- +a| +No longer includes the privileges `START DATABASE` and `STOP DATABASE`. +|=== + +=== Updated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:procedure[] +label:updated[] +[source, cypher, role="noheader"] +---- +queryId +---- +a| +The `queryId` procedure format has changed, and no longer includes the database name. For example, `mydb-query-123` is now `query-123`. This change affects built-in procedures `dbms.listQueries()`, `dbms.listActiveLocks(queryId)`, `dbms.killQueries(queryIds)` `and dbms.killQuery(queryId)`. + +a| +label:functionality[] +label:updated[] +[source, cypher, role="noheader"] +---- +SHOW PRIVILEGES +---- +a| +The returned privileges are a closer match to the original grants and denies, e.g. if granted `MATCH` the command will show that specific privilege and not the `TRAVERSE` and `READ` privileges. Added support for `YIELD` and `WHERE` clauses to allow filtering results. +|=== + +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:new[] + +New role: +[source, cypher, role="noheader"] +---- +PUBLIC +---- +a| +The `PUBLIC` role is automatically assigned to all users, giving them a set of base privileges. + +a| +label:syntax[] +label:new[] + +For privileges: +[source, cypher, role="noheader"] +---- +REVOKE MATCH +---- +a| +The `MATCH` privilege can now be revoked. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW USERS +---- +a| +New support for `YIELD` and `WHERE` clauses to allow filtering results. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW ROLES +---- +a| +New support for `YIELD` and `WHERE` clauses to allow filtering results. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +SHOW DATABASES +---- +a| +New support for `YIELD` and `WHERE` clauses to allow filtering results. + +a| +label:functionality[] +label:new[] + +link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/database-administration/#access-control-database-administration-transaction[TRANSACTION MANAGEMENT] privileges +a| +New Cypher commands for administering transaction management. + +a| +label:functionality[] +label:new[] + +DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-user-management[USER MANAGEMENT] privileges +a| +New Cypher commands for administering user management. + +a| +label:functionality[] +label:new[] + +DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-database-management[DATABASE MANAGEMENT] privileges +a| +New Cypher commands for administering database management. + +a| +label:functionality[] +label:new[] + +DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-privilege-management[PRIVILEGE MANAGEMENT] privileges +a| +New Cypher commands for administering privilege management. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +ALL DBMS PRIVILEGES +---- +a| +New Cypher command for administering role, user, database and privilege management. + + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +ALL GRAPH PRIVILEGES +---- +a| +New Cypher command for administering read and write privileges. + +a| +label:functionality[] +label:new[] + +Write privileges +a| +New Cypher commands for administering write privileges. + +a| +label:functionality[] +label:new[] +[source, cypher, role="noheader"] +---- +ON DEFAULT DATABASE +---- +a| +New optional part of the Cypher commands for database privileges. +|=== + + +[[cypher-deprecations-additions-removals-4.0]] +== Neo4j 4.0 + +=== Removed features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +rels() +---- +a| +Replaced by xref:functions/list.adoc#functions-relationships[relationships()]. + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +toInt() +---- +a| +Replaced by xref:functions/scalar.adoc#functions-tointeger[toInteger()]. + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +lower() +---- +a| +Replaced by xref:functions/string.adoc#functions-tolower[toLower()]. + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +upper() +---- +a| +Replaced by xref:functions/string.adoc#functions-toupper[toUpper()]. + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +extract() +---- +a| +Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. + +a| +label:function[] +label:removed[] +[source, cypher, role="noheader"] +---- +filter() +---- +a| +Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. + +a| +label:functionality[] +label:removed[] + +For Rule planner: +[source, cypher, role="noheader"] +---- +CYPHER planner=rule +---- +a| +The `RULE` planner was removed in 3.2, but still possible to trigger using `START` or `CREATE UNIQUE` clauses. Now it is completely removed. + + +a| +label:functionality[] +label:removed[] + +Explicit indexes +a| +The removal of the `RULE` planner in 3.2 was the beginning of the end for explicit indexes. Now they are completely removed, including the removal of the link:https://neo4j.com/docs/cypher-manual/3.5/schema/index/#explicit-indexes-procedures[built-in procedures for Neo4j 3.3 to 3.5]. + + +a| +label:functionality[] +label:removed[] + +For compiled runtime: +[source, cypher, role="noheader"] +---- +CYPHER runtime=compiled +---- +a| +Replaced by the new `pipelined` runtime which covers a much wider range of queries. + + +a| +label:clause[] +label:removed[] +[source, cypher, role="noheader"] +---- +CREATE UNIQUE +---- +a| +Running queries with this clause will cause a syntax error. + +a| +label:clause[] +label:removed[] +[source, cypher, role="noheader"] +---- +START +---- +a| +Running queries with this clause will cause a syntax error. + +a| +label:syntax[] +label:removed[] +[source, cypher, role="noheader"] +---- +MATCH (n)-[:A\|:B\|:C {foo: 'bar'}]-() RETURN n +---- +a| +Replaced by `MATCH (n)-[:A\|B\|C {foo: 'bar'}]-() RETURN n`. + +a| +label:syntax[] +label:removed[] +[source, cypher, role="noheader"] +---- +MATCH (n)-[x:A\|:B\|:C]-() RETURN n +---- +a| +Replaced by `MATCH (n)-[x:A\|B\|C]-() RETURN n`. + + +a| +label:syntax[] +label:removed[] +[source, cypher, role="noheader"] +---- +MATCH (n)-[x:A\|:B\|:C*]-() RETURN n +---- +a| +Replaced by `MATCH (n)-[x:A\|B\|C*]-() RETURN n`. + + +a| +label:syntax[] +label:removed[] +[source, cypher, role="noheader"] +---- +{parameter} +---- +a| +Replaced by xref:syntax/parameters.adoc[$parameter]. +|=== + +=== Deprecated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +MATCH (n)-[rs*]-() RETURN rs +---- +a| +As in Cypher 3.2, this is replaced by: +[source, cypher, role="noheader"] +---- +MATCH p=(n)-[*]-() RETURN relationships(p) AS rs +---- + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +CREATE INDEX ON :Label(prop) +---- +a| +Replaced by `CREATE INDEX FOR (n:Label) ON (n.prop)`. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +DROP INDEX ON :Label(prop) +---- +a| +Replaced by `DROP INDEX name`. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT ON (n:Label) ASSERT (n.prop) IS NODE KEY +---- +a| +Replaced by `DROP CONSTRAINT name`. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT ON (n:Label) ASSERT (n.prop) IS UNIQUE +---- +a| +Replaced by `DROP CONSTRAINT name`. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT ON (n:Label) ASSERT exists(n.prop) +---- +a| +Replaced by `DROP CONSTRAINT name`. + +a| +label:syntax[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT ON ()-[r:Type]-() ASSERT exists(r.prop) +---- +a| +Replaced by `DROP CONSTRAINT name`. + +|=== + +=== Restricted features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:function[] +label:restricted[] +[source, cypher, role="noheader"] +---- +length() +---- +a| +Restricted to only work on paths. See xref:functions/scalar.adoc#functions-length[length()] for more details. + +a| +label:function[] +label:restricted[] +[source, cypher, role="noheader"] +---- +size() +---- +a| +Only works for strings, lists and pattern comprehensions, and no longer works for paths. +For versions above 5.0, use a `COUNT` expression instead: +[source, cypher, role="noheader"] +---- +RETURN COUNT { (a)-[]->(b) } +---- +For versions below 5.0, use a pattern comprehension instead: +[source, cypher, role="noheader"] +---- +RETURN size([ (a)-[]->(b) \| a ]) +---- +See xref:functions/scalar.adoc#functions-size[size()] and xref:subqueries/count.adoc[Count Subqueries] for more details. +|=== + +=== Updated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:syntax[] +label:extended[] +[source, cypher, role="noheader"] +---- +CREATE CONSTRAINT [name] ON ... +---- +a| +The create constraint syntax can now include a name. + +The `IS NODE KEY` and `IS UNIQUE` versions of this command replace the procedures `db.createNodeKey` and `db.createUniquePropertyConstraint`, respectively. + +|=== + +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:new[] + +Pipelined runtime: +[source, cypher, role="noheader"] +---- +CYPHER runtime=pipelined +---- +a| +This Neo4j Enterprise Edition only feature involves a new runtime that has many performance enhancements. + +a| +label:functionality[] +label:new[] + +link:{neo4j-docs-base-uri}/operations-manual/current/database-administration/standard-databases/manage-databases/[Multi-database administration] +a| +New Cypher commands for administering multiple databases. + +a| +label:functionality[] +label:new[] + +link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/[Access control] +a| +New Cypher commands for administering role-based access control. + +a| +label:functionality[] +label:new[] + +link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/manage-privileges/[Fine-grained security] +a| +New Cypher commands for administering dbms, database, graph and sub-graph access control. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +CREATE INDEX [name] FOR (n:Label) ON (n.prop) +---- +a| +New syntax for creating indexes, which can include a name. + +Replaces the `db.createIndex` procedure. + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +DROP INDEX name +---- +a| +xref:indexes/search-performance-indexes/managing-indexes.adoc#indexes-drop-an-index[New command] for dropping an index by name. + + +a| +label:syntax[] +label:new[] +[source, cypher, role="noheader"] +---- +DROP CONSTRAINT name +---- +a| +<<<<<<< HEAD +xref:constraints/managing-constraints.adoc#drop-constraint[New command] for dropping a constraint by name, no matter the type. +======= +xref:constraints/syntax.adoc#constraints-syntax-drop[New command] for dropping a constraint by name, no matter the type. +>>>>>>> b38c1e9 (Document relationship key and uniqueness constraints (#225)) + + +a| +label:clause[] +label:new[] +[source, cypher, role="noheader"] +---- +WHERE EXISTS {...} +---- +a| +`EXISTS` subqueries are subclauses used to filter the results of a `MATCH`, `OPTIONAL MATCH`, or `WITH` clause. + +a| +label:clause[] +label:new[] +[source, cypher, role="noheader"] +---- +USE neo4j +---- +a| +New clause to specify which graph a query, or query part, is executed against. + +|=== + + +[[cypher-deprecations-additions-removals-3.5]] +== Neo4j 3.5 + +=== Deprecated features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:deprecated[] + +Compiled runtime: +[source, cypher, role="noheader"] +---- +CYPHER runtime=compiled +---- +a| +The compiled runtime will be discontinued in the next major release. It might still be used for default queries in order to not cause regressions, but explicitly requesting it will not be possible. + +a| +label:function[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +extract() +---- +a| +Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. + +a| +label:function[] +label:deprecated[] +[source, cypher, role="noheader"] +---- +filter() +---- +a| +Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. +|=== + + +[[cypher-deprecations-additions-removals-3.4]] +== Neo4j 3.4 +[options="header"] +|=== +| Feature | Type | Change | Details +| xref:values-and-types/spatial.adoc[Spatial point types] | Functionality | Amendment | A point -- irrespective of which Coordinate Reference System is used -- can be stored as a property and is able to be backed by an index. Prior to this, a point was a virtual property only. +| xref:functions/spatial.adoc#functions-point-cartesian-3d[point() - Cartesian 3D] | Function | Added | +| xref:functions/spatial.adoc#functions-point-wgs84-3d[point() - WGS 84 3D] | Function | Added | +| xref:functions/scalar.adoc#functions-randomuuid[randomUUID()] | Function | Added | +| xref:values-and-types/temporal.adoc[Temporal types] | Functionality | Added | Supports storing, indexing and working with the following temporal types: Date, Time, LocalTime, DateTime, LocalDateTime and Duration. +| xref:functions/temporal/index.adoc[Temporal functions] | Functionality | Added | Functions allowing for the creation and manipulation of values for each temporal type -- _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ and _Duration_. +| xref:syntax/operators.adoc#query-operators-temporal[Temporal operators] | Functionality | Added | Operators allowing for the manipulation of values for each temporal type -- _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ and _Duration_. +| xref:functions/string.adoc#functions-tostring[toString()] | Function | Extended | Now also allows temporal values as input (i.e. values of type _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ or _Duration_). +|=== + + +[[cypher-deprecations-additions-removals-3.3]] +== Neo4j 3.3 +[options="header"] +|=== +| Feature | Type | Change | Details +| `START` | Clause | Removed | As in Cypher 3.2, any queries using the `START` clause will revert back to Cypher 3.1 `planner=rule`. +However, there are link:https://neo4j.com/docs/cypher-manual/3.5/schema/index/#explicit-indexes-procedures[built-in procedures for Neo4j versions 3.3 to 3.5] for accessing explicit indexes. The procedures will enable users to use the current version of Cypher and the cost planner together with these indexes. +An example of this is `CALL db.index.explicit.searchNodes('my_index','email:me*')`. +| `CYPHER runtime=slotted` (Faster interpreted runtime) | Functionality | Added | Neo4j Enterprise Edition only +| xref:functions/aggregating.adoc#functions-max[max()], xref:functions/aggregating.adoc#functions-min[min()] | Function | Extended | Now also supports aggregation over sets containing lists of strings and/or numbers, as well as over sets containing strings, numbers, and lists of strings and/or numbers +|=== + + +[[cypher-deprecations-additions-removals-3.2]] +== Neo4j 3.2 +[options="header"] +|=== +| Feature | Type | Change | Details +| `CYPHER planner=rule` (Rule planner) | Functionality | Removed | All queries now use the cost planner. Any query prepended thus will fall back to using Cypher 3.1. +| `CREATE UNIQUE` | Clause | Removed | Running such queries will fall back to using Cypher 3.1 (and use the rule planner) +| `START` | Clause | Removed | Running such queries will fall back to using Cypher 3.1 (and use the rule planner) +| `MATCH (n)-[rs*]-() RETURN rs` | Syntax | Deprecated | Replaced by `MATCH p=(n)-[*]-() RETURN relationships(p) AS rs` +| `MATCH (n)-[:A\|:B\|:C {foo: 'bar'}]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[:A\|B\|C {foo: 'bar'}]-() RETURN n` +| `MATCH (n)-[x:A\|:B\|:C]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C]-() RETURN n` +| `MATCH (n)-[x:A\|:B\|:C*]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C*]-() RETURN n` +| link:/docs/java-reference/5/extending-neo4j/aggregation-functions#extending-neo4j-aggregation-functions[User-defined aggregation functions] | Functionality | Added | +<<<<<<< HEAD +| xref:indexes/search-performance-indexes/managing-indexes.adoc[Composite indexes] | Index | Added | +| xref:constraints/managing-constraints.adoc#create-key-constraint[Node Key] | Index | Added | Neo4j Enterprise Edition only +======= +| xref:indexes-for-search-performance.adoc[Composite indexes] | Index | Added | +| xref:constraints/examples.adoc#constraints-examples-node-key[Node Key] | Index | Added | Neo4j Enterprise Edition only +>>>>>>> b38c1e9 (Document relationship key and uniqueness constraints (#225)) +| `CYPHER runtime=compiled` (Compiled runtime) | Functionality | Added | Neo4j Enterprise Edition only +| xref:functions/list.adoc#functions-reverse-list[reverse()] | Function | Extended | Now also allows a list as input +| xref:functions/aggregating.adoc#functions-max[max()], xref:functions/aggregating.adoc#functions-min[min()] | Function | Extended | Now also supports aggregation over a set containing both strings and numbers +|=== + + +[[cypher-deprecations-additions-removals-3.1]] +== Neo4j 3.1 +[options="header"] +|=== +| Feature | Type | Change | Details +| `rels()` | Function | Deprecated | Replaced by xref:functions/list.adoc#functions-relationships[relationships()] +| `toInt()` | Function | Deprecated | Replaced by xref:functions/scalar.adoc#functions-tointeger[toInteger()] +| `lower()` | Function | Deprecated | Replaced by xref:functions/string.adoc#functions-tolower[toLower()] +| `upper()` | Function | Deprecated | Replaced by xref:functions/string.adoc#functions-toupper[toUpper()] +| xref:functions/scalar.adoc#functions-toboolean[toBoolean()] | Function | Added | +| xref:values-and-types/maps.adoc#cypher-map-projection[Map projection] | Syntax | Added | +| xref:values-and-types/lists.adoc#cypher-pattern-comprehension[Pattern comprehension] | Syntax | Added | +| link:/docs/java-reference/5/extending-neo4j/functions#extending-neo4j-functions[User-defined functions] | Functionality | Added | +| xref:clauses/call.adoc[CALL\...YIELD\...WHERE] | Clause | Extended | Records returned by `YIELD` may be filtered further using `WHERE` +|=== + + +[[cypher-deprecations-additions-removals-3.0]] +== Neo4j 3.0 +[options="header"] +|=== +| Feature | Type | Change | Details +| `has()` | Function | Removed | Replaced by xref:functions/predicate.adoc#functions-exists[exists()] +| `str()` | Function | Removed | Replaced by xref:functions/string.adoc#functions-tostring[toString()] +| `+{parameter}+` | Syntax | Deprecated | Replaced by xref:syntax/parameters.adoc[$parameter] +| xref:functions/scalar.adoc#functions-properties[properties()] | Function | Added | +| xref:clauses/call.adoc[CALL [\...YIELD\]] | Clause | Added | +| xref:functions/spatial.adoc#functions-point-cartesian-2d[point() - Cartesian 2D] | Function | Added | +| xref:functions/spatial.adoc#functions-point-wgs84-2d[point() - WGS 84 2D] | Function | Added | +| xref:functions/spatial.adoc#functions-distance[distance()] | Function | Added | +| link:/docs/java-reference/5/extending-neo4j/procedures#extending-neo4j-procedures[User-defined procedures] | Functionality | Added | +| xref:functions/string.adoc#functions-tostring[toString()] | Function | Extended | Now also allows Boolean values as input +|=== +>>>>>>> 5ec3805 (Document relationship key and uniqueness constraints (#225)) From d7f918ee38d88eb5a82694e7ad74c4a3d6615657 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Mon, 30 Jan 2023 09:11:15 +0100 Subject: [PATCH 16/32] Update CALL subquery examples for testing (#348) (#354) Original PR: https://github.com/neo4j/docs-cypher/pull/348 Fix unterminated example block in alias page. --- modules/ROOT/pages/clauses/call-subquery.adoc | 717 ++++++++++++++++++ 1 file changed, 717 insertions(+) create mode 100644 modules/ROOT/pages/clauses/call-subquery.adoc diff --git a/modules/ROOT/pages/clauses/call-subquery.adoc b/modules/ROOT/pages/clauses/call-subquery.adoc new file mode 100644 index 000000000..34dd53746 --- /dev/null +++ b/modules/ROOT/pages/clauses/call-subquery.adoc @@ -0,0 +1,717 @@ +:description: The `+CALL {}+` clause evaluates a subquery that returns some values. + +[[query-call-subquery]] += +CALL {}+ (subquery) + +[abstract] +-- +The `+CALL {}+` clause evaluates a subquery that returns some values. +-- + +`CALL` allows to execute subqueries, i.e. queries inside of other queries. +Subqueries allow you to compose queries, which is especially useful when working with `UNION` or aggregations. + +[TIP] +==== +The `CALL` clause is also used for calling procedures. +For descriptions of the `CALL` clause in this context, refer to xref::clauses/call.adoc[`CALL` procedure]. +==== + +Subqueries which end in a `RETURN` statement are called _returning subqueries_ while subqueries without such a return statement are called _unit subqueries_. + +A subquery is evaluated for each incoming input row. +Every output row of a _returning subquery_ is combined with the input row to build the result of the subquery. +That means that a returning subquery will influence the number of rows. +If the subquery does not return any rows, there will be no rows available after the subquery. + +_Unit subqueries_ on the other hand are called for their side-effects and not for their results and do therefore not influence the results of the enclosing query. + +There are restrictions on how subqueries interact with the enclosing query: + +* A subquery can only refer to variables from the enclosing query if they are explicitly imported. +* A subquery cannot return variables with the same names as variables in the enclosing query. +* All variables that are returned from a subquery are afterwards available in the enclosing query. + +The following graph is used for the examples below: + +image:graph_call_subquery_clause.svg[] + +To recreate the graph, run the following query in an empty Neo4j database: + +[source, cypher, role=test-setup] +---- +CREATE + (a:Person:Child {age: 20, name: 'Alice'}), + (b:Person {age: 27, name: 'Bob'}), + (c:Person:Parent {age: 65, name: 'Charlie'}), + (d:Person {age: 30, name: 'Dora'}) + CREATE (a)-[:FRIEND_OF]->(b) + CREATE (a)-[:CHILD_OF]->(c) +CREATE (:Counter {count: 0}) +---- + + +[[call-semantics]] +== Semantics + +A `CALL` clause is executed once for each incoming row. + + +.Execute for each incoming row +====== + +The `CALL` clause executes three times, one for each row that the `UNWIND` clause outputs. + +.Query +[source, cypher] +---- +UNWIND [0, 1, 2] AS x +CALL { + RETURN 'hello' AS innerReturn +} +RETURN innerReturn +---- + +.Result +[role="queryresult",options="header,footer",cols="m"] +|=== +| +innerReturn+ +| +'hello'+ +| +'hello'+ +| +'hello'+ +d|Rows:3 +|=== +====== + +Each execution of a `CALL` clause can observe changes from previous executions. + + +.Observe changes from previous execution +====== + +.Query +[source, cypher] +---- +UNWIND [0, 1, 2] AS x +CALL { + MATCH (n:Counter) + SET n.count = n.count + 1 + RETURN n.count AS innerCount +} +WITH innerCount +MATCH (n:Counter) +RETURN + innerCount, + n.count AS totalCount +---- + +.Result +[role="queryresult",options="header,footer",cols=""2*(next) + RETURN current AS from, next AS to +} +RETURN + from.name AS name, + from.age AS age, + to.name AS closestOlderName, + to.age AS closestOlderAge +---- + +.Result +[role="queryresult",options="header,footer",cols="4*(other:Person) + RETURN other +UNION + WITH p + OPTIONAL MATCH (p)-[:CHILD_OF]->(other:Parent) + RETURN other +} +RETURN DISTINCT p.name, count(other) +---- + +.Result +[role="queryresult",options="header,footer",cols="2*(b), + (a)-[:CHILD_OF]->(c) +---- +//// + +[[subquery-correlated-aggregation]] +== Aggregation on imported variables + +Aggregations in subqueries are scoped to the subquery evaluation, also for imported variables. +The following example counts the number of younger persons for each person in the graph: + +.Query +[source, cypher] +---- +MATCH (p:Person) +CALL { + WITH p + MATCH (other:Person) + WHERE other.age < p.age + RETURN count(other) AS youngerPersonsCount +} +RETURN p.name, youngerPersonsCount +---- + +.Result +[role="queryresult",options="header,footer",cols="2* 100 +CALL { + WITH n + DETACH DELETE n +} IN TRANSACTIONS +---- + +.Result +[role="queryresult",options="footer",cols="1* 2 + RETURN l AS largeLists +} +RETURN largeLists +---- + +.Error message +[source, error] +---- +Importing WITH should consist only of simple references to outside variables. +WHERE is not allowed. +---- + +A solution to this restriction, necessary for any filtering or ordering of an importing `WITH` clause, is to declare a second `WITH` clause after the importing `WITH` clause. +This second `WITH` clause will act as a regular `WITH` clause. +For example, the following query will not throw an error: + +.Query +[source, cypher] +---- +UNWIND [[1,2],[1,2,3,4],[1,2,3,4,5]] AS l +CALL { + WITH l + WITH size(l) AS size, l AS l + WHERE size > 2 + RETURN l AS largeLists +} +RETURN largeLists +---- + +.Result +[role="queryresult",options="header,footer",cols="1* Date: Fri, 10 Feb 2023 08:24:09 +0100 Subject: [PATCH 17/32] Mirror changes for testing in `operators.adoc` (#390, #395) --- .../pages/planning-and-tuning/operators/operators-detail.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/planning-and-tuning/operators/operators-detail.adoc b/modules/ROOT/pages/planning-and-tuning/operators/operators-detail.adoc index 946be091a..5c38c948d 100644 --- a/modules/ROOT/pages/planning-and-tuning/operators/operators-detail.adoc +++ b/modules/ROOT/pages/planning-and-tuning/operators/operators-detail.adoc @@ -7084,4 +7084,4 @@ Runtime version {neo4j-version} Total database accesses: 0, total allocated memory: 64 ---- -====== +====== \ No newline at end of file From 9f46a4dbdf8559598dfbbfcb3d6682c936cd8b55 Mon Sep 17 00:00:00 2001 From: Stefano Ottolenghi Date: Mon, 13 Feb 2023 11:01:58 +0100 Subject: [PATCH 18/32] Make example in `limit.adoc` deterministic (#411) This makes the example always return the same result by enforcing an ordering, so that we don't need to skip testing its result (this PR updates #405). The sense of the example is unaffected. --- modules/ROOT/pages/clauses/limit.adoc | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/ROOT/pages/clauses/limit.adoc b/modules/ROOT/pages/clauses/limit.adoc index 243b948d4..3b073d627 100644 --- a/modules/ROOT/pages/clauses/limit.adoc +++ b/modules/ROOT/pages/clauses/limit.adoc @@ -146,6 +146,7 @@ MATCH (n) WITH n ORDER BY n.name LIMIT 1 SET n.locked = true RETURN n +ORDER BY n.name ---- Writes `locked` property on one node and return that node: From ce4a0768591e6dc3184bd155988a742ef31cf803 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Fri, 17 Mar 2023 10:56:32 +0100 Subject: [PATCH 19/32] Update show output column lists (#473) Original PR: https://github.com/neo4j/docs-cypher/pull/464 Cherry-pick excludes 5.6 specific content in original PR Co-authored-by: Therese Magnusson --- .../access-control/manage-privileges.adoc | 1436 +++++++++++++++++ .../pages/access-control/manage-roles.adoc | 816 ++++++++++ .../pages/access-control/manage-servers.adoc | 423 +++++ .../pages/access-control/manage-users.adoc | 864 ++++++++++ .../pages/clauses/transaction-clauses.adoc | 4 - 5 files changed, 3539 insertions(+), 4 deletions(-) create mode 100644 modules/ROOT/pages/access-control/manage-privileges.adoc create mode 100644 modules/ROOT/pages/access-control/manage-roles.adoc create mode 100644 modules/ROOT/pages/access-control/manage-servers.adoc create mode 100644 modules/ROOT/pages/access-control/manage-users.adoc diff --git a/modules/ROOT/pages/access-control/manage-privileges.adoc b/modules/ROOT/pages/access-control/manage-privileges.adoc new file mode 100644 index 000000000..1b867d74d --- /dev/null +++ b/modules/ROOT/pages/access-control/manage-privileges.adoc @@ -0,0 +1,1436 @@ +:description: This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. +[role=enterprise-edition aura-db-enterprise] +[[access-control-manage-privileges]] + += Managing privileges + +[abstract] +-- +This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. +-- + +Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. +It is possible to grant or deny access, or use a combination of the two. +The user will be able to access the resource if they have a `GRANT` (allowlist) and do not have a `DENY` (denylist) relevant to that resource. +All other combinations of `GRANT` and `DENY` will result in the matching path being inaccessible. +What this means in practice depends on whether we are talking about a xref::access-control/privileges-reads.adoc[read privilege] or a xref::access-control/privileges-writes.adoc[write privilege]: + +* If an entity is not accessible due to xref::access-control/privileges-reads.adoc[read privileges], the data will become invisible. +It will appear to the user as if they had a smaller database (smaller graph). +* If an entity is not accessible due to xref::access-control/privileges-writes.adoc[write privileges], an error will occur on any attempt to write that data. + +[NOTE] +==== +In this document we will often use the terms _'allows'_ and _'enables'_ in seemingly identical ways. However, there is a subtle difference. +We will use _'enables'_ to refer to the consequences of xref::access-control/privileges-reads.adoc[read privileges] where a restriction will not cause an error, only a reduction in the apparent graph size. +We will use _'allows'_ to refer to the consequence of xref::access-control/privileges-writes.adoc[write privileges] where a restriction can result in an error. +==== + +[NOTE] +==== +If a user was not also provided with the database `ACCESS` privilege, then access to the entire database will be denied. +Information about the database access privilege can be found in xref::access-control/database-administration.adoc#access-control-database-administration-access[The ACCESS privilege]. +==== + +[NOTE] +==== +The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. +==== + +[[access-control-graph-privileges]] +== Graph privilege commands (`GRANT`, `DENY` and `REVOKE`) + +Administrators can use Cypher commands to manage Neo4j graph administrative rights. +The components of the graph privilege commands are: + +* _the command_: +** `GRANT` – gives privileges to roles. +** `DENY` – denies privileges to roles. +** `REVOKE` – removes granted or denied privileges from roles. + +* _mutability_: +** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. See also xref:access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. + +* _graph-privilege_: +** Can be either a xref::access-control/privileges-reads.adoc[read privilege] or xref::access-control/privileges-writes.adoc[write privilege]. + +* _name_: +** The graph or graphs to associate the privilege with. +Because in Neo4j {neo4j-version} you can have only one graph per database, this command uses the database name or alias to refer to that graph. +When using an alias, the command will be executed on the resolved graph. ++ +[NOTE] +==== +If you delete a database and create a new one with the same name, the new one will _NOT_ have the privileges previously assigned to the deleted graph. +==== +** It can be `+*+`, which means all graphs. +Graphs created after this command execution will also be associated with these privileges. + +** `HOME GRAPH` refers to the graph associated with the home database for that user. +The default database will be used as home database if a user does not have one configured. +If the user's home database changes for any reason after privileges have been created, then these privileges will be associated with the graph attached to the new database. +This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user's home database. + +* _entity_ +** The graph elements this privilege applies to: +*** `NODES` label (nodes with the specified label(s)). +*** `RELATIONSHIPS` type (relationships of the specific type(s)). +*** `ELEMENTS` label (both nodes and relationships). +** The label or type can be referred with `+*+`, which means all labels or types. +** Multiple labels or types can be specified, comma-separated. +** Defaults to `ELEMENTS` `+*+` if omitted. +** Some of the commands for write privileges do not allow an _entity_ part. +See xref::access-control/privileges-writes.adoc[Write privileges] for details. +* _role[, ...]_ +** The role or roles to associate the privilege with, comma-separated. + +.General grant +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] +---- + +| Description +a| Grants a privilege to one or multiple roles. + +|=== + +.General deny +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +DENY ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +DENY [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] +---- + +| Description +a| Denies a privilege to one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE GRANT ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] GRANT graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] +---- +| Description +a| Revokes a granted privilege from one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE DENY ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] DENY graph-privilege ON { HOME GRAPH \| GRAPH[S] {* \| name[, ...] } } [entity] FROM role[, ...] +---- + +| Description +a| Revokes a denied privilege from one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] +---- + +| Description +| Revokes a granted or denied privilege from one or multiple roles. +|=== + +[NOTE] +==== +`DENY` does NOT erase a granted privilege; they both exist. +Use `REVOKE` if you want to remove a privilege. +==== + +The general `GRANT` and `DENY` syntaxes are illustrated in the following image: + +image::privileges_grant_and_deny_syntax.svg[title="GRANT and DENY Syntax"] + +A more detailed syntax illustration for graph privileges would be the following: + +image::privileges_on_graph_syntax.svg[title="Syntax of GRANT and DENY Graph Privileges. The `{` and `}` are part of the syntax and not used for grouping."] + +The following image shows the hierarchy between different graph privileges: + +image::privileges_hierarchy.svg[title="Graph privileges hierarchy"] + +[[access-control-list-privileges]] +== Listing privileges + +Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. + +.Show privileges command syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- +| Description +| List all privileges. + +|=== + +.Show role privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW ROLE ... PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +| Lists privileges for a specific role. + +|=== + +.Show user privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW USER ... PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +| Lists privileges for a specific user, or the current user. + +[NOTE] +==== +Please note that it is only possible for a user to show their own privileges. +Therefore, if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work in a limited capacity. + +Other users' privileges cannot be listed when using a non-native auth provider. +==== +|=== + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For an easy overview of the existing privileges, it is recommended to use the `AS COMMANDS` version of the `SHOW` command. +This returns the column `command` of type `STRING` containing the privileges as the commands that are granted or denied. + +When omitting the `AS COMMANDS` clause, results will include multiple columns describing privileges: + +[options="header", width="100%", cols="4m,6a,2m"] +|=== +| Column | Description | Type + +| access +| Whether the privilege is granted or denied. +| STRING + +| action +| The type of the privilege. +E.g., traverse, read, index management, or role management. +| STRING + +| resource +| The scope of the privilege. +E.g., the entire DBMS, a specific database, a graph, or sub-graph access. +| STRING + +| graph +| The specific database or graph the privilege applies to. +| STRING + +| segment +| The labels, relationship types, procedures, functions, transactions or settings the privilege applies to (if applicable). +| STRING + +| role +| The role the privilege is granted to. +| STRING + +| immutable +| Whether or not the privilege is immutable. + +This column is also available for the `AS COMMAND` variant using `YIELD`. +| BOOLEAN + +| user +| The user the privilege belongs to. + +Note that this is only returned for `SHOW USER [username] PRIVILEGES`. +| STRING + +|=== + +[[access-control-list-all-privileges]] +=== Examples for listing all privileges + +Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. + +[source, syntax] +---- +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES +---- + +Lists all privileges for all roles: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|segment +|role +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"admin" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"admin" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"admin" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"admin" +|false + +|"GRANTED" +|"transaction_management" +|"database" +|"*" +|"USER(*)" +|"admin" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"constraint" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"dbms_actions" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"index" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"start_database" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"stop_database" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"architect" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"architect" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"architect" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"architect" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"constraint" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"index" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"editor" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"editor" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"editor" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"editor" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"editor" +|false + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"publisher" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"publisher" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"publisher" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"publisher" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"publisher" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"publisher" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"reader" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"reader" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"reader" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 39 +|=== + +It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD role, access, action, segment +ORDER BY action +WHERE role = 'admin' +---- + +In this example: + +* The number of columns returned has been reduced with the `YIELD` clause. +* The order of the returned columns has been changed. +* The results have been filtered to only return the `admin` role using a `WHERE` clause. +* The results are ordered by the `action` column using `ORDER BY`. + +`SKIP` and `LIMIT` can also be used to paginate the results. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m"] +|=== +|role +|access +|action +|segment + +|"admin" +|"GRANTED" +|"access" +|"database" + +|"admin" +|"GRANTED" +|"constraint" +|"database" + +|"admin" +|"GRANTED" +|"dbms_actions" +|"database" + +|"admin" +|"GRANTED" +|"index" +|"database" + +|"admin" +|"GRANTED" +|"match" +|"NODE(*)" + +|"admin" +|"GRANTED" +|"match" +|"RELATIONSHIP(*)" + +|"admin" +|"GRANTED" +|"start_database" +|"database" + +|"admin" +|"GRANTED" +|"stop_database" +|"database" + +|"admin" +|"GRANTED" +|"token" +|"database" + +|"admin" +|"GRANTED" +|"transaction_management" +|"USER(*)" + +|"admin" +|"GRANTED" +|"write" +|"NODE(*)" + +|"admin" +|"GRANTED" +|"write" +|"RELATIONSHIP(*)" + +4+a|Rows: 12 +|=== + +`WHERE` can also be used without `YIELD`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES +WHERE graph <> '*' +---- + +In this example, the `WHERE` clause is used to filter privileges down to those that target specific graphs only. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment + +|"GRANTED" +|"access" +|"DEFAULT" +|"database" +|"PUBLIC" +|"database" + +|"DENIED" +|"access" +|"neo4j" +|"database" +|"noAccessUsers" +|"database" + +|"GRANTED" +|"access" +|"neo4j" +|"database" +|"regularUsers" +|"database" + +6+a|Rows: 3 +|=== + +Aggregations in the `RETURN` clause can be used to group privileges. +In this case, by user and `GRANTED` or `DENIED`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) AS privileges +---- + +.Result +[options="header,footer", width="100%", cols="1m,1m,3m"] +|=== +|role +|access +|privileges + +|"PUBLIC" +|"GRANTED" +|[["\*","database","FUNCTION(*)","execute"],["\*","database","PROCEDURE(*)","execute"],["DEFAULT","database","database","access"]] + +|"admin" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","USER(*)","transaction_management"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","dbms_actions"],["*","database","database","index"],["\*","database","database","start_database"],["*","database","database","stop_database"],["*","database","database","token"]] + +|"architect" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","index"],["*","database","database","token"]] + +|"editor" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"]] + +|"noAccessUsers" +|"DENIED" +|[["neo4j","database","database","access"]] + +|"publisher" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","token"]] + +|"reader" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","all_properties","RELATIONSHIP(*)","match"],["*","database","database","access"]] + +|"regularUsers" +|"GRANTED" +|[["neo4j","database","database","access"]] + +3+a|Rows: 8 +|=== + +The `RETURN` clause can also be used to order and paginate the results, which is useful when combined with `YIELD` and `WHERE`. +In this example the query returns privileges for display five-per-page, and skips the first five to display the second page. + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5 +---- + +.Result +[options="header,footer", width="100%", cols="2m,2m,1m,2m,1m,2m,1m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"match" +|"*" +|"all_properties" +|"admin" +|"RELATIONSHIP(*)" +|false + +|"GRANTED" +|"write" +|"*" +|"graph" +|"admin" +|"RELATIONSHIP(*)" +|false + +|"GRANTED" +|"transaction_management" +|"*" +|"database" +|"admin" +|"USER(*)" +|false + +|"GRANTED" +|"access" +|"*" +|"database" +|"admin" +|"database" +|false + +|"GRANTED" +|"constraint" +|"*" +|"database" +|"admin" +|"database" +|false + +6+a|Rows: 5 +|=== + +Available privileges can also be displayed as Cypher commands by adding `AS COMMAND[S]`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" +|"GRANT ACCESS ON DATABASE * TO `admin`" +|"GRANT ACCESS ON DATABASE * TO `architect`" +|"GRANT ACCESS ON DATABASE * TO `editor`" +|"GRANT ACCESS ON DATABASE * TO `publisher`" +|"GRANT ACCESS ON DATABASE * TO `reader`" +|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" +|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" +|"GRANT START ON DATABASE * TO `admin`" +|"GRANT STOP ON DATABASE * TO `admin`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `architect`" +|"GRANT WRITE ON GRAPH * TO `editor`" +|"GRANT WRITE ON GRAPH * TO `publisher`" +a|Rows: 35 +|=== + +Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS COMMANDS +WHERE command CONTAINS 'MANAGEMENT' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +a|Rows: 8 +|=== + +It is also possible to get the privileges listed as revoking commands instead of granting or denying: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS REVOKE COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE DENY ACCESS ON DATABASE `neo4j` FROM `noAccessUsers`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `admin`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `architect`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `editor`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" +|"REVOKE GRANT ACCESS ON DATABASE `neo4j` FROM `regularUsers`" +|"REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`" +|"REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`" +|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM `PUBLIC`" +|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`" +|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`" +|"REVOKE GRANT START ON DATABASE * FROM `admin`" +|"REVOKE GRANT STOP ON DATABASE * FROM `admin`" +|"REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `admin`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `architect`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `editor`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `publisher`" +a|Rows: 35 +|=== + +For more info about revoking privileges, please see xref::access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. + +[[access-control-list-privileges-role]] +=== Examples for listing privileges for specific roles + +Available privileges for specific roles can be displayed using `SHOW ROLE name PRIVILEGE[S]`: + +[source, syntax] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW ROLE regularUsers PRIVILEGES +---- + +Lists all privileges for role `regularUsers`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 1 +|=== + +[source, cypher, role=noplay] +---- +SHOW ROLES regularUsers, noAccessUsers PRIVILEGES +---- + +Lists all privileges for roles `regularUsers` and `noAccessUsers`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 2 +|=== + +Similar to the other `SHOW PRIVILEGES` commands, the available privileges for roles can also be listed as Cypher commands with the optional `AS COMMAND[S]`. + +[source, cypher, role=noplay] +---- +SHOW ROLES regularUsers, noAccessUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `admin`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT START ON DATABASE * TO `admin`" +|"GRANT STOP ON DATABASE * TO `admin`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `admin`" +a|Rows: 11 +|=== + +The output can be processed using `YIELD` / `WHERE` / `RETURN` here as well: + +[source, cypher, role=noplay] +---- +SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" +|Rows: 2 +|=== + +Again, it is possible to get the privileges listed as revoking commands instead of granting or denying. +For more info about revoking privileges, please see xref::access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. + +[source, cypher, role=noplay] +---- +SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" +a|Rows: 3 +|=== + +[[access-control-list-privileges-user]] +=== Examples for listing privileges for specific users + +Available privileges for specific users can be displayed using `SHOW USER name PRIVILEGES`. + +[NOTE] +==== +Note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity as it is only possible for a user to show their own privileges. +Other users' privileges cannot be listed when using a non-native auth provider. +==== + +[source, syntax] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES +---- + +Lists all privileges for user `jake`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|"jake" +|false + +7+a|Rows: 4 +|=== + +[source, cypher, role=noplay] +---- +SHOW USERS jake, joe PRIVILEGES +---- + +Lists all privileges for users `jake` and `joe`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"joe" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"joe" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"joe" +|false + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|"joe" +|false + +7+a|Rows: 8 +|=== + +The same command can be used at all times to review available privileges for the current user. +For this purpose, there is a shorter form of the command: `SHOW USER PRIVILEGES`: + +[source, cypher, role=noplay] +---- +SHOW USER PRIVILEGES +---- + +As for the other privilege commands, available privileges for users can also be listed as Cypher commands with the optional `AS COMMAND[S]`. + +[NOTE] +==== +When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. +This can be used to quickly create new roles based on the privileges of specific users. +==== + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE `neo4j` TO $role" +|"GRANT ACCESS ON HOME DATABASE TO $role" +|"GRANT EXECUTE FUNCTION * ON DBMS TO $role" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO $role" +a|Rows: 4 +|=== + +Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`. +Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges. + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES AS REVOKE COMMANDS +WHERE command CONTAINS 'EXECUTE' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM $role" +|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role" +a|Rows: 2 +|=== + +[[access-control-revoke-privileges]] +== Revoking privileges + +Privileges that were granted or denied earlier can be revoked using the `REVOKE` command: + +[source, syntax] +---- +REVOKE + [ IMMUTABLE ] + [ GRANT | DENY ] graph-privilege + FROM role[, ...] +---- + +An example usage of the `REVOKE` command is given here: + +[source, cypher, role=noplay] +---- +REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers +---- + +While it can be explicitly specified that `REVOKE` should remove a `GRANT` or `DENY`, it is also possible to `REVOKE` both by not specifying them at all, as the next example demonstrates. +Because of this, if there happens to be a `GRANT` and a `DENY` for the same privilege, it would remove both. + +[source, cypher, role=noplay] +---- +REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers +---- + +Adding `IMMUTABLE` explicitly specifies that only immutable privileges should be removed. Omitting it specifies that both immutable and regular privileges should be removed. diff --git a/modules/ROOT/pages/access-control/manage-roles.adoc b/modules/ROOT/pages/access-control/manage-roles.adoc new file mode 100644 index 000000000..e12aa550a --- /dev/null +++ b/modules/ROOT/pages/access-control/manage-roles.adoc @@ -0,0 +1,816 @@ +:description: This section explains how to use Cypher to manage roles in Neo4j. + +[role=enterprise-edition aura-db-enterprise] +[[access-control-manage-roles]] += Managing roles + +//// +[source, cypher, role=test-setup] +---- +CREATE USER bob SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user1 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user2 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user3 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE ROLE myrole IF NOT EXISTS; +CREATE ROLE role1 IF NOT EXISTS; +CREATE ROLE role2 IF NOT EXISTS; +---- +//// + +[abstract] +-- +This section explains how to use Cypher to manage roles in Neo4j. +-- + +Roles can be created and managed using a set of Cypher administration commands executed against the `system` database. + +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[access-control-role-syntax]] +== Role management command syntax + +[NOTE] +==== +The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. +==== + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW [ALL\|POPULATED] ROLE[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists roles. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW ROLE +---- + + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]). +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLES WITH USERS + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW [ALL\|POPULATED] ROLE[S] WITH USER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists roles and users assigned to them. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + + +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLE PRIVILEGES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the privileges granted to the specified roles. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW PRIVILEGE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + + +| Command +m| CREATE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] +---- + +| Description +a| +Creates a new role. + +For more information, see xref::access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| CREATE OR REPLACE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE ROLE name [AS COPY OF otherName] +---- + +| Description +a| +Creates a new role, or if a role with the same name exists, replace it. + +For more information, see xref::access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE ROLE +---- + +[source, privilege, role="noheader"] +---- +GRANT DROP ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| RENAME ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +RENAME ROLE name [IF EXISTS] TO otherName +---- + +| Description +a| +Changes the name of a role. + +For more information, see xref::access-control/manage-roles.adoc#access-control-rename-roles[Renaming roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT RENAME ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| DROP ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +DROP ROLE name [IF EXISTS] +---- + +| Description +a| +Removes a role. + +For more information, see xref::access-control/manage-roles.adoc#access-control-drop-roles[Deleting roles]. + +| Required privilege +[source, privilege, role="noheader"] +---- +GRANT DROP ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| GRANT ROLE TO + +| Syntax +a| +[source, syntax, role="noheader"] +---- +GRANT ROLE[S] name[, ...] TO user[, ...] +---- + +| Description +a| +Assigns roles to users. + +For more information, see xref::access-control/manage-roles.adoc#access-control-assign-roles[Assigning roles to users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT ASSIGN ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| REVOKE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +REVOKE ROLE[S] name[, ...] FROM user[, ...] +---- + +| Description +a| +Removes roles from users. + +For more information, see xref::access-control/manage-roles.adoc#access-control-revoke-roles[Revoking roles from users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT REMOVE ROLE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[[access-control-list-roles]] +== Listing roles + + +Available roles can be seen using `SHOW ROLES`. +This returns a single column `role` of type `STRING`, containing the role name. + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +This is the same command as `SHOW ALL ROLES`. + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"publisher" +|"reader" + +1+a|Rows: 6 +|=== + +When first starting a Neo4j DBMS, there are a number of built-in roles: + +* `PUBLIC` - a role that all users have granted. +By default it gives access to the home database and to execute privileges for procedures and functions. +* `reader` - can perform traverse and read operations in all databases except `system`. +* `editor` - can perform traverse, read, and write operations in all databases except `system`, but cannot create new labels or relationship types. +* `publisher` - can do the same as `editor`, but also create new labels and relationship types. +* `architect` - can do the same as `publisher` as well as create and manage indexes and constraints. +* `admin` - can do the same as all the above, as well as manage databases, aliases, users, roles, and privileges. + +More information about the built-in roles can be found in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/built-in-roles[Operations Manual -> Built-in roles] + +There are multiple versions of this command, the default being `SHOW ALL ROLES`. +To only show roles that are assigned to users, the command is `SHOW POPULATED ROLES`. +To see which users are assigned to which roles, `WITH USERS` can be added to the command. +This will return an additional `STRING` column, `member`, containing the username. +Since this gives a result with one row for each user, if a role is assigned to two users it will show up twice. + +[source, cypher, role=noplay] +---- +SHOW POPULATED ROLES WITH USERS +---- + +The table of results will show information about the role and what database it belongs to: + +.Result +[options="header,footer", width="100%", cols="m,m"] +|=== +|role +|member + +|"PUBLIC" +|"neo4j" + +|"PUBLIC" +|"bob" + +|"PUBLIC" +|"user1" + +|"PUBLIC" +|"user2" + +|"PUBLIC" +|"user3" + +|"admin" +|"neo4j" + +2+a|Rows: 6 +|=== + +It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: + +[source, cypher, role=noplay] +---- +SHOW ROLES YIELD role +ORDER BY role +WHERE role ENDS WITH 'r' +---- + +In this example: + +* The results have been filtered to only return the roles ending in 'r'. +* The results are ordered by the `action` column using `ORDER BY`. + +It is also possible to use `SKIP` and `LIMIT` to paginate the results. + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"editor" +|"publisher" +|"reader" + +1+a|Rows: 3 +|=== + +[NOTE] +==== +The `SHOW ROLE name PRIVILEGES` command is found in xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. +==== + + +[[access-control-create-roles]] +== Creating roles + +Roles can be created using `CREATE ROLE`: + +[source, syntax] +---- +CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] +---- + +Roles can be created or replaced by using `CREATE OR REPLACE ROLE`: + +[source, syntax] +---- +CREATE OR REPLACE ROLE name [AS COPY OF otherName] +---- + +[NOTE] +==== +The following naming rules apply: + +* The first character must be an ASCII alphabetic character. +* Subsequent characters can be ASCII alphabetic, numeric characters, and underscore. +* Role names are case sensitive. +==== + +A role can be copied, keeping its privileges, using `CREATE ROLE name AS COPY OF otherName`. + +.Copy a role +====== +[source, cypher, role=noplay] +---- +CREATE ROLE mysecondrole AS COPY OF myrole +---- +====== + +Created roles will appear on the list provided by `SHOW ROLES`. + +.List roles +====== +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"mysecondrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== +====== + +The `CREATE ROLE` command is optionally idempotent, with the default behavior to throw an exception if the role already exists. +Adding `IF NOT EXISTS` to the `CREATE ROLE` command will ensure that no exception is thrown and nothing happens should the role already exist. + +.Create role if not exists +====== + +[source, cypher, role=noplay] +---- +CREATE ROLE myrole IF NOT EXISTS +---- + +====== + + +The `CREATE OR REPLACE ROLE` command will result in any existing role being deleted and a new one created. + + +.Create or replace role +====== + +[source, cypher, role=noplay] +---- +CREATE OR REPLACE ROLE myrole +---- + +This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE ROLE myrole`. + +====== + + +[NOTE] +==== +* The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. +==== + + +[[access-control-rename-roles]] +== Renaming roles + +Roles can be renamed using `RENAME ROLE` command: + +[source, cypher, role=noplay] +---- +RENAME ROLE mysecondrole TO mythirdrole +---- + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"mythirdrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== + +[NOTE] +==== +The `RENAME ROLE` command is only available when using native authentication and authorization. +==== + + +[[access-control-assign-roles]] +== Assigning roles to users + +Users can be given access rights by assigning them roles using `GRANT ROLE`: + +[source, cypher, role=noplay] +---- +GRANT ROLE myrole TO bob +---- + +The roles assigned to each user can be seen on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["myrole","PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["PUBLIC"] +|true +|false +| + +|"user2" +|["PUBLIC"] +|true +|false +| + +|"user3" +|["PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + +It is possible to assign multiple roles to multiple users in one command: + +[source, cypher, role=noplay] +---- +GRANT ROLES role1, role2 TO user1, user2, user3 +---- + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["myrole","PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user2" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user3" +|["role1","role2","PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + + +[[access-control-revoke-roles]] +== Revoking roles from users + +Users can lose access rights by revoking their role using `REVOKE ROLE`: + +[source, cypher, role=noplay] +---- +REVOKE ROLE myrole FROM bob +---- + +The roles revoked from users can no longer be seen on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user2" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user3" +|["role1","role2","PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + +It is possible to revoke multiple roles from multiple users in one command: + +[source, cypher, role=noplay] +---- +REVOKE ROLES role1, role2 FROM user1, user2, user3 +---- + + +[[access-control-drop-roles]] +== Deleting roles + +Roles can be deleted using `DROP ROLE` command: + +[source, cypher, role=noplay] +---- +DROP ROLE mythirdrole +---- + +When a role has been deleted, it will no longer appear on the list provided by `SHOW ROLES`: + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== + +This command is optionally idempotent, with the default behavior to throw an exception if the role does not exist. +Adding `IF EXISTS` to the command will ensure that no exception is thrown and nothing happens should the role not exist: + +[source, cypher, role=noplay] +---- +DROP ROLE mythirdrole IF EXISTS +---- diff --git a/modules/ROOT/pages/access-control/manage-servers.adoc b/modules/ROOT/pages/access-control/manage-servers.adoc new file mode 100644 index 000000000..eda562dd9 --- /dev/null +++ b/modules/ROOT/pages/access-control/manage-servers.adoc @@ -0,0 +1,423 @@ +:description: This section explains how to use Cypher to manage servers in Neo4j. +[role=enterprise-edition] +[[server-management]] += Managing servers + + +Servers can be added and managed using a set of Cypher administration commands executed against the `system` database. + +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[server-management-syntax]] +== Server management command syntax + +[NOTE] +==== +The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. +==== + +[cols="<15s,<85"] +|=== +| Command +m| ENABLE SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +ENABLE SERVER 'serverId' [OPTIONS "{" option: value[,...] "}"] +---- + +| Description +a| Adds a server that has been discovered to the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| ALTER SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +ALTER SERVER 'name' SET OPTIONS "{" option: value[,...] "}" +---- + +| Description +a| Changes the constraints for a server. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| RENAME SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +RENAME SERVER 'name' TO 'newName' +---- + +| Description +a| Changes the name of a server. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| REALLOCATE DATABASES + +| Syntax +a| +[source, syntax, role=noheader] +---- +[DRYRUN] REALLOCATE DATABASE[S] +---- + +| Description +a| Re-balances databases among the servers in the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| DEALLOCATE DATABASES + +| Syntax +a| +[source, syntax, role=noheader] +---- +[DRYRUN] DEALLOCATE DATABASE[S] FROM SERVER[S] 'name'[, ...] +---- + +| Description +a| Removes all databases from the given servers. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| DROP SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +DROP SERVER 'name' +---- + +| Description +a| Removes a server not hosting any databases from the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| SHOW SERVERS + +| Syntax +a| +[source, syntax, role=noheader] +---- +SHOW SERVER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| Lists all servers visible to the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SHOW SERVERS` + +(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[[server-management-show-servers]] +== Listing servers + +`SHOW SERVERS` displays all servers running in the cluster, including servers that have yet to be enabled as well as dropped servers. + +The table of results shows information about the servers: + +[options="header", width="100%", cols="2a,4,2m,1,1"] +|=== +| Column +| Description +| Type +| Default output +| Full output + +| name +| Name of the server. +| STRING +| {check-mark} +| {check-mark} + +| serverId +| Id of the server. +| STRING +| +| {check-mark} + +| address +| Bolt address of the server (if enabled). +| STRING +| {check-mark} +| {check-mark} + +| httpAddress +| Http address of the server (if enabled). +| STRING +| +| {check-mark} + +| httpsAddress +| Https address of the server (if enabled). +| STRING +| +| {check-mark} + +| state +| Information of the state of the server: `free`, `enabled`, `deallocating`, or `dropped`. +| STRING +| {check-mark} +| {check-mark} + +| health +| The availability of the server: `available` or `unavailable`. +| STRING +| {check-mark} +| {check-mark} + +| hosting +| A list of databases currently hosted on the server. +| LIST OF STRING +| {check-mark} +| {check-mark} + +| requestedHosting +| A list of databases that should be hosted on the server, decided by the allocator. +| LIST OF STRING +| +| {check-mark} + +| tags +| Tags are user provided strings that can be used while allocating databases. +| LIST OF STRING +| +| {check-mark} + +| allowedDatabases +| A list of databases allowed to be hosted on the server. +| LIST OF STRING +| +| {check-mark} + +| deniedDatabases +| A list of databases not allowed to be hosted on the server. +| LIST OF STRING +| +| {check-mark} + +| modeConstraint +| Constraint for the allocator to allocate only databases in this mode on the server. +| STRING +| +| {check-mark} + +| version +| Neo4j version the server is running. +| STRING +| +| {check-mark} +|=== + +A summary of all servers can be displayed using the command `SHOW SERVERS`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m"] +|=== +|name|address|state|health|hosting + +| "server1" | "localhost:20000" | "Enabled" | "Available" | ["system","neo4j"] +| "server2" | "localhost:20007" | "Enabled" | "Available" | ["system","neo4j"] +| "server3" | "localhost:20014" | "Enabled" | "Available" | ["system","neo4j"] +| "0c030000-267b-49a8-801f-78bd0b5c6445" | "localhost:20021" | "Free" | "Available" | ["system"] +|=== + +[role=not-on-aura] +[[server-management-enable-server]] +== Enabling servers + +A server can be added to the cluster with the `ENABLE SERVER 'name'` command. +The servers initial name is its id. +The server must be in the `free` state to be added to the cluster. +If the server is already `enabled` and the command is executed with the same options specified nothing is changed. +In any other case trying to enable a server fails. + +The possible options allowed when enabling a server are: + +[options="header", width="100%", cols="2a,2,^.^"] +|=== +| Option +| Allowed values +| Description + +| modeConstraint +| `PRIMARY`, `SECONDARY`, `NONE` +| Databases may only be hosted on the server in the mode specified by the constraint. +`None` means there is no constraint and any mode is allowed. + +| allowedDatabases +| list of database names +| Only databases matching the specified names may be hosted on the server. +This may not be specified in combination with `deniedDatabases`. + +| deniedDatabases +| list of database names +| Only databases **not** matching the specified names may be hosted on the server. +This may not be specified in combination with `allowedDatabases`. +|=== + +[NOTE] +==== +Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. +The composite databases are available everywhere and hold no data on their own. +==== + +[role=not-on-aura] +[[server-management-alter-server]] +== Modifying servers + +The constraints on a server can be changed with `ALTER SERVER 'name' SET OPTIONS { option: value }`. +Either the name or the id of the server can be used. + +The possible options allowed when altering a server are: + +[options="header", width="100%", cols="2a,2,^.^"] +|=== +| Option +| Allowed values +| Description + +| modeConstraint +| `PRIMARY`, `SECONDARY`, `NONE` +| Databases may only be hosted on the server in the mode specified by the constraint. +`None` means there is no constraint and any mode is allowed. + +| allowedDatabases +| list of database names +| Only databases matching the specified names may be hosted on the server. +This may not be specified in combination with `deniedDatabases`. + +| deniedDatabases +| list of database names +| Only databases **not** matching the specified names may be hosted on the server. +This may not be specified in combination with `allowedDatabases`. +|=== + +[NOTE] +==== +Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. +The composite databases are available everywhere and hold no data on their own. +==== + +[[server-management-rename-server]] +== Renaming servers + +The name of a server can be altered with `RENAME SERVER 'name' TO 'newName'`. +Either the id or current name of the server can be used to identify the server. +The new name of the server must be unique. + +[[server-management-reallocate]] +== Reallocate databases + +After enabling a server, `REALLOCATE DATABASES` can be used to make the cluster re-balance databases across all servers that are part of the cluster. +Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|database|fromServerName|fromServerId|toServerName|toServerId|mode + +| "db1" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-4" | "00000002-25a9-4984-9ad2-dc39024c9238" | "primary" +| "db3" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-5" | "00000003-0df7-4057-81fd-1cf43c9ef5f7" | "primary" +|=== + +[NOTE] +==== +`DRYRUN` is introduced in Neo4j 5.2, and thus is not available in earlier minor releases of v5. +==== + +[role=not-on-aura] +[[server-management-deallocate]] +== Deallocate databases + +A server can be set to not host any databases with `DEALLOCATE DATABASES FROM SERVER 'name'`, in preparation for removing the server from the cluster. +Either the id or name of the server can be used. +All databases that the server is hosting are moved to other servers. +The server changes state to `deallocating`. +A deallocated server cannot readily be enabled again. + +Multiple servers can be deallocated at the same time, `DEALLOCATE DATABASES FROM SERVER 'server-1', 'server-2'`. +The command fails if there aren't enough servers available to move the databases to. + +Using `DRYRUN DEALLOCATE DATABASES FROM 'server-1', 'server-2'` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|database|fromServerName|fromServerId|toServerName|toServerId|mode +| "db1" | "server-1" | "00000001-8c04-4731-a2fd-7b0289c511ce" | "server-4" | "00000002-5b91-43c1-8b25-5289f674563e" | "primary" +| "db1" | "server-2" | "00000000-7e53-427c-a987-24634c4745f3" | "server-5" | "00000003-0e98-44c8-9844-f0a4eb95b0d8" | "primary" +|=== + +[role=not-on-aura] +[[server-management-drop-server]] +== Drop server + +When a server has been deallocated and is no longer hosting any databases it can be removed from the cluster with `DROP SERVER 'name'`. +Either the id or name of the server can be used. +As long as the server is running, it is listed when showing servers with the state `dropped`. diff --git a/modules/ROOT/pages/access-control/manage-users.adoc b/modules/ROOT/pages/access-control/manage-users.adoc new file mode 100644 index 000000000..502fc0cce --- /dev/null +++ b/modules/ROOT/pages/access-control/manage-users.adoc @@ -0,0 +1,864 @@ +:description: This section explains how to use Cypher to manage users in Neo4j. + +[[access-control-manage-users]] += Managing users + +[abstract] +-- +This section explains how to use Cypher to manage users in Neo4j. +-- + +Users can be created and managed using a set of Cypher administration commands executed against the `system` database. +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[access-control-user-syntax]] +== User management command syntax + +[NOTE] +==== +The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. +==== + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW CURRENT USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW CURRENT USER + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the current user. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-users.adoc#access-control-current-users[Listing current user]. + +| Required privilege +a| None + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW USERS + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW USER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists all users. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-users.adoc#access-control-list-users[Listing users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== +| Command +m| SHOW USER PRIVILEGES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the privileges granted to the specified users or the current user if no user is specified. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW PRIVILEGE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) + +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) +|=== + + +[cols="<15s,<85"] +|=== +| Command +m| CREATE USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE USER name [IF NOT EXISTS] + SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED}] + [SET HOME DATABASE name] +---- + +| Description +a| +Creates a new user. + +For more information, see xref::access-control/manage-users.adoc#access-control-create-users[Creating users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| CREATE OR REPLACE USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE USER name + SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED}] + [SET HOME DATABASE name] +---- + +| Description +a| +Creates a new user, or if a user with the same name exists, replace it. + +For more information, see xref::access-control/manage-users.adoc#access-control-create-users[Creating users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + + +[source, privilege, role="noheader"] +---- +GRANT DROP USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| RENAME USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +RENAME USER name [IF EXISTS] TO otherName +---- + +| Description +a| +Changes the name of a user. + +For more information, see xref::access-control/manage-users.adoc#access-control-rename-users[Renaming users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT RENAME USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| ALTER USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +ALTER USER name [IF EXISTS] + [SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password'] + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED} ] + [SET HOME DATABASE name] + [REMOVE HOME DATABASE] +---- + +| Description +a| +Modifies the settings for an existing user. +At least one `SET` or `REMOVE` clause is required. +`SET` and `REMOVE` clauses cannot be combined in the same command. + +For more information, see xref::access-control/manage-users.adoc#access-control-alter-users[Modifying users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SET PASSWORD +---- + +[source, privilege, role="noheader" +---- +GRANT SET USER STATUS +---- + +[source, privilege, role="noheader"] +---- +GRANT SET USER HOME DATABASE +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| ALTER CURRENT USER SET PASSWORD + +| Syntax +a| +[source, syntax, role="noheader"] +---- +ALTER CURRENT USER SET PASSWORD FROM 'oldPassword' TO 'newPassword' +---- + +| Description +a| +Changes the current user's password. + +For more information, see xref::access-control/manage-users.adoc#access-control-alter-password[Changing the current user's password]. + +| Required privilege +a| None + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| DROP USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +DROP USER name [IF EXISTS] +---- + +| Description +a| +Removes an existing user. + +For more information, see xref::access-control/manage-users.adoc#access-control-drop-users[Delete users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT DROP USER +---- + +(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[NOTE] +==== +The `SHOW USER[S] PRIVILEGES` command is only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + + +[[access-control-current-users]] +== Listing current user + +The currently logged-in user can be seen using `SHOW CURRENT USER`, which will produce a table with the following columns: + +[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] +|=== +| Column +| Description +| Type +| Community Edition +| Enterprise Edition + +| user +| User name +| STRING +| {check-mark} +| {check-mark} + +| roles +| Roles granted to the user. + +Will return `null` in community edition. +| LIST OF STRING +| {cross-mark} +| {check-mark} + +| passwordChangeRequired +| If `true`, the user must change their password at the next login. +| BOOLEAN +| {check-mark} +| {check-mark} + +| suspended +| If `true`, the user is currently suspended (cannot log in). + +Will return `null` in community edition. +| BOOLEAN +| {cross-mark} +| {check-mark} + +| home +| The home database configured by the user, or `null` if no home database has been configured. +If this database is unavailable and the user does not specify a database to use, they will not be able to log in. + +Will return `null` in community edition. +| STRING +| {cross-mark} +| {check-mark} +|=== + +[source, cypher, role=noplay] +---- +SHOW CURRENT USER +---- + +.Result +[options="header,footer", width="100%", cols="2m,2m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"jake" +|["PUBLIC"] +|false +|false +| + +5+a|Rows: 1 +|=== + +[NOTE] +==== +This command is only supported for a logged-in user and will return an empty result if authorization has been disabled. +==== + + +[[access-control-list-users]] +== Listing users + +Available users can be seen using `SHOW USERS`, which will produce a table of users with the following columns: + +[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] +|=== +| Column +| Description +| Type +| Community Edition +| Enterprise Edition + +| user +| User name +| STRING +| {check-mark} +| {check-mark} + +| roles +| Roles granted to the user. + +Will return `null` in community edition. +| LIST OF STRING +| {cross-mark} +| {check-mark} + +| passwordChangeRequired +| If `true`, the user must change their password at the next login. +| BOOLEAN +| {check-mark} +| {check-mark} + +| suspended +| If `true`, the user is currently suspended (cannot log in). + +Will return `null` in community edition. +| BOOLEAN +| {cross-mark} +| {check-mark} + +| home +| The home database configured by the user, or `null` if no home database has been configured. +A home database will be resolved if it is either pointing to a database or a database alias. +If this database is unavailable and the user does not specify a database to use, they will not be able to log in. + +Will return `null` in community edition. +| STRING +| {cross-mark} +| {check-mark} +|=== + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[role="queryresult" options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"neo4j" +|["admin","PUBLIC"] +|false +|false +| + +5+a|Rows: 1 +|=== + +When first starting a Neo4j DBMS, there is always a single default user `neo4j` with administrative privileges. +It is possible to set the initial password using link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/set-initial-password[`neo4j-admin dbms set-initial-password `], otherwise it is necessary to change the password after the first login. + +.Show user +====== +This example shows how to: + +* Reorder the columns using a `YIELD` clause. +* Filter the results using a `WHERE` clause. + +[source, cypher, role=noplay] +---- +SHOW USER YIELD user, suspended, passwordChangeRequired, roles, home +WHERE user = 'jake' +---- +====== + +.Show user +====== +It is possible to add a `RETURN` clause to further manipulate the results after filtering. +In this example, the `RETURN` clause is used to filter out the `roles` column and rename the `user` column to `adminUser`. + +[source,cypher,role=noplay] +---- +SHOW USERS YIELD roles, user +WHERE 'admin' IN roles +RETURN user AS adminUser +---- +====== + +[NOTE] +==== +The `SHOW USER name PRIVILEGES` command is described in xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. +==== + + +[[access-control-create-users]] +== Creating users + +Users can be created using `CREATE USER`. + +[source, syntax, role="noheader"] +---- +CREATE USER name [IF NOT EXISTS] + SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] +---- + +Users can be created or replaced using `CREATE OR REPLACE USER`. + +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE USER name + SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] +---- + +* For `SET PASSWORD`: +** The `password` can either be a string value or a string parameter. +** The default Neo4j password length is at least 8 characters. +** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. +`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. +Consequently, it is never possible to get the plaintext of a password back out of the database. +A password can be set in either fashion at any time. +** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. +** The optional `ENCRYPTED` is used to recreate an existing user when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + +With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: +*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. +*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. +* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. +The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. +* The default for `SET STATUS` is `ACTIVE`. +* `SET HOME DATABASE` can be used to configure a home database for a user. +A home database will be resolved if it is either pointing to a database or a database alias. +If no home database is set, the DBMS default database is used as the home database for the user. +* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. + +[NOTE] +==== +User names are case sensitive. +The created user will appear on the list provided by `SHOW USERS`. + +* In Neo4j Community Edition there are no roles, but all users have implied administrator privileges. +* In Neo4j Enterprise Edition all users are automatically assigned the xref::access-control/built-in-roles.adoc#access-control-built-in-roles-public[`PUBLIC` role], giving them a base set of privileges. +==== + + +.Create user +====== +For example, you can create the user `jake` in a suspended state, with the home database `anotherDb`, and the requirement to change the password by using the command: + +[source,cypher,role=noplay] +---- +CREATE USER jake +SET PASSWORD 'abcd1234' CHANGE REQUIRED +SET STATUS SUSPENDED +SET HOME DATABASE anotherDb +---- + +====== + + +.Create user +====== +Or you can create the user `Jake` in an active state, with an encrypted password (taken from the _data/scripts/databasename/restore_metadata.cypher_ of a database backup), and the requirement to not change the password by running: + +[source,cypher,role=noplay] +---- +CREATE USER Jake +SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff2a55c5b825,190ae47c661e0668a0c8be8a21ff78a4a34cdf918cae3c407e907b73932bd16c' CHANGE NOT REQUIRED +SET STATUS ACTIVE +---- + +====== + +[NOTE] +==== +The `SET STATUS {ACTIVE | SUSPENDED}` and `SET HOME DATABASE` parts of the commands are only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + +The `CREATE USER` command is optionally idempotent, with the default behavior to throw an exception if the user already exists. +Appending `IF NOT EXISTS` to the `CREATE USER` command will ensure that no exception is thrown and nothing happens should the user already exist. + + +.Create user if not exists +====== +[source,cypher,role=noplay] +---- +CREATE USER jake IF NOT EXISTS +SET PLAINTEXT PASSWORD 'abcd1234' +---- + +====== + +The `CREATE OR REPLACE USER` command will result in any existing user being deleted and a new one created. + + +.Create or replace user +====== +[source,cypher,role=noplay] +---- +CREATE OR REPLACE USER jake +SET PLAINTEXT PASSWORD 'abcd1234' +---- + +This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`. + +====== + +[NOTE] +==== +The `CREATE OR REPLACE USER` command does not allow the use of `IF NOT EXISTS`. +==== + + +[[access-control-rename-users]] +== Renaming users + +Users can be renamed with the `RENAME USER` command. + +[source, cypher, role=noplay] +---- +RENAME USER jake TO bob +---- + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"bob" +|["PUBLIC"] +|true +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 2 + +|=== + +[NOTE] +==== +The `RENAME USER` command is only available when using native authentication and authorization. +==== + + +[[access-control-alter-users]] +== Modifying users + +Users can be modified with `ALTER USER`. + +[source, syntax, role="noheader"] +---- +ALTER USER name [IF EXISTS] + [SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password'] + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] + [REMOVE HOME DATABASE name] +---- + +* At least one `SET` or `REMOVE` clause is required for the command. +* `SET` and `REMOVE` clauses cannot be combined in the same command. +* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. +The `SET PASSWORD` clause must come first, if used. +* For `SET PASSWORD`: +** The `password` can either be a string value or a string parameter. +** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. +`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. +Consequently, it is never possible to get the plaintext of a password back out of the database. +A password can be set in either fashion at any time. +** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. +** The optional `ENCRYPTED` is used to update an existing user's password when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + +With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: +*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. +*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. +* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. +The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. +* For `SET PASSWORD CHANGE [NOT] REQUIRED`, the `SET PASSWORD` is only optional if it directly follows the `SET PASSWORD` clause. +* `SET HOME DATABASE` can be used to configure a home database for a user. +A home database will be resolved if it is either pointing to a database or a database alias. +If no home database is set, the DBMS default database is used as the home database for the user. +* `REMOVE HOME DATABASE` is used to unset the home database for a user. +This results in the DBMS default database being used as the home database for the user. + +For example, you can modify the user `bob` with a new password and active status, and remove the requirement to change his password: + +[source, cypher, role=noplay] +---- +ALTER USER bob +SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED +SET STATUS ACTIVE +---- + +Or you may decide to assign the user `bob` a different home database: + +[source, cypher, role=noplay] +---- +ALTER USER bob +SET HOME DATABASE anotherDbOrAlias +---- + +Or remove the home database from the user `bob`: + +[source, cypher, role=noplay] +---- +ALTER USER bob +REMOVE HOME DATABASE +---- + +[NOTE] +==== +When altering a user, it is only necessary to specify the changes required. +For example, leaving out the `CHANGE [NOT] REQUIRED` part of the query will leave that unchanged. +==== + +[NOTE] +==== +The `SET STATUS {ACTIVE | SUSPENDED}`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts of the command are only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + +The changes to the user will appear on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"bob" +|["PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 2 + +|=== + +The default behavior of this command is to throw an exception if the user does not exist. +Adding an optional parameter `IF EXISTS` to the command makes it idempotent and ensures that no exception is thrown. +Nothing happens should the user not exist. + +[source, cypher, role=noplay] +---- +ALTER USER nonExistingUser IF EXISTS SET PASSWORD 'abcd1234' +---- + + +[[access-control-alter-password]] +== Changing the current user's password + +Users can change their password using `ALTER CURRENT USER SET PASSWORD`. +The old password is required in addition to the new one, and either or both can be a string value or a string parameter. +When a user executes this command it will change their password as well as set the `CHANGE NOT REQUIRED` flag. + +[source, cypher, role=test-skip] +---- +ALTER CURRENT USER +SET PASSWORD FROM 'password1' TO 'password2' +---- + +[NOTE] +==== +This command works only for a logged-in user and cannot be run with auth disabled. +==== + + +[[access-control-drop-users]] +== Delete users + +Users can be deleted with `DROP USER`. + +[source, cypher, role=noplay] +---- +DROP USER bob +---- + +Deleting a user will not automatically terminate associated connections, sessions, transactions, or queries. + +However, when a user has been deleted, it will no longer appear on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 1 + +|=== diff --git a/modules/ROOT/pages/clauses/transaction-clauses.adoc b/modules/ROOT/pages/clauses/transaction-clauses.adoc index bd2a93ccc..cb8409a2d 100644 --- a/modules/ROOT/pages/clauses/transaction-clauses.adoc +++ b/modules/ROOT/pages/clauses/transaction-clauses.adoc @@ -127,7 +127,6 @@ m| activeLockCount a| Count of active locks held by the transaction. m| INTEGER - m| currentQueryActiveLockCount a| Count of active locks held by the query currently executing in this transaction. m| INTEGER @@ -164,7 +163,6 @@ m| currentQueryIdleTime a| Idle time for the query currently executing in this transaction, or `null` if unavailable or no query is currently executing. m| DURATION - m| currentQueryAllocatedBytes a| The number of bytes allocated on the heap so far by the query currently executing in this transaction, or `null` if unavailable or no query is currently executing. m| INTEGER @@ -185,12 +183,10 @@ m| pageFaults a| The total number of page cache faults that the transaction performed. m| INTEGER - m| currentQueryPageHits a| The total number of page cache hits that the query currently executing in this transaction performed. m| INTEGER - m| currentQueryPageFaults a| The total number of page cache faults that the query currently executing in this transaction performed. m| INTEGER From 057eca111c7eba25d2bf729e2df9651e558b5bed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Wed, 22 Mar 2023 10:17:21 +0100 Subject: [PATCH 20/32] Merge 5.6 PRs to 5.x (#480) --- .../images/graph_expression_subqueries.svg | 146 +- ..._grant_and_deny_syntax_dbms_privileges.svg | 1 + .../ROOT/images/privileges_hierarchy_dbms.svg | 1 + .../access-control/manage-privileges.adoc | 1436 ----------------- .../pages/access-control/manage-roles.adoc | 816 ---------- .../pages/access-control/manage-servers.adoc | 423 ----- .../pages/access-control/manage-users.adoc | 864 ---------- ...ions-additions-removals-compatibility.adoc | 9 - modules/ROOT/pages/index.adoc | 98 ++ modules/ROOT/pages/introduction/aura.adoc | 52 + 10 files changed, 226 insertions(+), 3620 deletions(-) create mode 100644 modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg create mode 100644 modules/ROOT/images/privileges_hierarchy_dbms.svg delete mode 100644 modules/ROOT/pages/access-control/manage-privileges.adoc delete mode 100644 modules/ROOT/pages/access-control/manage-roles.adoc delete mode 100644 modules/ROOT/pages/access-control/manage-servers.adoc delete mode 100644 modules/ROOT/pages/access-control/manage-users.adoc create mode 100644 modules/ROOT/pages/index.adoc create mode 100644 modules/ROOT/pages/introduction/aura.adoc diff --git a/modules/ROOT/images/graph_expression_subqueries.svg b/modules/ROOT/images/graph_expression_subqueries.svg index b037298a9..0b116c781 100644 --- a/modules/ROOT/images/graph_expression_subqueries.svg +++ b/modules/ROOT/images/graph_expression_subqueries.svg @@ -3,117 +3,119 @@ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> - - - -L - + + + +H + Andy - -Swedish, Person - -age = 36 -name = 'Andy' + +Swedish, Person + +age = 36 + name = 'Andy' - + -DogAndy - -Dog - -name = 'Andy' +AndyDog + +Dog + +name = 'Andy' - + -Andy->DogAndy - - -  HAS_DOG -since = 2016 +Andy->AndyDog + + +HAS_DOG +  since = 2016 Timothy - -Person - -age = 25 -name = 'Timothy' + +Person + +age = 25 + name = 'Timothy' + nickname = 'Tim' - + Mittens - -Cat - -name = 'Mittens' + +Cat + +name = 'Mittens' - + Timothy->Mittens - - -  HAS_CAT -since = 2019 + + +HAS_CAT +  since = 2019 Peter - -Person - -age = 35 -name = 'Peter' + +Person + +age = 25 + name = 'Peter' + nickname = 'Pete' - + Ozzy - -Dog - -name = 'Ozzy' + +Dog + +name = 'Ozzy' - + Peter->Ozzy - - -  HAS_DOG -since = 2018 + + +HAS_DOG +  since = 2018 - + Fido - -Dog - -name = 'Fido' + +Dog + +name = 'Fido' - + Peter->Fido - - -  HAS_DOG -since = 2010 + + +HAS_DOG +  since = 2010 - + Banana - -Toy - -name = 'Banana' + +Toy + +name = 'Banana' - + Fido->Banana - - -  HAS_TOY + + +  HAS_TOY diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg new file mode 100644 index 000000000..b929a580d --- /dev/null +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/modules/ROOT/images/privileges_hierarchy_dbms.svg b/modules/ROOT/images/privileges_hierarchy_dbms.svg new file mode 100644 index 000000000..705c3fd5d --- /dev/null +++ b/modules/ROOT/images/privileges_hierarchy_dbms.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/modules/ROOT/pages/access-control/manage-privileges.adoc b/modules/ROOT/pages/access-control/manage-privileges.adoc deleted file mode 100644 index 1b867d74d..000000000 --- a/modules/ROOT/pages/access-control/manage-privileges.adoc +++ /dev/null @@ -1,1436 +0,0 @@ -:description: This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. -[role=enterprise-edition aura-db-enterprise] -[[access-control-manage-privileges]] - -= Managing privileges - -[abstract] --- -This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. --- - -Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. -It is possible to grant or deny access, or use a combination of the two. -The user will be able to access the resource if they have a `GRANT` (allowlist) and do not have a `DENY` (denylist) relevant to that resource. -All other combinations of `GRANT` and `DENY` will result in the matching path being inaccessible. -What this means in practice depends on whether we are talking about a xref::access-control/privileges-reads.adoc[read privilege] or a xref::access-control/privileges-writes.adoc[write privilege]: - -* If an entity is not accessible due to xref::access-control/privileges-reads.adoc[read privileges], the data will become invisible. -It will appear to the user as if they had a smaller database (smaller graph). -* If an entity is not accessible due to xref::access-control/privileges-writes.adoc[write privileges], an error will occur on any attempt to write that data. - -[NOTE] -==== -In this document we will often use the terms _'allows'_ and _'enables'_ in seemingly identical ways. However, there is a subtle difference. -We will use _'enables'_ to refer to the consequences of xref::access-control/privileges-reads.adoc[read privileges] where a restriction will not cause an error, only a reduction in the apparent graph size. -We will use _'allows'_ to refer to the consequence of xref::access-control/privileges-writes.adoc[write privileges] where a restriction can result in an error. -==== - -[NOTE] -==== -If a user was not also provided with the database `ACCESS` privilege, then access to the entire database will be denied. -Information about the database access privilege can be found in xref::access-control/database-administration.adoc#access-control-database-administration-access[The ACCESS privilege]. -==== - -[NOTE] -==== -The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. -==== - -[[access-control-graph-privileges]] -== Graph privilege commands (`GRANT`, `DENY` and `REVOKE`) - -Administrators can use Cypher commands to manage Neo4j graph administrative rights. -The components of the graph privilege commands are: - -* _the command_: -** `GRANT` – gives privileges to roles. -** `DENY` – denies privileges to roles. -** `REVOKE` – removes granted or denied privileges from roles. - -* _mutability_: -** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. See also xref:access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. - -* _graph-privilege_: -** Can be either a xref::access-control/privileges-reads.adoc[read privilege] or xref::access-control/privileges-writes.adoc[write privilege]. - -* _name_: -** The graph or graphs to associate the privilege with. -Because in Neo4j {neo4j-version} you can have only one graph per database, this command uses the database name or alias to refer to that graph. -When using an alias, the command will be executed on the resolved graph. -+ -[NOTE] -==== -If you delete a database and create a new one with the same name, the new one will _NOT_ have the privileges previously assigned to the deleted graph. -==== -** It can be `+*+`, which means all graphs. -Graphs created after this command execution will also be associated with these privileges. - -** `HOME GRAPH` refers to the graph associated with the home database for that user. -The default database will be used as home database if a user does not have one configured. -If the user's home database changes for any reason after privileges have been created, then these privileges will be associated with the graph attached to the new database. -This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user's home database. - -* _entity_ -** The graph elements this privilege applies to: -*** `NODES` label (nodes with the specified label(s)). -*** `RELATIONSHIPS` type (relationships of the specific type(s)). -*** `ELEMENTS` label (both nodes and relationships). -** The label or type can be referred with `+*+`, which means all labels or types. -** Multiple labels or types can be specified, comma-separated. -** Defaults to `ELEMENTS` `+*+` if omitted. -** Some of the commands for write privileges do not allow an _entity_ part. -See xref::access-control/privileges-writes.adoc[Write privileges] for details. -* _role[, ...]_ -** The role or roles to associate the privilege with, comma-separated. - -.General grant +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] ----- - -| Description -a| Grants a privilege to one or multiple roles. - -|=== - -.General deny +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +DENY ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -DENY [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] ----- - -| Description -a| Denies a privilege to one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE GRANT ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] GRANT graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] ----- -| Description -a| Revokes a granted privilege from one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE DENY ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] DENY graph-privilege ON { HOME GRAPH \| GRAPH[S] {* \| name[, ...] } } [entity] FROM role[, ...] ----- - -| Description -a| Revokes a denied privilege from one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] ----- - -| Description -| Revokes a granted or denied privilege from one or multiple roles. -|=== - -[NOTE] -==== -`DENY` does NOT erase a granted privilege; they both exist. -Use `REVOKE` if you want to remove a privilege. -==== - -The general `GRANT` and `DENY` syntaxes are illustrated in the following image: - -image::privileges_grant_and_deny_syntax.svg[title="GRANT and DENY Syntax"] - -A more detailed syntax illustration for graph privileges would be the following: - -image::privileges_on_graph_syntax.svg[title="Syntax of GRANT and DENY Graph Privileges. The `{` and `}` are part of the syntax and not used for grouping."] - -The following image shows the hierarchy between different graph privileges: - -image::privileges_hierarchy.svg[title="Graph privileges hierarchy"] - -[[access-control-list-privileges]] -== Listing privileges - -Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. - -.Show privileges command syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- -| Description -| List all privileges. - -|=== - -.Show role privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW ROLE ... PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -| Lists privileges for a specific role. - -|=== - -.Show user privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW USER ... PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -| Lists privileges for a specific user, or the current user. - -[NOTE] -==== -Please note that it is only possible for a user to show their own privileges. -Therefore, if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work in a limited capacity. - -Other users' privileges cannot be listed when using a non-native auth provider. -==== -|=== - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For an easy overview of the existing privileges, it is recommended to use the `AS COMMANDS` version of the `SHOW` command. -This returns the column `command` of type `STRING` containing the privileges as the commands that are granted or denied. - -When omitting the `AS COMMANDS` clause, results will include multiple columns describing privileges: - -[options="header", width="100%", cols="4m,6a,2m"] -|=== -| Column | Description | Type - -| access -| Whether the privilege is granted or denied. -| STRING - -| action -| The type of the privilege. -E.g., traverse, read, index management, or role management. -| STRING - -| resource -| The scope of the privilege. -E.g., the entire DBMS, a specific database, a graph, or sub-graph access. -| STRING - -| graph -| The specific database or graph the privilege applies to. -| STRING - -| segment -| The labels, relationship types, procedures, functions, transactions or settings the privilege applies to (if applicable). -| STRING - -| role -| The role the privilege is granted to. -| STRING - -| immutable -| Whether or not the privilege is immutable. - -This column is also available for the `AS COMMAND` variant using `YIELD`. -| BOOLEAN - -| user -| The user the privilege belongs to. - -Note that this is only returned for `SHOW USER [username] PRIVILEGES`. -| STRING - -|=== - -[[access-control-list-all-privileges]] -=== Examples for listing all privileges - -Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. - -[source, syntax] ----- -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES ----- - -Lists all privileges for all roles: - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|segment -|role -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"admin" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"admin" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"admin" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"admin" -|false - -|"GRANTED" -|"transaction_management" -|"database" -|"*" -|"USER(*)" -|"admin" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"constraint" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"dbms_actions" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"index" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"start_database" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"stop_database" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"architect" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"architect" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"architect" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"architect" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"constraint" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"index" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"editor" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"editor" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"editor" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"editor" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"editor" -|false - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"publisher" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"publisher" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"publisher" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"publisher" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"publisher" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"publisher" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"reader" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"reader" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"reader" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 39 -|=== - -It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD role, access, action, segment -ORDER BY action -WHERE role = 'admin' ----- - -In this example: - -* The number of columns returned has been reduced with the `YIELD` clause. -* The order of the returned columns has been changed. -* The results have been filtered to only return the `admin` role using a `WHERE` clause. -* The results are ordered by the `action` column using `ORDER BY`. - -`SKIP` and `LIMIT` can also be used to paginate the results. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m"] -|=== -|role -|access -|action -|segment - -|"admin" -|"GRANTED" -|"access" -|"database" - -|"admin" -|"GRANTED" -|"constraint" -|"database" - -|"admin" -|"GRANTED" -|"dbms_actions" -|"database" - -|"admin" -|"GRANTED" -|"index" -|"database" - -|"admin" -|"GRANTED" -|"match" -|"NODE(*)" - -|"admin" -|"GRANTED" -|"match" -|"RELATIONSHIP(*)" - -|"admin" -|"GRANTED" -|"start_database" -|"database" - -|"admin" -|"GRANTED" -|"stop_database" -|"database" - -|"admin" -|"GRANTED" -|"token" -|"database" - -|"admin" -|"GRANTED" -|"transaction_management" -|"USER(*)" - -|"admin" -|"GRANTED" -|"write" -|"NODE(*)" - -|"admin" -|"GRANTED" -|"write" -|"RELATIONSHIP(*)" - -4+a|Rows: 12 -|=== - -`WHERE` can also be used without `YIELD`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES -WHERE graph <> '*' ----- - -In this example, the `WHERE` clause is used to filter privileges down to those that target specific graphs only. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment - -|"GRANTED" -|"access" -|"DEFAULT" -|"database" -|"PUBLIC" -|"database" - -|"DENIED" -|"access" -|"neo4j" -|"database" -|"noAccessUsers" -|"database" - -|"GRANTED" -|"access" -|"neo4j" -|"database" -|"regularUsers" -|"database" - -6+a|Rows: 3 -|=== - -Aggregations in the `RETURN` clause can be used to group privileges. -In this case, by user and `GRANTED` or `DENIED`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) AS privileges ----- - -.Result -[options="header,footer", width="100%", cols="1m,1m,3m"] -|=== -|role -|access -|privileges - -|"PUBLIC" -|"GRANTED" -|[["\*","database","FUNCTION(*)","execute"],["\*","database","PROCEDURE(*)","execute"],["DEFAULT","database","database","access"]] - -|"admin" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","USER(*)","transaction_management"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","dbms_actions"],["*","database","database","index"],["\*","database","database","start_database"],["*","database","database","stop_database"],["*","database","database","token"]] - -|"architect" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","index"],["*","database","database","token"]] - -|"editor" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"]] - -|"noAccessUsers" -|"DENIED" -|[["neo4j","database","database","access"]] - -|"publisher" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","token"]] - -|"reader" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","all_properties","RELATIONSHIP(*)","match"],["*","database","database","access"]] - -|"regularUsers" -|"GRANTED" -|[["neo4j","database","database","access"]] - -3+a|Rows: 8 -|=== - -The `RETURN` clause can also be used to order and paginate the results, which is useful when combined with `YIELD` and `WHERE`. -In this example the query returns privileges for display five-per-page, and skips the first five to display the second page. - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5 ----- - -.Result -[options="header,footer", width="100%", cols="2m,2m,1m,2m,1m,2m,1m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"match" -|"*" -|"all_properties" -|"admin" -|"RELATIONSHIP(*)" -|false - -|"GRANTED" -|"write" -|"*" -|"graph" -|"admin" -|"RELATIONSHIP(*)" -|false - -|"GRANTED" -|"transaction_management" -|"*" -|"database" -|"admin" -|"USER(*)" -|false - -|"GRANTED" -|"access" -|"*" -|"database" -|"admin" -|"database" -|false - -|"GRANTED" -|"constraint" -|"*" -|"database" -|"admin" -|"database" -|false - -6+a|Rows: 5 -|=== - -Available privileges can also be displayed as Cypher commands by adding `AS COMMAND[S]`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" -|"GRANT ACCESS ON DATABASE * TO `admin`" -|"GRANT ACCESS ON DATABASE * TO `architect`" -|"GRANT ACCESS ON DATABASE * TO `editor`" -|"GRANT ACCESS ON DATABASE * TO `publisher`" -|"GRANT ACCESS ON DATABASE * TO `reader`" -|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" -|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" -|"GRANT START ON DATABASE * TO `admin`" -|"GRANT STOP ON DATABASE * TO `admin`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `architect`" -|"GRANT WRITE ON GRAPH * TO `editor`" -|"GRANT WRITE ON GRAPH * TO `publisher`" -a|Rows: 35 -|=== - -Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS COMMANDS -WHERE command CONTAINS 'MANAGEMENT' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -a|Rows: 8 -|=== - -It is also possible to get the privileges listed as revoking commands instead of granting or denying: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS REVOKE COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE DENY ACCESS ON DATABASE `neo4j` FROM `noAccessUsers`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `admin`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `architect`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `editor`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" -|"REVOKE GRANT ACCESS ON DATABASE `neo4j` FROM `regularUsers`" -|"REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`" -|"REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`" -|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM `PUBLIC`" -|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`" -|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`" -|"REVOKE GRANT START ON DATABASE * FROM `admin`" -|"REVOKE GRANT STOP ON DATABASE * FROM `admin`" -|"REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `admin`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `architect`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `editor`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `publisher`" -a|Rows: 35 -|=== - -For more info about revoking privileges, please see xref::access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. - -[[access-control-list-privileges-role]] -=== Examples for listing privileges for specific roles - -Available privileges for specific roles can be displayed using `SHOW ROLE name PRIVILEGE[S]`: - -[source, syntax] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW ROLE regularUsers PRIVILEGES ----- - -Lists all privileges for role `regularUsers`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 1 -|=== - -[source, cypher, role=noplay] ----- -SHOW ROLES regularUsers, noAccessUsers PRIVILEGES ----- - -Lists all privileges for roles `regularUsers` and `noAccessUsers`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 2 -|=== - -Similar to the other `SHOW PRIVILEGES` commands, the available privileges for roles can also be listed as Cypher commands with the optional `AS COMMAND[S]`. - -[source, cypher, role=noplay] ----- -SHOW ROLES regularUsers, noAccessUsers PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `admin`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT START ON DATABASE * TO `admin`" -|"GRANT STOP ON DATABASE * TO `admin`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `admin`" -a|Rows: 11 -|=== - -The output can be processed using `YIELD` / `WHERE` / `RETURN` here as well: - -[source, cypher, role=noplay] ----- -SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" -|Rows: 2 -|=== - -Again, it is possible to get the privileges listed as revoking commands instead of granting or denying. -For more info about revoking privileges, please see xref::access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. - -[source, cypher, role=noplay] ----- -SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" -a|Rows: 3 -|=== - -[[access-control-list-privileges-user]] -=== Examples for listing privileges for specific users - -Available privileges for specific users can be displayed using `SHOW USER name PRIVILEGES`. - -[NOTE] -==== -Note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity as it is only possible for a user to show their own privileges. -Other users' privileges cannot be listed when using a non-native auth provider. -==== - -[source, syntax] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES ----- - -Lists all privileges for user `jake`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|"jake" -|false - -7+a|Rows: 4 -|=== - -[source, cypher, role=noplay] ----- -SHOW USERS jake, joe PRIVILEGES ----- - -Lists all privileges for users `jake` and `joe`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"joe" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"joe" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"joe" -|false - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|"joe" -|false - -7+a|Rows: 8 -|=== - -The same command can be used at all times to review available privileges for the current user. -For this purpose, there is a shorter form of the command: `SHOW USER PRIVILEGES`: - -[source, cypher, role=noplay] ----- -SHOW USER PRIVILEGES ----- - -As for the other privilege commands, available privileges for users can also be listed as Cypher commands with the optional `AS COMMAND[S]`. - -[NOTE] -==== -When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. -This can be used to quickly create new roles based on the privileges of specific users. -==== - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE `neo4j` TO $role" -|"GRANT ACCESS ON HOME DATABASE TO $role" -|"GRANT EXECUTE FUNCTION * ON DBMS TO $role" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO $role" -a|Rows: 4 -|=== - -Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`. -Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges. - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES AS REVOKE COMMANDS -WHERE command CONTAINS 'EXECUTE' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM $role" -|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role" -a|Rows: 2 -|=== - -[[access-control-revoke-privileges]] -== Revoking privileges - -Privileges that were granted or denied earlier can be revoked using the `REVOKE` command: - -[source, syntax] ----- -REVOKE - [ IMMUTABLE ] - [ GRANT | DENY ] graph-privilege - FROM role[, ...] ----- - -An example usage of the `REVOKE` command is given here: - -[source, cypher, role=noplay] ----- -REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers ----- - -While it can be explicitly specified that `REVOKE` should remove a `GRANT` or `DENY`, it is also possible to `REVOKE` both by not specifying them at all, as the next example demonstrates. -Because of this, if there happens to be a `GRANT` and a `DENY` for the same privilege, it would remove both. - -[source, cypher, role=noplay] ----- -REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers ----- - -Adding `IMMUTABLE` explicitly specifies that only immutable privileges should be removed. Omitting it specifies that both immutable and regular privileges should be removed. diff --git a/modules/ROOT/pages/access-control/manage-roles.adoc b/modules/ROOT/pages/access-control/manage-roles.adoc deleted file mode 100644 index e12aa550a..000000000 --- a/modules/ROOT/pages/access-control/manage-roles.adoc +++ /dev/null @@ -1,816 +0,0 @@ -:description: This section explains how to use Cypher to manage roles in Neo4j. - -[role=enterprise-edition aura-db-enterprise] -[[access-control-manage-roles]] -= Managing roles - -//// -[source, cypher, role=test-setup] ----- -CREATE USER bob SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user1 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user2 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user3 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE ROLE myrole IF NOT EXISTS; -CREATE ROLE role1 IF NOT EXISTS; -CREATE ROLE role2 IF NOT EXISTS; ----- -//// - -[abstract] --- -This section explains how to use Cypher to manage roles in Neo4j. --- - -Roles can be created and managed using a set of Cypher administration commands executed against the `system` database. - -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[access-control-role-syntax]] -== Role management command syntax - -[NOTE] -==== -The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. -==== - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW [ALL\|POPULATED] ROLE[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists roles. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW ROLE ----- - - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]). -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLES WITH USERS - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW [ALL\|POPULATED] ROLE[S] WITH USER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists roles and users assigned to them. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - - -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLE PRIVILEGES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the privileges granted to the specified roles. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW PRIVILEGE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - - -| Command -m| CREATE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] ----- - -| Description -a| -Creates a new role. - -For more information, see xref::access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| CREATE OR REPLACE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE ROLE name [AS COPY OF otherName] ----- - -| Description -a| -Creates a new role, or if a role with the same name exists, replace it. - -For more information, see xref::access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE ROLE ----- - -[source, privilege, role="noheader"] ----- -GRANT DROP ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| RENAME ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -RENAME ROLE name [IF EXISTS] TO otherName ----- - -| Description -a| -Changes the name of a role. - -For more information, see xref::access-control/manage-roles.adoc#access-control-rename-roles[Renaming roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT RENAME ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| DROP ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -DROP ROLE name [IF EXISTS] ----- - -| Description -a| -Removes a role. - -For more information, see xref::access-control/manage-roles.adoc#access-control-drop-roles[Deleting roles]. - -| Required privilege -[source, privilege, role="noheader"] ----- -GRANT DROP ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| GRANT ROLE TO - -| Syntax -a| -[source, syntax, role="noheader"] ----- -GRANT ROLE[S] name[, ...] TO user[, ...] ----- - -| Description -a| -Assigns roles to users. - -For more information, see xref::access-control/manage-roles.adoc#access-control-assign-roles[Assigning roles to users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT ASSIGN ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| REVOKE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -REVOKE ROLE[S] name[, ...] FROM user[, ...] ----- - -| Description -a| -Removes roles from users. - -For more information, see xref::access-control/manage-roles.adoc#access-control-revoke-roles[Revoking roles from users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT REMOVE ROLE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[[access-control-list-roles]] -== Listing roles - - -Available roles can be seen using `SHOW ROLES`. -This returns a single column `role` of type `STRING`, containing the role name. - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -This is the same command as `SHOW ALL ROLES`. - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"publisher" -|"reader" - -1+a|Rows: 6 -|=== - -When first starting a Neo4j DBMS, there are a number of built-in roles: - -* `PUBLIC` - a role that all users have granted. -By default it gives access to the home database and to execute privileges for procedures and functions. -* `reader` - can perform traverse and read operations in all databases except `system`. -* `editor` - can perform traverse, read, and write operations in all databases except `system`, but cannot create new labels or relationship types. -* `publisher` - can do the same as `editor`, but also create new labels and relationship types. -* `architect` - can do the same as `publisher` as well as create and manage indexes and constraints. -* `admin` - can do the same as all the above, as well as manage databases, aliases, users, roles, and privileges. - -More information about the built-in roles can be found in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/built-in-roles[Operations Manual -> Built-in roles] - -There are multiple versions of this command, the default being `SHOW ALL ROLES`. -To only show roles that are assigned to users, the command is `SHOW POPULATED ROLES`. -To see which users are assigned to which roles, `WITH USERS` can be added to the command. -This will return an additional `STRING` column, `member`, containing the username. -Since this gives a result with one row for each user, if a role is assigned to two users it will show up twice. - -[source, cypher, role=noplay] ----- -SHOW POPULATED ROLES WITH USERS ----- - -The table of results will show information about the role and what database it belongs to: - -.Result -[options="header,footer", width="100%", cols="m,m"] -|=== -|role -|member - -|"PUBLIC" -|"neo4j" - -|"PUBLIC" -|"bob" - -|"PUBLIC" -|"user1" - -|"PUBLIC" -|"user2" - -|"PUBLIC" -|"user3" - -|"admin" -|"neo4j" - -2+a|Rows: 6 -|=== - -It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: - -[source, cypher, role=noplay] ----- -SHOW ROLES YIELD role -ORDER BY role -WHERE role ENDS WITH 'r' ----- - -In this example: - -* The results have been filtered to only return the roles ending in 'r'. -* The results are ordered by the `action` column using `ORDER BY`. - -It is also possible to use `SKIP` and `LIMIT` to paginate the results. - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"editor" -|"publisher" -|"reader" - -1+a|Rows: 3 -|=== - -[NOTE] -==== -The `SHOW ROLE name PRIVILEGES` command is found in xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. -==== - - -[[access-control-create-roles]] -== Creating roles - -Roles can be created using `CREATE ROLE`: - -[source, syntax] ----- -CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] ----- - -Roles can be created or replaced by using `CREATE OR REPLACE ROLE`: - -[source, syntax] ----- -CREATE OR REPLACE ROLE name [AS COPY OF otherName] ----- - -[NOTE] -==== -The following naming rules apply: - -* The first character must be an ASCII alphabetic character. -* Subsequent characters can be ASCII alphabetic, numeric characters, and underscore. -* Role names are case sensitive. -==== - -A role can be copied, keeping its privileges, using `CREATE ROLE name AS COPY OF otherName`. - -.Copy a role -====== -[source, cypher, role=noplay] ----- -CREATE ROLE mysecondrole AS COPY OF myrole ----- -====== - -Created roles will appear on the list provided by `SHOW ROLES`. - -.List roles -====== -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"mysecondrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== -====== - -The `CREATE ROLE` command is optionally idempotent, with the default behavior to throw an exception if the role already exists. -Adding `IF NOT EXISTS` to the `CREATE ROLE` command will ensure that no exception is thrown and nothing happens should the role already exist. - -.Create role if not exists -====== - -[source, cypher, role=noplay] ----- -CREATE ROLE myrole IF NOT EXISTS ----- - -====== - - -The `CREATE OR REPLACE ROLE` command will result in any existing role being deleted and a new one created. - - -.Create or replace role -====== - -[source, cypher, role=noplay] ----- -CREATE OR REPLACE ROLE myrole ----- - -This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE ROLE myrole`. - -====== - - -[NOTE] -==== -* The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. -==== - - -[[access-control-rename-roles]] -== Renaming roles - -Roles can be renamed using `RENAME ROLE` command: - -[source, cypher, role=noplay] ----- -RENAME ROLE mysecondrole TO mythirdrole ----- - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"mythirdrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== - -[NOTE] -==== -The `RENAME ROLE` command is only available when using native authentication and authorization. -==== - - -[[access-control-assign-roles]] -== Assigning roles to users - -Users can be given access rights by assigning them roles using `GRANT ROLE`: - -[source, cypher, role=noplay] ----- -GRANT ROLE myrole TO bob ----- - -The roles assigned to each user can be seen on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["myrole","PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["PUBLIC"] -|true -|false -| - -|"user2" -|["PUBLIC"] -|true -|false -| - -|"user3" -|["PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - -It is possible to assign multiple roles to multiple users in one command: - -[source, cypher, role=noplay] ----- -GRANT ROLES role1, role2 TO user1, user2, user3 ----- - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["myrole","PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user2" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user3" -|["role1","role2","PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - - -[[access-control-revoke-roles]] -== Revoking roles from users - -Users can lose access rights by revoking their role using `REVOKE ROLE`: - -[source, cypher, role=noplay] ----- -REVOKE ROLE myrole FROM bob ----- - -The roles revoked from users can no longer be seen on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user2" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user3" -|["role1","role2","PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - -It is possible to revoke multiple roles from multiple users in one command: - -[source, cypher, role=noplay] ----- -REVOKE ROLES role1, role2 FROM user1, user2, user3 ----- - - -[[access-control-drop-roles]] -== Deleting roles - -Roles can be deleted using `DROP ROLE` command: - -[source, cypher, role=noplay] ----- -DROP ROLE mythirdrole ----- - -When a role has been deleted, it will no longer appear on the list provided by `SHOW ROLES`: - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== - -This command is optionally idempotent, with the default behavior to throw an exception if the role does not exist. -Adding `IF EXISTS` to the command will ensure that no exception is thrown and nothing happens should the role not exist: - -[source, cypher, role=noplay] ----- -DROP ROLE mythirdrole IF EXISTS ----- diff --git a/modules/ROOT/pages/access-control/manage-servers.adoc b/modules/ROOT/pages/access-control/manage-servers.adoc deleted file mode 100644 index eda562dd9..000000000 --- a/modules/ROOT/pages/access-control/manage-servers.adoc +++ /dev/null @@ -1,423 +0,0 @@ -:description: This section explains how to use Cypher to manage servers in Neo4j. -[role=enterprise-edition] -[[server-management]] -= Managing servers - - -Servers can be added and managed using a set of Cypher administration commands executed against the `system` database. - -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[server-management-syntax]] -== Server management command syntax - -[NOTE] -==== -The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. -==== - -[cols="<15s,<85"] -|=== -| Command -m| ENABLE SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -ENABLE SERVER 'serverId' [OPTIONS "{" option: value[,...] "}"] ----- - -| Description -a| Adds a server that has been discovered to the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| ALTER SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -ALTER SERVER 'name' SET OPTIONS "{" option: value[,...] "}" ----- - -| Description -a| Changes the constraints for a server. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| RENAME SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -RENAME SERVER 'name' TO 'newName' ----- - -| Description -a| Changes the name of a server. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| REALLOCATE DATABASES - -| Syntax -a| -[source, syntax, role=noheader] ----- -[DRYRUN] REALLOCATE DATABASE[S] ----- - -| Description -a| Re-balances databases among the servers in the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| DEALLOCATE DATABASES - -| Syntax -a| -[source, syntax, role=noheader] ----- -[DRYRUN] DEALLOCATE DATABASE[S] FROM SERVER[S] 'name'[, ...] ----- - -| Description -a| Removes all databases from the given servers. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| DROP SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -DROP SERVER 'name' ----- - -| Description -a| Removes a server not hosting any databases from the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| SHOW SERVERS - -| Syntax -a| -[source, syntax, role=noheader] ----- -SHOW SERVER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| Lists all servers visible to the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SHOW SERVERS` - -(see xref:access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[[server-management-show-servers]] -== Listing servers - -`SHOW SERVERS` displays all servers running in the cluster, including servers that have yet to be enabled as well as dropped servers. - -The table of results shows information about the servers: - -[options="header", width="100%", cols="2a,4,2m,1,1"] -|=== -| Column -| Description -| Type -| Default output -| Full output - -| name -| Name of the server. -| STRING -| {check-mark} -| {check-mark} - -| serverId -| Id of the server. -| STRING -| -| {check-mark} - -| address -| Bolt address of the server (if enabled). -| STRING -| {check-mark} -| {check-mark} - -| httpAddress -| Http address of the server (if enabled). -| STRING -| -| {check-mark} - -| httpsAddress -| Https address of the server (if enabled). -| STRING -| -| {check-mark} - -| state -| Information of the state of the server: `free`, `enabled`, `deallocating`, or `dropped`. -| STRING -| {check-mark} -| {check-mark} - -| health -| The availability of the server: `available` or `unavailable`. -| STRING -| {check-mark} -| {check-mark} - -| hosting -| A list of databases currently hosted on the server. -| LIST OF STRING -| {check-mark} -| {check-mark} - -| requestedHosting -| A list of databases that should be hosted on the server, decided by the allocator. -| LIST OF STRING -| -| {check-mark} - -| tags -| Tags are user provided strings that can be used while allocating databases. -| LIST OF STRING -| -| {check-mark} - -| allowedDatabases -| A list of databases allowed to be hosted on the server. -| LIST OF STRING -| -| {check-mark} - -| deniedDatabases -| A list of databases not allowed to be hosted on the server. -| LIST OF STRING -| -| {check-mark} - -| modeConstraint -| Constraint for the allocator to allocate only databases in this mode on the server. -| STRING -| -| {check-mark} - -| version -| Neo4j version the server is running. -| STRING -| -| {check-mark} -|=== - -A summary of all servers can be displayed using the command `SHOW SERVERS`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m"] -|=== -|name|address|state|health|hosting - -| "server1" | "localhost:20000" | "Enabled" | "Available" | ["system","neo4j"] -| "server2" | "localhost:20007" | "Enabled" | "Available" | ["system","neo4j"] -| "server3" | "localhost:20014" | "Enabled" | "Available" | ["system","neo4j"] -| "0c030000-267b-49a8-801f-78bd0b5c6445" | "localhost:20021" | "Free" | "Available" | ["system"] -|=== - -[role=not-on-aura] -[[server-management-enable-server]] -== Enabling servers - -A server can be added to the cluster with the `ENABLE SERVER 'name'` command. -The servers initial name is its id. -The server must be in the `free` state to be added to the cluster. -If the server is already `enabled` and the command is executed with the same options specified nothing is changed. -In any other case trying to enable a server fails. - -The possible options allowed when enabling a server are: - -[options="header", width="100%", cols="2a,2,^.^"] -|=== -| Option -| Allowed values -| Description - -| modeConstraint -| `PRIMARY`, `SECONDARY`, `NONE` -| Databases may only be hosted on the server in the mode specified by the constraint. -`None` means there is no constraint and any mode is allowed. - -| allowedDatabases -| list of database names -| Only databases matching the specified names may be hosted on the server. -This may not be specified in combination with `deniedDatabases`. - -| deniedDatabases -| list of database names -| Only databases **not** matching the specified names may be hosted on the server. -This may not be specified in combination with `allowedDatabases`. -|=== - -[NOTE] -==== -Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. -The composite databases are available everywhere and hold no data on their own. -==== - -[role=not-on-aura] -[[server-management-alter-server]] -== Modifying servers - -The constraints on a server can be changed with `ALTER SERVER 'name' SET OPTIONS { option: value }`. -Either the name or the id of the server can be used. - -The possible options allowed when altering a server are: - -[options="header", width="100%", cols="2a,2,^.^"] -|=== -| Option -| Allowed values -| Description - -| modeConstraint -| `PRIMARY`, `SECONDARY`, `NONE` -| Databases may only be hosted on the server in the mode specified by the constraint. -`None` means there is no constraint and any mode is allowed. - -| allowedDatabases -| list of database names -| Only databases matching the specified names may be hosted on the server. -This may not be specified in combination with `deniedDatabases`. - -| deniedDatabases -| list of database names -| Only databases **not** matching the specified names may be hosted on the server. -This may not be specified in combination with `allowedDatabases`. -|=== - -[NOTE] -==== -Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. -The composite databases are available everywhere and hold no data on their own. -==== - -[[server-management-rename-server]] -== Renaming servers - -The name of a server can be altered with `RENAME SERVER 'name' TO 'newName'`. -Either the id or current name of the server can be used to identify the server. -The new name of the server must be unique. - -[[server-management-reallocate]] -== Reallocate databases - -After enabling a server, `REALLOCATE DATABASES` can be used to make the cluster re-balance databases across all servers that are part of the cluster. -Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|database|fromServerName|fromServerId|toServerName|toServerId|mode - -| "db1" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-4" | "00000002-25a9-4984-9ad2-dc39024c9238" | "primary" -| "db3" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-5" | "00000003-0df7-4057-81fd-1cf43c9ef5f7" | "primary" -|=== - -[NOTE] -==== -`DRYRUN` is introduced in Neo4j 5.2, and thus is not available in earlier minor releases of v5. -==== - -[role=not-on-aura] -[[server-management-deallocate]] -== Deallocate databases - -A server can be set to not host any databases with `DEALLOCATE DATABASES FROM SERVER 'name'`, in preparation for removing the server from the cluster. -Either the id or name of the server can be used. -All databases that the server is hosting are moved to other servers. -The server changes state to `deallocating`. -A deallocated server cannot readily be enabled again. - -Multiple servers can be deallocated at the same time, `DEALLOCATE DATABASES FROM SERVER 'server-1', 'server-2'`. -The command fails if there aren't enough servers available to move the databases to. - -Using `DRYRUN DEALLOCATE DATABASES FROM 'server-1', 'server-2'` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|database|fromServerName|fromServerId|toServerName|toServerId|mode -| "db1" | "server-1" | "00000001-8c04-4731-a2fd-7b0289c511ce" | "server-4" | "00000002-5b91-43c1-8b25-5289f674563e" | "primary" -| "db1" | "server-2" | "00000000-7e53-427c-a987-24634c4745f3" | "server-5" | "00000003-0e98-44c8-9844-f0a4eb95b0d8" | "primary" -|=== - -[role=not-on-aura] -[[server-management-drop-server]] -== Drop server - -When a server has been deallocated and is no longer hosting any databases it can be removed from the cluster with `DROP SERVER 'name'`. -Either the id or name of the server can be used. -As long as the server is running, it is listed when showing servers with the state `dropped`. diff --git a/modules/ROOT/pages/access-control/manage-users.adoc b/modules/ROOT/pages/access-control/manage-users.adoc deleted file mode 100644 index 502fc0cce..000000000 --- a/modules/ROOT/pages/access-control/manage-users.adoc +++ /dev/null @@ -1,864 +0,0 @@ -:description: This section explains how to use Cypher to manage users in Neo4j. - -[[access-control-manage-users]] -= Managing users - -[abstract] --- -This section explains how to use Cypher to manage users in Neo4j. --- - -Users can be created and managed using a set of Cypher administration commands executed against the `system` database. -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[access-control-user-syntax]] -== User management command syntax - -[NOTE] -==== -The syntax descriptions use xref:access-control/index.adoc#access-control-syntax[the style] from access control. -==== - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW CURRENT USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW CURRENT USER - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the current user. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-users.adoc#access-control-current-users[Listing current user]. - -| Required privilege -a| None - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW USERS - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW USER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists all users. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-users.adoc#access-control-list-users[Listing users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== -| Command -m| SHOW USER PRIVILEGES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the privileges granted to the specified users or the current user if no user is specified. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW PRIVILEGE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) - -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) -|=== - - -[cols="<15s,<85"] -|=== -| Command -m| CREATE USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE USER name [IF NOT EXISTS] - SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED}] - [SET HOME DATABASE name] ----- - -| Description -a| -Creates a new user. - -For more information, see xref::access-control/manage-users.adoc#access-control-create-users[Creating users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| CREATE OR REPLACE USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE USER name - SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED}] - [SET HOME DATABASE name] ----- - -| Description -a| -Creates a new user, or if a user with the same name exists, replace it. - -For more information, see xref::access-control/manage-users.adoc#access-control-create-users[Creating users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - - -[source, privilege, role="noheader"] ----- -GRANT DROP USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| RENAME USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -RENAME USER name [IF EXISTS] TO otherName ----- - -| Description -a| -Changes the name of a user. - -For more information, see xref::access-control/manage-users.adoc#access-control-rename-users[Renaming users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT RENAME USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| ALTER USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -ALTER USER name [IF EXISTS] - [SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password'] - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED} ] - [SET HOME DATABASE name] - [REMOVE HOME DATABASE] ----- - -| Description -a| -Modifies the settings for an existing user. -At least one `SET` or `REMOVE` clause is required. -`SET` and `REMOVE` clauses cannot be combined in the same command. - -For more information, see xref::access-control/manage-users.adoc#access-control-alter-users[Modifying users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SET PASSWORD ----- - -[source, privilege, role="noheader" ----- -GRANT SET USER STATUS ----- - -[source, privilege, role="noheader"] ----- -GRANT SET USER HOME DATABASE ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| ALTER CURRENT USER SET PASSWORD - -| Syntax -a| -[source, syntax, role="noheader"] ----- -ALTER CURRENT USER SET PASSWORD FROM 'oldPassword' TO 'newPassword' ----- - -| Description -a| -Changes the current user's password. - -For more information, see xref::access-control/manage-users.adoc#access-control-alter-password[Changing the current user's password]. - -| Required privilege -a| None - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| DROP USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -DROP USER name [IF EXISTS] ----- - -| Description -a| -Removes an existing user. - -For more information, see xref::access-control/manage-users.adoc#access-control-drop-users[Delete users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT DROP USER ----- - -(see xref::access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[NOTE] -==== -The `SHOW USER[S] PRIVILEGES` command is only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - - -[[access-control-current-users]] -== Listing current user - -The currently logged-in user can be seen using `SHOW CURRENT USER`, which will produce a table with the following columns: - -[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] -|=== -| Column -| Description -| Type -| Community Edition -| Enterprise Edition - -| user -| User name -| STRING -| {check-mark} -| {check-mark} - -| roles -| Roles granted to the user. - -Will return `null` in community edition. -| LIST OF STRING -| {cross-mark} -| {check-mark} - -| passwordChangeRequired -| If `true`, the user must change their password at the next login. -| BOOLEAN -| {check-mark} -| {check-mark} - -| suspended -| If `true`, the user is currently suspended (cannot log in). - -Will return `null` in community edition. -| BOOLEAN -| {cross-mark} -| {check-mark} - -| home -| The home database configured by the user, or `null` if no home database has been configured. -If this database is unavailable and the user does not specify a database to use, they will not be able to log in. - -Will return `null` in community edition. -| STRING -| {cross-mark} -| {check-mark} -|=== - -[source, cypher, role=noplay] ----- -SHOW CURRENT USER ----- - -.Result -[options="header,footer", width="100%", cols="2m,2m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"jake" -|["PUBLIC"] -|false -|false -| - -5+a|Rows: 1 -|=== - -[NOTE] -==== -This command is only supported for a logged-in user and will return an empty result if authorization has been disabled. -==== - - -[[access-control-list-users]] -== Listing users - -Available users can be seen using `SHOW USERS`, which will produce a table of users with the following columns: - -[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] -|=== -| Column -| Description -| Type -| Community Edition -| Enterprise Edition - -| user -| User name -| STRING -| {check-mark} -| {check-mark} - -| roles -| Roles granted to the user. - -Will return `null` in community edition. -| LIST OF STRING -| {cross-mark} -| {check-mark} - -| passwordChangeRequired -| If `true`, the user must change their password at the next login. -| BOOLEAN -| {check-mark} -| {check-mark} - -| suspended -| If `true`, the user is currently suspended (cannot log in). - -Will return `null` in community edition. -| BOOLEAN -| {cross-mark} -| {check-mark} - -| home -| The home database configured by the user, or `null` if no home database has been configured. -A home database will be resolved if it is either pointing to a database or a database alias. -If this database is unavailable and the user does not specify a database to use, they will not be able to log in. - -Will return `null` in community edition. -| STRING -| {cross-mark} -| {check-mark} -|=== - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[role="queryresult" options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"neo4j" -|["admin","PUBLIC"] -|false -|false -| - -5+a|Rows: 1 -|=== - -When first starting a Neo4j DBMS, there is always a single default user `neo4j` with administrative privileges. -It is possible to set the initial password using link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/set-initial-password[`neo4j-admin dbms set-initial-password `], otherwise it is necessary to change the password after the first login. - -.Show user -====== -This example shows how to: - -* Reorder the columns using a `YIELD` clause. -* Filter the results using a `WHERE` clause. - -[source, cypher, role=noplay] ----- -SHOW USER YIELD user, suspended, passwordChangeRequired, roles, home -WHERE user = 'jake' ----- -====== - -.Show user -====== -It is possible to add a `RETURN` clause to further manipulate the results after filtering. -In this example, the `RETURN` clause is used to filter out the `roles` column and rename the `user` column to `adminUser`. - -[source,cypher,role=noplay] ----- -SHOW USERS YIELD roles, user -WHERE 'admin' IN roles -RETURN user AS adminUser ----- -====== - -[NOTE] -==== -The `SHOW USER name PRIVILEGES` command is described in xref::access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. -==== - - -[[access-control-create-users]] -== Creating users - -Users can be created using `CREATE USER`. - -[source, syntax, role="noheader"] ----- -CREATE USER name [IF NOT EXISTS] - SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] ----- - -Users can be created or replaced using `CREATE OR REPLACE USER`. - -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE USER name - SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] ----- - -* For `SET PASSWORD`: -** The `password` can either be a string value or a string parameter. -** The default Neo4j password length is at least 8 characters. -** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. -`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. -Consequently, it is never possible to get the plaintext of a password back out of the database. -A password can be set in either fashion at any time. -** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. -** The optional `ENCRYPTED` is used to recreate an existing user when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + -With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: -*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. -*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. -* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. -The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. -* The default for `SET STATUS` is `ACTIVE`. -* `SET HOME DATABASE` can be used to configure a home database for a user. -A home database will be resolved if it is either pointing to a database or a database alias. -If no home database is set, the DBMS default database is used as the home database for the user. -* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. - -[NOTE] -==== -User names are case sensitive. -The created user will appear on the list provided by `SHOW USERS`. - -* In Neo4j Community Edition there are no roles, but all users have implied administrator privileges. -* In Neo4j Enterprise Edition all users are automatically assigned the xref::access-control/built-in-roles.adoc#access-control-built-in-roles-public[`PUBLIC` role], giving them a base set of privileges. -==== - - -.Create user -====== -For example, you can create the user `jake` in a suspended state, with the home database `anotherDb`, and the requirement to change the password by using the command: - -[source,cypher,role=noplay] ----- -CREATE USER jake -SET PASSWORD 'abcd1234' CHANGE REQUIRED -SET STATUS SUSPENDED -SET HOME DATABASE anotherDb ----- - -====== - - -.Create user -====== -Or you can create the user `Jake` in an active state, with an encrypted password (taken from the _data/scripts/databasename/restore_metadata.cypher_ of a database backup), and the requirement to not change the password by running: - -[source,cypher,role=noplay] ----- -CREATE USER Jake -SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff2a55c5b825,190ae47c661e0668a0c8be8a21ff78a4a34cdf918cae3c407e907b73932bd16c' CHANGE NOT REQUIRED -SET STATUS ACTIVE ----- - -====== - -[NOTE] -==== -The `SET STATUS {ACTIVE | SUSPENDED}` and `SET HOME DATABASE` parts of the commands are only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - -The `CREATE USER` command is optionally idempotent, with the default behavior to throw an exception if the user already exists. -Appending `IF NOT EXISTS` to the `CREATE USER` command will ensure that no exception is thrown and nothing happens should the user already exist. - - -.Create user if not exists -====== -[source,cypher,role=noplay] ----- -CREATE USER jake IF NOT EXISTS -SET PLAINTEXT PASSWORD 'abcd1234' ----- - -====== - -The `CREATE OR REPLACE USER` command will result in any existing user being deleted and a new one created. - - -.Create or replace user -====== -[source,cypher,role=noplay] ----- -CREATE OR REPLACE USER jake -SET PLAINTEXT PASSWORD 'abcd1234' ----- - -This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`. - -====== - -[NOTE] -==== -The `CREATE OR REPLACE USER` command does not allow the use of `IF NOT EXISTS`. -==== - - -[[access-control-rename-users]] -== Renaming users - -Users can be renamed with the `RENAME USER` command. - -[source, cypher, role=noplay] ----- -RENAME USER jake TO bob ----- - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"bob" -|["PUBLIC"] -|true -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 2 - -|=== - -[NOTE] -==== -The `RENAME USER` command is only available when using native authentication and authorization. -==== - - -[[access-control-alter-users]] -== Modifying users - -Users can be modified with `ALTER USER`. - -[source, syntax, role="noheader"] ----- -ALTER USER name [IF EXISTS] - [SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password'] - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] - [REMOVE HOME DATABASE name] ----- - -* At least one `SET` or `REMOVE` clause is required for the command. -* `SET` and `REMOVE` clauses cannot be combined in the same command. -* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. -The `SET PASSWORD` clause must come first, if used. -* For `SET PASSWORD`: -** The `password` can either be a string value or a string parameter. -** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. -`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. -Consequently, it is never possible to get the plaintext of a password back out of the database. -A password can be set in either fashion at any time. -** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. -** The optional `ENCRYPTED` is used to update an existing user's password when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + -With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: -*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. -*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. -* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. -The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. -* For `SET PASSWORD CHANGE [NOT] REQUIRED`, the `SET PASSWORD` is only optional if it directly follows the `SET PASSWORD` clause. -* `SET HOME DATABASE` can be used to configure a home database for a user. -A home database will be resolved if it is either pointing to a database or a database alias. -If no home database is set, the DBMS default database is used as the home database for the user. -* `REMOVE HOME DATABASE` is used to unset the home database for a user. -This results in the DBMS default database being used as the home database for the user. - -For example, you can modify the user `bob` with a new password and active status, and remove the requirement to change his password: - -[source, cypher, role=noplay] ----- -ALTER USER bob -SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED -SET STATUS ACTIVE ----- - -Or you may decide to assign the user `bob` a different home database: - -[source, cypher, role=noplay] ----- -ALTER USER bob -SET HOME DATABASE anotherDbOrAlias ----- - -Or remove the home database from the user `bob`: - -[source, cypher, role=noplay] ----- -ALTER USER bob -REMOVE HOME DATABASE ----- - -[NOTE] -==== -When altering a user, it is only necessary to specify the changes required. -For example, leaving out the `CHANGE [NOT] REQUIRED` part of the query will leave that unchanged. -==== - -[NOTE] -==== -The `SET STATUS {ACTIVE | SUSPENDED}`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts of the command are only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - -The changes to the user will appear on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"bob" -|["PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 2 - -|=== - -The default behavior of this command is to throw an exception if the user does not exist. -Adding an optional parameter `IF EXISTS` to the command makes it idempotent and ensures that no exception is thrown. -Nothing happens should the user not exist. - -[source, cypher, role=noplay] ----- -ALTER USER nonExistingUser IF EXISTS SET PASSWORD 'abcd1234' ----- - - -[[access-control-alter-password]] -== Changing the current user's password - -Users can change their password using `ALTER CURRENT USER SET PASSWORD`. -The old password is required in addition to the new one, and either or both can be a string value or a string parameter. -When a user executes this command it will change their password as well as set the `CHANGE NOT REQUIRED` flag. - -[source, cypher, role=test-skip] ----- -ALTER CURRENT USER -SET PASSWORD FROM 'password1' TO 'password2' ----- - -[NOTE] -==== -This command works only for a logged-in user and cannot be run with auth disabled. -==== - - -[[access-control-drop-users]] -== Delete users - -Users can be deleted with `DROP USER`. - -[source, cypher, role=noplay] ----- -DROP USER bob ----- - -Deleting a user will not automatically terminate associated connections, sessions, transactions, or queries. - -However, when a user has been deleted, it will no longer appear on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 1 - -|=== diff --git a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc index e91afe906..029336e67 100644 --- a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc +++ b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc @@ -5747,11 +5747,7 @@ label:new[] DROP CONSTRAINT name ---- a| -<<<<<<< HEAD xref:constraints/managing-constraints.adoc#drop-constraint[New command] for dropping a constraint by name, no matter the type. -======= -xref:constraints/syntax.adoc#constraints-syntax-drop[New command] for dropping a constraint by name, no matter the type. ->>>>>>> b38c1e9 (Document relationship key and uniqueness constraints (#225)) a| @@ -5862,13 +5858,8 @@ An example of this is `CALL db.index.explicit.searchNodes('my_index','email:me*' | `MATCH (n)-[x:A\|:B\|:C]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C]-() RETURN n` | `MATCH (n)-[x:A\|:B\|:C*]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C*]-() RETURN n` | link:/docs/java-reference/5/extending-neo4j/aggregation-functions#extending-neo4j-aggregation-functions[User-defined aggregation functions] | Functionality | Added | -<<<<<<< HEAD | xref:indexes/search-performance-indexes/managing-indexes.adoc[Composite indexes] | Index | Added | | xref:constraints/managing-constraints.adoc#create-key-constraint[Node Key] | Index | Added | Neo4j Enterprise Edition only -======= -| xref:indexes-for-search-performance.adoc[Composite indexes] | Index | Added | -| xref:constraints/examples.adoc#constraints-examples-node-key[Node Key] | Index | Added | Neo4j Enterprise Edition only ->>>>>>> b38c1e9 (Document relationship key and uniqueness constraints (#225)) | `CYPHER runtime=compiled` (Compiled runtime) | Functionality | Added | Neo4j Enterprise Edition only | xref:functions/list.adoc#functions-reverse-list[reverse()] | Function | Extended | Now also allows a list as input | xref:functions/aggregating.adoc#functions-max[max()], xref:functions/aggregating.adoc#functions-min[min()] | Function | Extended | Now also supports aggregation over a set containing both strings and numbers diff --git a/modules/ROOT/pages/index.adoc b/modules/ROOT/pages/index.adoc new file mode 100644 index 000000000..0eb155bf2 --- /dev/null +++ b/modules/ROOT/pages/index.adoc @@ -0,0 +1,98 @@ +:description: This is the Cypher Query Language documentation for Neo4j, authored by the Neo4j Team. + +[[cypher-manual]] += The Neo4j Cypher Manual v{neo4j-version} +:neo4j-buildnumber: {neo4j-version-minor} + +Cypher is Neo4j's graph query language that allows users to store and retrieve data from the graph database. +It is a declarative, SQL-inspired language for describing visual patterns in graphs. +The syntax provides a visual and logical way to match patterns of nodes and relationships in the graph. + + +== Documentation updates for Neo4j 5 + +Neo4j {neo4j-version} includes a number of new features and updates. +A highlight of these include: + +* Cypher syntax improvements with Graph Pattern Matching (relationships and labels): ++ +** In `MATCH` clauses, `WHERE` can be placed inside a relationship pattern to filter relationships. +** In `MATCH` clauses, nodes and relationships can be filtered using more sophisticated label (type) expressions. +** Simpler alternative syntax to navigate and traverse graphs using the following operators: +*** `&`: logical `AND` +*** `|`: logical `OR` +*** `!`: logical `NOT` +*** `%`: a "wildcard", meaning "any label" (in Cypher this translates to `size(labels(n)) > 0`). + + ++ +For more information, see the xref:syntax/expressions.adoc#label-expressions[section on Label expressions] and in xref:clauses/where.adoc[the `WHERE` clause]. + +* New `elementID` for graph objects: ++ +New IDs are introduced to uniquely identify graph elements in Neo4j databases. +Node ID will exist with each release of Neo4j {neo4j-version}. ++ +For more information, see xref:functions/scalar.adoc#functions-elementid[`elementId()`]. + +* Composite databases. ++ +Composite databases allow queries that access multiple graphs at once. +You can create, update, and remove configurations without a restart, whether the database is within the same cluster, or hosted remotely. ++ +For more information on composite databases, and how to create composite databases, see link:https://neo4j.com/docs/operations-manual/current/composite-databases/[Operations Manual -> Composite databases], and xref:databases.adoc#administration-databases-create-composite-database[Creating composite databases]. + +* Immutable privileges. ++ +Immutable privileges are useful for restricting the actions of users who themselves are able to administer privileges. + +For more information, see xref:access-control/privileges-immutable.adoc[Immutable privileges]. + +* `Execute` and `ExecuteBoosted` privilege. ++ +The permissions for the execution of admin procedures have been refreshed; these two privileges are now hierarchically related. ++ +For more information, see xref:access-control/dbms-administration.adoc#access-control-execute-procedure[the `EXECUTE PROCEDURE` privilege] and xref:access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[the `EXECUTE BOOSTED PROCEDURE` privilege]. + +* `EXISTS` and `COUNT` are now both expressions. ++ +For more information, see xref:syntax/expressions.adoc#cypher-subquery-expressions[Subquery expressions]. + +* `SHOW` and `TERMINATE TRANSACTIONS` improvements. ++ +You can now combine these two commands in the same query. +The ability to yield and filter the output from `TERMINATE TRANSACTIONS` has been added. ++ +For more information, see xref:deprecations-additions-removals-compatibility.adoc#_updated_features[Updated features list]. + +* `SHOW SETTINGS` clause. ++ +You can now query configuration settings using `SHOW SETTINGS` clause. ++ +For more information, see xref:clauses/listing-settings.adoc[SHOW SETTINGS]. + +* Changes to Neo4j indexes: ++ +** The B-tree index type has been removed. +** New Range and Point index types are available now. +** Faster Text index provider for `ENDS WITH` and `CONTAINS` queries is introduced. +** Full-text indexes can now index lists of strings. + ++ +For more information, see xref:indexes-for-search-performance.adoc[new index types]. + + +ifdef::backend-html5[(C) {copyright}] +ifndef::backend-pdf[] + +Documentation license: link:{common-license-page-uri}[Creative Commons 4.0] +endif::[] +ifdef::backend-pdf[] +(C) {copyright} + +Documentation license: <> +endif::[] + +ifdef::backend-pdf[] +include::license.adoc[leveloffset=+1] +endif::[] + + diff --git a/modules/ROOT/pages/introduction/aura.adoc b/modules/ROOT/pages/introduction/aura.adoc new file mode 100644 index 000000000..449df071e --- /dev/null +++ b/modules/ROOT/pages/introduction/aura.adoc @@ -0,0 +1,52 @@ += Aura and Cypher + +== Introduction + +Aura is Neo4j's fully managed cloud service. +It consists of AuraDB and AuraDS. +AuraDB is a graph database service for developers building intelligent applications, and AuraDS is a Graph Data Science (GDS) service for data scientists building predictive models and analytics workflows. + +AuraDB is available on the following tiers: + +* AuraDB Free +* AuraDB Pro +* AuraDB Enterprise + +For more information, see link:{neo4j-docs-base-uri}/aura/auradb[Aura docs - Neo4j AuraDB overview]. + +AuraDS is available on the following tiers: + +* AuraDS Pro +* AuraDS Enterprise + +For more information, see link:{neo4j-docs-base-uri}/aura/aurads[Aura docs - Neo4j AuraDS overview] + +== Using Cypher on Aura + +Most Cypher features are available on all tiers of Aura. +There are, however, some features which are not available to Aura instances. +For example, it is not possible to create, alter, or drop databases using Aura, nor is it possible to alter or drop servers. + +There are also certain Cypher features which are only available on AuraDB Enterprise instances. +These can be categorized as the role-based access-control features of Cypher. +For example, it is not possible to create, alter, or drop roles using AuraDB Free, AuraDB Pro, AuraDS Pro, or AuraDS Enterprise, but it is possible using AuraDB Enterprise. + +The Cypher Manual uses two different labels to differentiate this distinction: + +[options="header,cols=""2a,2a"] +|=== +| Label | Description +| label:not-on-aura[] | Cypher feature not available on any tier of Aura. +| label:aura-db-enterprise[] | Cypher feature only available on AuraDB Enterprise. +|=== + +//// +TODO: remove comment blocks once Aura Cheat Sheet has been published. + +== Aura and the Cypher Cheat Sheet + +Each different tier of Aura has a customized version of the Cypher Cheat Sheet which only shows the features of Cypher available for the chosen tier. + +The Aura Cheat Sheet can be accessed here: //Add url when available +Note that the default tier is AuraDB Enterprise. +//// From b2ccc1430cb950fa4255ce32937e67210e460845 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Tue, 11 Apr 2023 13:37:01 +0200 Subject: [PATCH 21/32] New Administration chapter (#504) Original PR: https://github.com/neo4j/docs-cypher/pull/494 --- modules/ROOT/content-nav.adoc | 16 + .../access-control/built-in-roles.adoc | 501 ++++ .../database-administration.adoc | 981 ++++++++ .../access-control/dbms-administration.adoc | 2170 +++++++++++++++++ .../administration/access-control/index.adoc | 37 + .../access-control/limitations.adoc | 337 +++ .../access-control/manage-privileges.adoc | 1436 +++++++++++ .../access-control/manage-roles.adoc | 816 +++++++ .../access-control/manage-users.adoc | 864 +++++++ .../access-control/privileges-immutable.adoc | 46 + .../access-control/privileges-reads.adoc | 189 ++ .../access-control/privileges-writes.adoc | 407 ++++ .../ROOT/pages/administration/aliases.adoc | 1523 ++++++++++++ .../ROOT/pages/administration/databases.adoc | 1172 +++++++++ modules/ROOT/pages/administration/index.adoc | 83 + .../ROOT/pages/administration/servers.adoc | 441 ++++ .../ROOT/pages/clauses/listing-functions.adoc | 4 + 17 files changed, 11023 insertions(+) create mode 100644 modules/ROOT/pages/administration/access-control/built-in-roles.adoc create mode 100644 modules/ROOT/pages/administration/access-control/database-administration.adoc create mode 100644 modules/ROOT/pages/administration/access-control/dbms-administration.adoc create mode 100644 modules/ROOT/pages/administration/access-control/index.adoc create mode 100644 modules/ROOT/pages/administration/access-control/limitations.adoc create mode 100644 modules/ROOT/pages/administration/access-control/manage-privileges.adoc create mode 100644 modules/ROOT/pages/administration/access-control/manage-roles.adoc create mode 100644 modules/ROOT/pages/administration/access-control/manage-users.adoc create mode 100644 modules/ROOT/pages/administration/access-control/privileges-immutable.adoc create mode 100644 modules/ROOT/pages/administration/access-control/privileges-reads.adoc create mode 100644 modules/ROOT/pages/administration/access-control/privileges-writes.adoc create mode 100644 modules/ROOT/pages/administration/aliases.adoc create mode 100644 modules/ROOT/pages/administration/databases.adoc create mode 100644 modules/ROOT/pages/administration/servers.adoc diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc index bdbda333e..c2b9426cb 100644 --- a/modules/ROOT/content-nav.adoc +++ b/modules/ROOT/content-nav.adoc @@ -138,6 +138,22 @@ ** xref:syntax/parameters.adoc[] ** xref:syntax/comments.adoc[] +* xref:administration/index.adoc[] +** xref:administration/databases.adoc[] +** xref:administration/aliases.adoc[] +** xref:administration/servers.adoc[] +** xref:administration/access-control/index.adoc[] +*** xref:administration/access-control/manage-users.adoc[] +*** xref:administration/access-control/manage-roles.adoc[] +*** xref:administration/access-control/manage-privileges.adoc[] +*** xref:administration/access-control/built-in-roles.adoc[] +*** xref:administration/access-control/privileges-reads.adoc[] +*** xref:administration/access-control/privileges-writes.adoc[] +*** xref:administration/access-control/database-administration.adoc[] +*** xref:administration/access-control/dbms-administration.adoc[] +*** xref:administration/access-control/limitations.adoc[] +*** xref:administration/access-control/privileges-immutable.adoc[] + * xref:deprecations-additions-removals-compatibility.adoc[] * Appendix diff --git a/modules/ROOT/pages/administration/access-control/built-in-roles.adoc b/modules/ROOT/pages/administration/access-control/built-in-roles.adoc new file mode 100644 index 000000000..cd29e7da2 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/built-in-roles.adoc @@ -0,0 +1,501 @@ +:description: The default privileges of the built-in roles in Neo4j and how to recreate them if needed. +[role=enterprise-edition aura-db-enterprise] +[[access-control-built-in-roles]] += Built-in roles and privileges + +[abstract] +-- +This section explains the default privileges of the built-in roles in Neo4j and how to recreate them if needed. +-- + +All of the commands described in this chapter require that the user executing the commands has the rights to do so. +The privileges listed in the following sections are the default set of privileges for each built-in role: + +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-public[The `PUBLIC` role] +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-reader[The `reader` role] +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-editor[The `editor` role] +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-publisher[The `publisher` role] +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-architect[The `architect` role] +* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-admin[The `admin` role] + +[[access-control-built-in-roles-public]] +== The `PUBLIC` role + +All users are granted the `PUBLIC` role, and it can not be revoked or dropped. +By default, it gives access to the default database and allows executing all procedures and user-defined functions. + +[IMPORTANT] +==== +The `PUBLIC` role cannot be dropped or revoked from any user, but the specific privileges for the role can be modified. +In contrast to the `PUBLIC` role, the other built-in roles can be granted, revoked, dropped, and re-created. +==== + +[[access-control-built-in-roles-public-list]] +=== Listing `PUBLIC` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE PUBLIC PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" +|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" +a|Rows: 3 +|=== + + +[[access-control-built-in-roles-public-recreate]] +=== Recreating the `PUBLIC` role + +The `PUBLIC` role can not be dropped and thus there is no need to recreate the role itself. +To restore the role to its original capabilities, two steps are needed. + +First, all `GRANT` or `DENY` privileges on this role should be revoked (see output of `SHOW ROLE PUBLIC PRIVILEGES AS REVOKE COMMANDS` on what to revoke). +Secondly, run these queries: + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON HOME DATABASE TO PUBLIC +---- + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURES * ON DBMS TO PUBLIC +---- + +[source, cypher, role=noplay] +---- +GRANT EXECUTE USER DEFINED FUNCTIONS * ON DBMS TO PUBLIC +---- + +The resulting `PUBLIC` role now has the same privileges as the original built-in `PUBLIC` role. + + +[[access-control-built-in-roles-reader]] +== The `reader` role + +The `reader` role can perform read-only queries on all graphs except for the `system` database. + + +[[access-control-built-in-roles-reader-list]] +=== Listing `reader` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE reader PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `reader`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" +|"GRANT SHOW CONSTRAINT ON DATABASE * TO `reader`" +|"GRANT SHOW INDEX ON DATABASE * TO `reader`" +a|Rows: 5 +|=== + + +[[access-control-built-in-roles-reader-recreate]] +=== Recreating the `reader` role + +//// +[source, cypher, role=test-setup] +---- +DROP ROLE reader; +---- +//// + +To restore the role to its original capabilities two steps are needed. +First, execute `DROP ROLE reader`. +Secondly, run these queries: + +[source, cypher, role=noplay] +---- +CREATE ROLE reader +---- + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON DATABASE * TO reader +---- + +[source, cypher, role=noplay] +---- +GRANT MATCH {*} ON GRAPH * TO reader +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW CONSTRAINT ON DATABASE * TO reader +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW INDEX ON DATABASE * TO reader +---- + +The resulting `reader` role now has the same privileges as the original built-in `reader` role. + + +[[access-control-built-in-roles-editor]] +== The `editor` role + +The `editor` role can perform read and write operations on all graphs except for the `system` database, but it cannot create new labels, property keys or relationship types. + +[[access-control-built-in-roles-editor-list]] +=== Listing `editor` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE editor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" +|"GRANT SHOW CONSTRAINT ON DATABASE * TO `editor`" +|"GRANT SHOW INDEX ON DATABASE * TO `editor`" +|"GRANT WRITE ON GRAPH * TO `editor`" +a|Rows: 6 +|=== + + +[[access-control-built-in-roles-editor-recreate]] +=== Recreating the `editor` role + +//// +[source, cypher, role=test-setup] +---- +DROP ROLE editor; +---- +//// + +To restore the role to its original capabilities two steps are needed. +First, execute `DROP ROLE editor`. +Secondly, run these queries: + +[source, cypher, role=noplay] +---- +CREATE ROLE editor +---- + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON DATABASE * TO editor +---- + +[source, cypher, role=noplay] +---- +GRANT MATCH {*} ON GRAPH * TO editor +---- + +[source, cypher, role=noplay] +---- +GRANT WRITE ON GRAPH * TO editor +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW CONSTRAINT ON DATABASE * TO editor +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW INDEX ON DATABASE * TO editor +---- + +The resulting `editor` role now has the same privileges as the original built-in `editor` role. + + +[[access-control-built-in-roles-publisher]] +== The `publisher` role + +The `publisher` role can do the same as xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-editor[`editor`], as well as create new labels, property keys and relationship types. + + +[[access-control-built-in-roles-publisher-list]] +=== Listing `publisher` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE publisher PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" +|"GRANT SHOW CONSTRAINT ON DATABASE * TO `publisher`" +|"GRANT SHOW INDEX ON DATABASE * TO `publisher`" +|"GRANT WRITE ON GRAPH * TO `publisher`" +a|Rows: 7 +|=== + + +[[access-control-built-in-roles-publisher-recreate]] +=== Recreating the `publisher` role + +//// +[source, cypher, role=test-setup] +---- +DROP ROLE publisher; +---- +//// + +To restore the role to its original capabilities two steps are needed. +First, execute `DROP ROLE publisher`. +Secondly, run these queries: + +[source, cypher, role=noplay] +---- +CREATE ROLE publisher +---- + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON DATABASE * TO publisher +---- + +[source, cypher, role=noplay] +---- +GRANT MATCH {*} ON GRAPH * TO publisher +---- + +[source, cypher, role=noplay] +---- +GRANT WRITE ON GRAPH * TO publisher +---- + +[source, cypher, role=noplay] +---- +GRANT NAME MANAGEMENT ON DATABASE * TO publisher +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW CONSTRAINT ON DATABASE * TO publisher +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW INDEX ON DATABASE * TO publisher +---- + +The resulting `publisher` role now has the same privileges as the original built-in `publisher` role. + + +[[access-control-built-in-roles-architect]] +== The `architect` role + +The `architect` role can do the same as the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-publisher[`publisher`], as well as create and manage indexes and constraints. + + +[[access-control-built-in-roles-architect-list]] +=== Listing `architect` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE architect PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `architect`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT SHOW CONSTRAINT ON DATABASE * TO `architect`" +|"GRANT SHOW INDEX ON DATABASE * TO `architect`" +|"GRANT WRITE ON GRAPH * TO `architect`" +a|Rows: 9 +|=== + + +[[access-control-built-in-roles-architect-recreate]] +=== Recreating the `architect` role + +//// +[source, cypher, role=test-setup] +---- +DROP ROLE architect; +---- +//// + +To restore the role to its original capabilities two steps are needed. +First, execute `DROP ROLE architect`. +Secondly, run these queries: + +[source, cypher, role=noplay] +---- +CREATE ROLE architect +---- + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON DATABASE * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT MATCH {*} ON GRAPH * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT WRITE ON GRAPH * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT NAME MANAGEMENT ON DATABASE * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW CONSTRAINT ON DATABASE * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT SHOW INDEX ON DATABASE * TO architect +---- + +[source, cypher, role=noplay] +---- +GRANT INDEX MANAGEMENT ON DATABASE * TO architect +---- + +The resulting `architect` role now has the same privileges as the original built-in `architect` role. + + +[[access-control-built-in-roles-admin]] +== The `admin` role + +The `admin` role can do the same as the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-architect[`architect`], as well as manage databases, aliases, users, roles and privileges. + +The `admin` role has the ability to perform administrative tasks. +These include the rights to perform the following classes of tasks: + +* Manage xref::administration/access-control/database-administration.adoc[database security] to control the rights to perform actions on specific databases: +** Manage access to a database and the right to start and stop a database. +** Manage xref::indexes-for-search-performance.adoc[indexes] and xref::constraints/index.adoc[constraints]. +** Allow the creation of labels, relationship types or property names. +** Manage transactions +* Manage xref::administration/access-control/dbms-administration.adoc[DBMS security] to control the rights to perform actions on the entire system: +** Manage xref::administration/databases.adoc[multiple databases]. +** Manage xref::administration/access-control/manage-users.adoc[users] and xref::administration/access-control/manage-roles.adoc[roles]. +** Change configuration parameters. +** Manage sub-graph privileges. +** Manage procedure security. + +These rights are conferred using privileges that can be managed through the xref::administration/access-control/manage-privileges.adoc#access-control-graph-privileges[`GRANT`, `DENY` and `REVOKE` commands]. + + +[[access-control-built-in-roles-admin-list]] +=== Listing `admin` role privileges + +[source, cypher, role=noplay] +---- +SHOW ROLE admin PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `admin`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT SHOW CONSTRAINT ON DATABASE * TO `admin`" +|"GRANT SHOW INDEX ON DATABASE * TO `admin`" +|"GRANT START ON DATABASE * TO `admin`" +|"GRANT STOP ON DATABASE * TO `admin`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `admin`" +a|Rows: 13 +|=== + +If the built-in `admin` role has been altered or dropped, and needs to be restored to its original state, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/password-and-user-recovery[Operations Manual -> Password and user recovery]. + +[[access-control-built-in-roles-admin-recreate]] +=== Recreating the `admin` role + +To restore the role to its original capabilities two steps are needed. +First, execute `DROP ROLE admin`. +Secondly, run these queries: + +// we cannot test this right now cause we would delete the role the test user is logged with + +[source, cypher, role=noplay test-skip] +---- +CREATE ROLE admin +---- + +[source, cypher, role=noplay] +---- +GRANT ALL DBMS PRIVILEGES ON DBMS TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT TRANSACTION MANAGEMENT ON DATABASE * TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT START ON DATABASE * TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT STOP ON DATABASE * TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT MATCH {*} ON GRAPH * TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT WRITE ON GRAPH * TO admin +---- + +[source, cypher, role=noplay] +---- +GRANT ALL ON DATABASE * TO admin +---- + +The resulting `admin` role now has the same effective privileges as the original built-in `admin` role. + +Additional information about restoring the `admin` role can be found in the link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/password-and-user-recovery#recover-admin-role[Operations Manual -> Recover the admin role]. + diff --git a/modules/ROOT/pages/administration/access-control/database-administration.adoc b/modules/ROOT/pages/administration/access-control/database-administration.adoc new file mode 100644 index 000000000..874047c73 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/database-administration.adoc @@ -0,0 +1,981 @@ +:description: How to use Cypher to manage Neo4j database administrative privileges. + +//// +[source, cypher, role=test-setup] +---- +CREATE ROLE regularUsers; +CREATE ROLE databaseAdminUsers; +CREATE DATABASE `remote-db`; +CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +---- +//// + +[role=enterprise-edition aura-db-enterprise] +[[access-control-database-administration]] += Database administration + +[abstract] +-- +This section explains how to use Cypher to manage Neo4j database administrative privileges. +-- + +Administrators can use the following Cypher commands to manage Neo4j database administrative rights. + +The components of the database privilege commands are: + +* _command_: +** `GRANT` – gives privileges to roles. +** `DENY` – denies privileges to roles. +** `REVOKE` – removes granted or denied privileges from roles. + +* _mutability_: +** `IMMUTABLE` - When used in conjunction with `GRANT` or `DENY`, specifies that a privilege cannot subsequently be removed unless auth is disabled. +Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. +See also xref:administration/access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. + +* _database-privilege_ +** `ACCESS` - allows access to a specific database or remote database alias. +** `START` - allows the specified database to be started. +** `STOP` - allows the specified database to be stopped. +** `CREATE INDEX` - allows indexes to be created on the specified database. +** `DROP INDEX` - allows indexes to be deleted on the specified database. +** `SHOW INDEX` - allows indexes to be listed on the specified database. +** `INDEX [MANAGEMENT]` - allows indexes to be created, deleted, and listed on the specified database. +** `CREATE CONSTRAINT` - allows constraints to be created on the specified database. +** `DROP CONSTRAINT` - allows constraints to be deleted on the specified database. +** `SHOW CONSTRAINT` - allows constraints to be listed on the specified database. +** `CONSTRAINT [MANAGEMENT]` - allows constraints to be created, deleted, and listed on the specified database. +** `CREATE NEW [NODE] LABEL` - allows new node labels to be created. +** `CREATE NEW [RELATIONSHIP] TYPE` - allows new relationship types to be created. +** `CREATE NEW [PROPERTY] NAME` - allows property names to be created, so that nodes and relationships can have properties assigned with these names. +** `NAME [MANAGEMENT]` - allows all of the name management capabilities: node labels, relationship types, and property names. +** `ALL [[DATABASE] PRIVILEGES]` - allows access, index, constraint, and name management for the specified database or remote database alias. +** `SHOW TRANSACTION` - allows listing transactions and queries for the specified users on the specified database. +** `TERMINATE TRANSACTION` - allows ending transactions and queries for the specified users on the specified database. +** `TRANSACTION [MANAGEMENT]` - allows listing and ending transactions and queries for the specified users on the specified database. + +* _name_ +** The database to associate the privilege with. ++ +[NOTE] +==== +If you delete a database and create a new one with the same name, the new one will NOT have the same privileges previously assigned to the deleted one. +==== +** The _name_ component can be `+*+`, which means all databases. +Databases created after this command execution will also be associated with these privileges. +** The `DATABASE[S] _name_` part of the command can be replaced by `HOME DATABASE`. +This refers to the home database configured for a user or, if that user does not have a home database configured, the default database. +If the user's home database changes for any reason after this command execution, the new one will be associated with these privileges. +This can be quite powerful as it allows permissions to be switched from one database to another simply by changing a user's home database. + +* _role[, ...]_ +** The role or roles to associate the privilege with, comma-separated. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.General grant +ON DATABASE+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } TO role[, ...] +---- + +| Description +| Grants a privilege to one or multiple roles. + +|=== + + +.General deny +ON DATABASE+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +DENY ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +DENY [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } TO role[, ...] +---- + +| Description +| Denies a privilege to one or multiple roles. + +|=== + + +.General revoke +ON DATABASE+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE GRANT ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] GRANT database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] +---- + +| Description +| Revoke a granted privilege from one or multiple roles. + +|=== + + +.General revoke +ON DATABASE+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE DENY ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] DENY database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] +---- + +| Description +| Revokes a denied privilege from one or multiple roles. + +|=== + + +.General revoke +ON DATABASE+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] +---- + +| Description +| Revokes a granted or denied privilege from one or multiple roles. + +|=== + + +[NOTE] +==== +`DENY` does *not* erase a granted privilege. +Use `REVOKE` if you want to remove a privilege. +==== + +The hierarchy between the different database privileges is shown in the image below. + +image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] + + + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT ACCESS+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] ACCESS + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +a| +Grants the specified roles the privilege to access: + +* The home database. +* Specific database(s) or remote database alias(es). +* All databases and remote database aliases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { START \| STOP }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { START \| STOP } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to start or stop the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { CREATE \| DROP \| SHOW } INDEX+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to create, delete, or show indexes on the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT INDEX+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to manage indexes on the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { CREATE \| DROP \| SHOW } CONSTRAINT+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to create, delete, or show constraints on the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CONSTRAINT+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to manage constraints on the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW LABEL+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to create new node labels in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW TYPE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to create new relationship types in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW NAME+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to create new property names in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT NAME+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] NAME [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to manage new labels, relationship types, and property names in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT ALL+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles all privileges for the home, a specific, or all databases and remote database aliases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { SHOW \| TERMINATE } TRANSACTION+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { SHOW \| TERMINATE } TRANSACTION[S] [( { * \| user[, ...] } )] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to list and end the transactions and queries of all users or a particular user(s) in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT TRANSACTION+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to manage the transactions and queries of all users or a particular user(s) in the home database, specific database(s), or all databases. + +|=== + + +image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] + + +[[access-control-database-administration-access]] +== The database `ACCESS` privilege + +The `ACCESS` privilege enables users to connect to a database or a remote database alias. +With `ACCESS` you can run calculations, for example, `+RETURN 2 * 5 AS answer+` or call functions `RETURN timestamp() AS time`. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to access the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT ACCESS ON DATABASE neo4j TO regularUsers +---- + +The `ACCESS` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to access to the remote database alias `remote-db`, use: + +[source, cypher, role=noplay] +---- +DENY ACCESS ON DATABASE `remote-db` TO regularUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE regularUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ACCESS ON DATABASE `remote-db` TO `regularUsers`" +|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" +a|Rows: 2 +|=== + + +[[access-control-database-administration-startstop]] +== The database `START`/`STOP` privileges + +The `START` privilege can be used to enable the ability to start a database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] START + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to start the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT START ON DATABASE neo4j TO regularUsers +---- + +The `START` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] START + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY START ON DATABASE system TO regularUsers +---- + +The `STOP` privilege can be used to enable the ability to stop a database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] STOP + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to stop the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT STOP ON DATABASE neo4j TO regularUsers +---- + +The `STOP` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] STOP + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY STOP ON DATABASE system TO regularUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE regularUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ACCESS ON DATABASE `remote-db` TO `regularUsers`" +|"DENY START ON DATABASE `system` TO `regularUsers`" +|"DENY STOP ON DATABASE `system` TO `regularUsers`" +|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" +|"GRANT START ON DATABASE `neo4j` TO `regularUsers`" +|"GRANT STOP ON DATABASE `neo4j` TO `regularUsers`" +a|Rows: 6 +|=== + +[NOTE] +==== +Note that `START` and `STOP` privileges are not included in the xref::administration/access-control/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. +==== + + +[[access-control-database-administration-index]] +== The `INDEX MANAGEMENT` privileges + +Indexes can be created, deleted, or listed with the `CREATE INDEX`, `DROP INDEX`, and `SHOW INDEXES` commands. +The privilege to do this can be granted with `GRANT CREATE INDEX`, `GRANT DROP INDEX`, and `GRANT SHOW INDEX` commands. +The privilege to do all three can be granted with `GRANT INDEX MANAGEMENT` command. + + + + +.Index management privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { CREATE \| DROP \| SHOW } INDEX+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create, delete, or show indexes in the home database, specific database(s), or all databases. + +|=== + + + +.Index management privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT INDEX+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to manage indexes in the home database, specific database(s), or all databases. + +|=== + + +For example, to grant the role `regularUsers` the ability to create indexes on the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT CREATE INDEX ON DATABASE neo4j TO regularUsers +---- + + +[[access-control-database-administration-constraints]] +== The `CONSTRAINT MANAGEMENT` privileges + +Constraints can be created, deleted, or listed with the `CREATE CONSTRAINT`, `DROP CONSTRAINT` and `SHOW CONSTRAINTS` commands. +The privilege to do this can be granted with `GRANT CREATE CONSTRAINT`, `GRANT DROP CONSTRAINT`, `GRANT SHOW CONSTRAINT` commands. +The privilege to do all three can be granted with `GRANT CONSTRAINT MANAGEMENT` command. + + +.Constraint management privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { CREATE \| DROP \| SHOW } CONSTRAINT+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create, delete, or show constraints on the home database, specific database(s), or all databases. + +|=== + + +.Constraint management privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CONSTRAINT+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enable the specified roles to manage constraints on the home database, specific database(s), or all databases. + +|=== + + +For example, to grant the role `regularUsers` the ability to create constraints on the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT CREATE CONSTRAINT ON DATABASE neo4j TO regularUsers +---- + + +[[access-control-database-administration-tokens]] +== The `NAME MANAGEMENT` privileges + +The right to create new labels, relationship types, and property names is different from the right to create nodes, relationships, and properties. +The latter is managed using database `WRITE` privileges, while the former is managed using specific `+GRANT/DENY CREATE NEW ...+` commands for each type. + + +.Node label management privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW LABEL+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create new node labels in the home database, specific database(s), or all databases. + +|=== + + +.Relationship type management privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW TYPE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create new relationship types in the home database, specific database(s), or all databases. + +|=== + + +.Property name management privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT CREATE NEW NAME+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create new property names in the home database, specific database(s), or all databases. + +|=== + + +.Node label, relationship type, and property name privileges management syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT NAME+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] NAME [MANAGEMENT] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to create new labels, relationship types, and property names in the home database, specific database(s), or all databases. + +|=== + + +For example, to grant the role `regularUsers` the ability to create new properties on nodes or relationships on the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT CREATE NEW PROPERTY NAME ON DATABASE neo4j TO regularUsers +---- + + +[[access-control-database-administration-all]] +== Granting `ALL DATABASE PRIVILEGES` + +The right to access a database, create and drop indexes and constraints and create new labels, relationship types or property names can be achieved with a single command: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +[NOTE] +==== +Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. +These privileges are associated with administrators while other database privileges are of use to domain and application developers. +==== + +For example, granting the abilities above on the database `neo4j` to the role `databaseAdminUsers` is done using the following query. + +[source, cypher, role=noplay] +---- +GRANT ALL DATABASE PRIVILEGES ON DATABASE neo4j TO databaseAdminUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE databaseAdminUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALL DATABASE PRIVILEGES ON DATABASE `neo4j` TO `databaseAdminUsers`" +a|Rows: 1 +|=== + + +[[access-control-database-administration-transaction]] +== Granting `TRANSACTION MANAGEMENT` privileges + +The right to run the commands `SHOW TRANSACTIONS`, `TERMINATE TRANSACTIONS`, and the deprecated procedures `dbms.listTransactions`, `dbms.listQueries`, `dbms.killQuery`, `dbms.killQueries`, `dbms.killTransaction` and `dbms.killTransactions` is now managed through the `SHOW TRANSACTION` and `TERMINATE TRANSACTION` privileges. + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT SHOW TRANSACTION+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] SHOW TRANSACTION[S] [( { * \| user[, ...] } )] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to list transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT TERMINATE TRANSACTION+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] TERMINATE TRANSACTION[S] [( { * \| user[, ...] } )] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to end running transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. + +|=== + + +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT TRANSACTION+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] + ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Enables the specified roles to manage transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. + +|=== + + +[NOTE] +==== +Note that the `TRANSACTION MANAGEMENT` privileges are not included in the xref::administration/access-control/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. +==== + +For example, to grant the role `regularUsers` the ability to list transactions for user `jake` on the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SHOW TRANSACTION (jake) ON DATABASE neo4j TO regularUsers +---- diff --git a/modules/ROOT/pages/administration/access-control/dbms-administration.adoc b/modules/ROOT/pages/administration/access-control/dbms-administration.adoc new file mode 100644 index 000000000..900c30032 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/dbms-administration.adoc @@ -0,0 +1,2170 @@ +:description: How to use Cypher to manage Neo4j DBMS administrative privileges. + +//// +[source, cypher, role=test-setup] +---- +CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE ROLE roleAdder IF NOT EXISTS; +CREATE ROLE roleNameModifier IF NOT EXISTS; +CREATE ROLE roleDropper IF NOT EXISTS; +CREATE ROLE roleAssigner IF NOT EXISTS; +CREATE ROLE roleRemover IF NOT EXISTS; +CREATE ROLE roleShower IF NOT EXISTS; +CREATE ROLE roleManager IF NOT EXISTS; +CREATE ROLE userAdder IF NOT EXISTS; +CREATE ROLE userNameModifier IF NOT EXISTS; +CREATE ROLE userModifier IF NOT EXISTS; +CREATE ROLE passwordModifier IF NOT EXISTS; +CREATE ROLE statusModifier IF NOT EXISTS; +CREATE ROLE userDropper IF NOT EXISTS; +CREATE ROLE userShower IF NOT EXISTS; +CREATE ROLE userManager IF NOT EXISTS; +CREATE ROLE userImpersonator IF NOT EXISTS; +CREATE ROLE databaseAdder IF NOT EXISTS; +CREATE ROLE compositeDatabaseAdder IF NOT EXISTS; +CREATE ROLE databaseDropper IF NOT EXISTS; +CREATE ROLE compositeDatabaseDropper IF NOT EXISTS; +CREATE ROLE databaseModifier IF NOT EXISTS; +CREATE ROLE accessModifier IF NOT EXISTS; +CREATE ROLE compositeDatabaseManager IF NOT EXISTS; +CREATE ROLE databaseManager IF NOT EXISTS; +CREATE ROLE aliasAdder IF NOT EXISTS; +CREATE ROLE aliasDropper IF NOT EXISTS; +CREATE ROLE aliasModifier IF NOT EXISTS; +CREATE ROLE aliasLister IF NOT EXISTS; +CREATE ROLE aliasManager IF NOT EXISTS; +CREATE ROLE privilegeShower IF NOT EXISTS; +CREATE ROLE privilegeAssigner IF NOT EXISTS; +CREATE ROLE privilegeRemover IF NOT EXISTS; +CREATE ROLE privilegeManager IF NOT EXISTS; +CREATE ROLE procedureExecutor IF NOT EXISTS; +CREATE ROLE deniedProcedureExecutor IF NOT EXISTS; +CREATE ROLE boostedProcedureExecutor IF NOT EXISTS; +CREATE ROLE deniedBoostedProcedureExecutor1 IF NOT EXISTS; +CREATE ROLE deniedBoostedProcedureExecutor2 IF NOT EXISTS; +CREATE ROLE deniedBoostedProcedureExecutor3 IF NOT EXISTS; +CREATE ROLE deniedBoostedProcedureExecutor4 IF NOT EXISTS; +CREATE ROLE adminProcedureExecutor IF NOT EXISTS; +CREATE ROLE functionExecutor IF NOT EXISTS; +CREATE ROLE deniedFunctionExecutor IF NOT EXISTS; +CREATE ROLE boostedFunctionExecutor IF NOT EXISTS; +CREATE ROLE globbing1 IF NOT EXISTS; +CREATE ROLE globbing2 IF NOT EXISTS; +CREATE ROLE globbing3 IF NOT EXISTS; +CREATE ROLE globbing4 IF NOT EXISTS; +CREATE ROLE globbing5 IF NOT EXISTS; +CREATE ROLE globbing6 IF NOT EXISTS; +CREATE ROLE dbmsManager IF NOT EXISTS; +CREATE ROLE configurationViewer IF NOT EXISTS; +CREATE ROLE deniedConfigurationViewer IF NOT EXISTS; +---- +//// + +[role=enterprise-edition aura-db-enterprise] +[[access-control-dbms-administration]] += DBMS administration + +[abstract] +-- +This section explains how to use Cypher to manage Neo4j DBMS administrative privileges. +-- + +All DBMS privileges are relevant system-wide. +Like user management, they do not belong to one specific database or graph. +For more details on the differences between graphs, databases and the DBMS, refer to xref::introduction/cypher_neo4j.adoc[]. + +image::privileges_grant_and_deny_syntax_dbms_privileges.svg[title="Syntax of GRANT and DENY DBMS Privileges"] + +image::privileges_hierarchy_dbms.svg[title="DBMS privileges hierarchy"] + +The xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges. +These include: + +* Create, delete, and modify databases and aliases. +* Change configuration parameters. +* Manage transactions. +* Manage users and roles. +* Manage sub-graph privileges. +* Manage procedure security. + +To enable a user to perform these tasks, you can grant them the `admin` role, but it is also possible to make a custom role with a subset of these privileges. +All privileges are also assignable using Cypher commands. +For more details, see the following sections: + +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[Role management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[User management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-impersonation[Impersonation privileges management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-database-management[Database management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[Alias management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[Privilege management] +* xref::administration/access-control/database-administration.adoc#access-control-database-administration-transaction[Transaction management] +* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-execute[Procedure and user-defined function security] + +[[access-control-dbms-administration-custom]] +== Using a custom role to manage DBMS privileges + +In order to have an administrator role with a subset of privileges that includes all DBMS privileges, but not all database privileges, you can copy the `admin` role and revoke or deny the unwanted privileges. +A second option is to build a custom administrator from scratch by granting the wanted privileges instead. + +As an example, an administrator role can be created to only manage users and roles by using the second option: + +. First, create the new role: ++ +[source, cypher, role=noplay] +---- +CREATE ROLE usermanager +---- +. Then grant the privilege to manage users: ++ +[source, cypher, role=noplay] +---- +GRANT USER MANAGEMENT ON DBMS TO usermanager +---- +. And to manage roles: ++ +[source, cypher, role=noplay] +---- +GRANT ROLE MANAGEMENT ON DBMS TO usermanager +---- + +The resulting role has privileges that only allow user and role management. +To list all privileges for the role `usermanager` as commands, run this query: + +[source, cypher, role=noplay] +---- +SHOW ROLE usermanager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ROLE MANAGEMENT ON DBMS TO `usermanager`" +|"GRANT USER MANAGEMENT ON DBMS TO `usermanager`" +a|Rows: 2 +|=== + +Note that this role does not allow all DBMS capabilities. +For example, the role is missing privileges for management, creation and drop of databases as well as execution of `admin` procedures. +To create a more powerful administrator, you can grant a different set of privileges. + +In the following example, a new administrator role is created to perform almost all DBMS capabilities, excluding database management. +However, the role still has some limited database capabilities, such as managing transactions: + +. Again, start by creating a new role: ++ +[source, cypher, role=noplay] +---- +CREATE ROLE customAdministrator +---- +. Then grant the privilege for all DBMS capabilities: ++ +[source, cypher, role=noplay] +---- +GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator +---- +. And explicitly deny the privilege to manage databases and aliases: ++ +[source, cypher, role=noplay] +---- +DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator +---- +. Next, grant the transaction management privilege: ++ +[source, cypher, role=noplay] +---- +GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator +---- + +The resulting role has privileges that include all DBMS privileges except creating, dropping, and modifying databases and aliases, as well as managing transactions. +Use the following query to list all privileges for the role `customAdministrator` as commands: + +[source, cypher, role=noplay] +---- +SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY DATABASE MANAGEMENT ON DBMS TO `customAdministrator`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `customAdministrator`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `customAdministrator`" +a|Rows: 3 +|=== + + +[[access-control-dbms-administration-role-management]] +== The DBMS `ROLE MANAGEMENT` privileges + +The DBMS privileges for role management are assignable using Cypher administrative commands. +They can be granted, denied and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Role management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] CREATE ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to create new roles. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] RENAME ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to change the name of roles. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] DROP ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to delete roles. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ASSIGN ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to assign roles to users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] REMOVE ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to remove roles from users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SHOW ROLE + ON DBMS + TO role[, ...] +| Enables the specified roles to list roles. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ROLE MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to create, delete, assign, remove, and list roles. + +|=== + +The ability to add roles can be granted via the `CREATE ROLE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT CREATE ROLE ON DBMS TO roleAdder +---- + +The resulting role has privileges that only allow adding roles. +List all privileges for the role `roleAdder` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleAdder PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CREATE ROLE ON DBMS TO `roleAdder`" +a|Rows: 1 +|=== + +The ability to rename roles can be granted via the `RENAME ROLE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT RENAME ROLE ON DBMS TO roleNameModifier +---- + +The resulting role has privileges that only allow renaming roles. +List all privileges for the role `roleNameModifier` using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT RENAME ROLE ON DBMS TO `roleNameModifier`" +a|Rows: 1 +|=== + +The ability to delete roles can be granted via the `DROP ROLE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DROP ROLE ON DBMS TO roleDropper +---- + +The resulting role has privileges that only allow deleting roles. +List all privileges for the role `roleDropper` by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleDropper PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DROP ROLE ON DBMS TO `roleDropper`" +a|Rows: 1 +|=== + +The ability to assign roles to users can be granted via the `ASSIGN ROLE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ASSIGN ROLE ON DBMS TO roleAssigner +---- + +The resulting role has privileges that only allow assigning/granting roles. +List all privileges for the role `roleAssigner` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ASSIGN ROLE ON DBMS TO `roleAssigner`" +a|Rows: 1 +|=== + +The ability to remove roles from users can be granted via the `REMOVE ROLE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT REMOVE ROLE ON DBMS TO roleRemover +---- + +The resulting role has privileges that only allow removing/revoking roles. +List all privileges for the role `roleRemover` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleRemover PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT REMOVE ROLE ON DBMS TO `roleRemover`" +a|Rows: 1 +|=== + +The ability to show roles can be granted via the `SHOW ROLE` privilege. +A role with this privilege is allowed to execute the `SHOW ROLES` and `SHOW POPULATED ROLES` administration commands. +For the `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both this privilege and the `SHOW USER` privilege are required. +The following query shows an example of how to grant the `SHOW ROLE` privilege: + +In order to use `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both the `SHOW ROLE` and the `SHOW USER` privileges are required. +See an example of how to grant the `SHOW ROLE` privilege: + +[source, cypher, role=noplay] +---- +GRANT SHOW ROLE ON DBMS TO roleShower +---- + +The resulting role has privileges that only allow showing roles. +List all privileges for the role `roleShower` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleShower PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW ROLE ON DBMS TO `roleShower`" +a|Rows: 1 +|=== + +The privileges to create, rename, delete, assign, remove, and list roles can be granted via the `ROLE MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ROLE MANAGEMENT ON DBMS TO roleManager +---- + +The resulting role has all privileges to manage roles. +List all privileges for the role `roleManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE roleManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ROLE MANAGEMENT ON DBMS TO `roleManager`" +a|Rows: 1 +|=== + + +[[access-control-dbms-administration-user-management]] +== The DBMS `USER MANAGEMENT` privileges + +The DBMS privileges for user management can be assigned using Cypher administrative commands. +They can be granted, denied and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.User management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] CREATE USER + ON DBMS + TO role[, ...] +| Enables the specified roles to create new users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] RENAME USER + ON DBMS + TO role[, ...] +| Enables the specified roles to change the name of users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ALTER USER + ON DBMS + TO role[, ...] +| Enables the specified roles to modify users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SET PASSWORD[S] + ON DBMS + TO role[, ...] +| Enables the specified roles to modify users' passwords and whether those passwords must be changed upon first login. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SET USER HOME DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to modify users' home database. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SET USER STATUS + ON DBMS + TO role[, ...] +| Enables the specified roles to modify the account status of users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] DROP USER + ON DBMS + TO role[, ...] +| Enables the specified roles to delete users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SHOW USER + ON DBMS + TO role[, ...] +| Enables the specified roles to list users. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] USER MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to create, delete, modify, and list users. + +|=== + +The ability to add users can be granted via the `CREATE USER` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT CREATE USER ON DBMS TO userAdder +---- + +The resulting role has privileges that only allow adding users. +List all privileges for the role `userAdder` as commands by using this query: + +[source, cypher, role=noplay] +---- +SHOW ROLE userAdder PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CREATE USER ON DBMS TO `userAdder`" +a|Rows: 1 +|=== + +The ability to rename users can be granted via the `RENAME USER` privilege. +The following query shows an example of this: + +[source, cypher, role=noplay] +---- +GRANT RENAME USER ON DBMS TO userNameModifier +---- + +The resulting role has privileges that only allow renaming users: + +[source, cypher, role=noplay] +---- +SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS +---- + +Lists all privileges for role `userNameModifier`: + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT RENAME USER ON DBMS TO `userNameModifier`" +a|Rows: 1 +|=== + +The ability to modify users can be granted via the `ALTER USER` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ALTER USER ON DBMS TO userModifier +---- + +The resulting role has privileges that only allow modifying users. +List all privileges for the role `userModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE userModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALTER USER ON DBMS TO `userModifier`" +a|Rows: 1 +|=== + +A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED` and `SET STATUS` parts: + +[source, cypher, role=noplay] +---- +ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED +---- + +The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the `SET PASSWORDS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SET PASSWORDS ON DBMS TO passwordModifier +---- + +The resulting role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login. +List all privileges for the role `passwordModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SET PASSWORD ON DBMS TO `passwordModifier`" +a|Rows: 1 +|=== + +A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts: + +[source, cypher, role=noplay] +---- +ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED +---- + +The ability to modify the account status of users can be granted via the `SET USER STATUS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SET USER STATUS ON DBMS TO statusModifier +---- + +The resulting role has privileges that only allow modifying the account status of users. +List all privileges for the role `statusModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE statusModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SET USER STATUS ON DBMS TO `statusModifier`" +a|Rows: 1 +|=== + +A user that is granted the `SET USER STATUS` privilege is allowed to run the `ALTER USER` administration command with only the `SET STATUS` part: + +[source, cypher, role=noplay] +---- +ALTER USER jake SET STATUS ACTIVE +---- + +In order to be able to modify the home database of users, grant the `SET USER HOME DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SET USER HOME DATABASE ON DBMS TO statusModifier +---- + +The resulting role has privileges that only allow modifying the home database of users. +List all privileges for the role `statusModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE statusModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SET USER HOME DATABASE ON DBMS TO `statusModifier`" +|"GRANT SET USER STATUS ON DBMS TO `statusModifier`" +a|Rows: 2 +|=== + +A user that is granted the `SET USER HOME DATABASE` privilege is allowed to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part: + +[source, cypher, role=noplay] +---- +ALTER USER jake SET HOME DATABASE otherDb +---- + +[source, cypher, role=noplay] +---- +ALTER USER jake REMOVE HOME DATABASE +---- + +[NOTE] +==== +Note that the combination of the `SET PASSWORDS`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action. +==== + +The ability to delete users can be granted via the `DROP USER` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DROP USER ON DBMS TO userDropper +---- + +The resulting role has privileges that only allow deleting users. +List all privileges for the role `userDropper` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE userDropper PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DROP USER ON DBMS TO `userDropper`" +a|Rows: 1 +|=== + +The ability to show users can be granted via the `SHOW USER` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SHOW USER ON DBMS TO userShower +---- + +The resulting role has privileges that only allow showing users. +List all privileges for the role `userShower` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE userShower PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW USER ON DBMS TO `userShower`" +a|Rows: 1 +|=== + +The privileges to create, rename, modify, delete, and list users can be granted via the `USER MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT USER MANAGEMENT ON DBMS TO userManager +---- + +The resulting role has all privileges to manage users. +List all privileges for the role `userManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE userManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW USER ON DBMS TO `userManager`" +a|Rows: 1 +|=== + +[[access-control-dbms-administration-impersonation]] +== The DBMS `IMPERSONATE` privileges + +The DBMS privileges for impersonation can be assigned through Cypher administrative commands. +They can be granted, denied, and revoked like other privileges. + +Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands). + +The ability to impersonate users can be granted via the `IMPERSONATE` privilege. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Impersonation privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] IMPERSONATE [(*)] + ON DBMS + TO role[, ...] +| Enables the specified roles to impersonate any user. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] IMPERSONATE (user[, ...]) + ON DBMS + TO role[, ...] +| Enables the specified roles to impersonate the specified users. + +|=== + +The following query shows an example of this. +Note that `userImpersonator` must be an existing role in order to make this query work: + +.Query +[source, cypher, role=noplay] +---- +GRANT IMPERSONATE (*) ON DBMS TO userImpersonator +---- + +The resulting role has privileges that allow impersonating all users: + +.Query +[source, cypher, role=noplay] +---- +SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +| command +| "GRANT IMPERSONATE (*) ON DBMS TO `userImpersonator`" +a|Rows: 1 +|=== + +It is also possible to deny and revoke that privilege. +See an example which shows of how the `userImpersonator` user would be able to impersonate all users, except `alice`: + +.Query +[source, cypher, role=noplay] +---- +DENY IMPERSONATE (alice) ON DBMS TO userImpersonator +---- + +To grant (or revoke) the permissions to impersonate a specific user or a subset of users, you can first list them with this query: + +.Query +[source, cypher, role=noplay] +---- +GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator +---- + + +[[access-control-dbms-administration-database-management]] +== The DBMS `DATABASE MANAGEMENT` privileges + +The DBMS privileges for database management can be assigned by using Cypher administrative commands. +They can be granted, denied and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Database management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] CREATE DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to create new standard databases and aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] DROP DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to delete standard databases and aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ALTER DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to modify standard databases and aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SET DATABASE ACCESS + ON DBMS + TO role[, ...] +| Enables the specified roles to modify access to standard databases. + +| [source, syntax, role=noheader] +GRANT CREATE COMPOSITE DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to create new composite databases. + +| [source, syntax, role=noheader] +GRANT DROP COMPOSITE DATABASE + ON DBMS + TO role[, ...] +| Enables the specified roles to delete composite databases. + +| [source, syntax, role=noheader] +GRANT COMPOSITE DATABASE MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to create and delete composite databases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] DATABASE MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to create, delete, and modify databases and aliases. + +|=== + + +The ability to create standard databases and aliases can be granted via the `CREATE DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT CREATE DATABASE ON DBMS TO databaseAdder +---- + +The resulting role has privileges that only allow creating standard databases and aliases. +List all privileges for the role `databaseAdder` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CREATE DATABASE ON DBMS TO `databaseAdder`" +a|Rows: 1 +|=== + +The ability to create composite databases can be granted via the `CREATE COMPOSITE DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT CREATE COMPOSITE DATABASE ON DBMS TO compositeDatabaseAdder +---- + +The resulting role has privileges that only allow creating composite databases. +List all privileges for the role `compositeDatabaseAdder` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CREATE COMPOSITE DATABASE ON DBMS TO `compositeDatabaseAdder`" +a|Rows: 1 +|=== + +The ability to delete standard databases and aliases can be granted via the `DROP DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DROP DATABASE ON DBMS TO databaseDropper +---- + +The resulting role has privileges that only allow deleting standard databases and aliases. +List all privileges for the role `databaseDropper` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DROP DATABASE ON DBMS TO `databaseDropper`" +a|Rows: 1 +|=== + +The ability to delete composite databases can be granted via the `DROP COMPOSITE DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DROP COMPOSITE DATABASE ON DBMS TO compositeDatabaseDropper +---- + +The resulting role has privileges that only allow deleting composite databases. +List all privileges for the role `compositeDatabaseDropper` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DROP COMPOSITE DATABASE ON DBMS TO `compositeDatabaseDropper`" +a|Rows: 1 +|=== + +The ability to modify standard databases and aliases can be granted via the `ALTER DATABASE` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ALTER DATABASE ON DBMS TO databaseModifier +---- + +The resulting role has privileges that only allow modifying standard databases and aliases. +List all privileges for the role `databaseModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALTER DATABASE ON DBMS TO `databaseModifier`" +a|Rows: 1 +|=== + +The ability to modify access to standard databases can be granted via the `SET DATABASE ACCESS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE ACCESS ON DBMS TO accessModifier +---- + +The resulting role has privileges that only allow modifying access to standard databases. +List all privileges for the role `accessModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE accessModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SET DATABASE ACCESS ON DBMS TO `accessModifier`" +a|Rows: 1 +|=== + +The ability to create and delete composite databases can be granted via the `COMPOSITE DATABASE MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager +---- + +The resulting role has all privileges to manage composite databases. +List all privileges for the role `compositeDatabaseManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO `compositeDatabaseManager`" +a|Rows: 1 +|=== + +The ability to create, delete, and modify databases and aliases can be granted via the `DATABASE MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager +---- + +The resulting role has all privileges to manage standard and composite databases as well as aliases. +List all privileges for the role `databaseManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE databaseManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DATABASE MANAGEMENT ON DBMS TO `databaseManager`" +a|Rows: 1 +|=== + +[[access-control-dbms-administration-alias-management]] +== The DBMS `ALIAS MANAGEMENT` privileges + +The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases. +They can be granted, denied and revoked like other privileges. +It is also possible to manage aliases with xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-database-management[database management commands]. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Alias management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] CREATE ALIAS +ON DBMS +TO role[, ...] +| Enables the specified roles to create new aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] DROP ALIAS +ON DBMS +TO role[, ...] +| Enables the specified roles to delete aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ALTER ALIAS +ON DBMS +TO role[, ...] +| Enables the specified roles to modify aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SHOW ALIAS +ON DBMS +TO role[, ...] +| Enables the specified roles to list aliases. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ALIAS MANAGEMENT +ON DBMS +TO role[, ...] +| Enables the specified roles to list, create, delete, and modify aliases. + +|=== + +The ability to create aliases can be granted via the `CREATE ALIAS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT CREATE ALIAS ON DBMS TO aliasAdder +---- + +The resulting role has privileges that only allow creating aliases. +List all privileges for the role `aliasAdder` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CREATE ALIAS ON DBMS TO `aliasAdder`" +a|Rows: 1 +|=== + +The ability to delete aliases can be granted via the `DROP ALIAS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT DROP ALIAS ON DBMS TO aliasDropper +---- + +The resulting role has privileges that only allow deleting aliases. +See all privileges for the role `aliasDropper` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT DROP ALIAS ON DBMS TO `aliasDropper`" +a|Rows: 1 +|=== + +The ability to modify aliases can be granted via the `ALTER ALIAS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ALTER ALIAS ON DBMS TO aliasModifier +---- + +The resulting role has privileges that only allow modifying aliases. +List all privileges for the role `aliasModifier` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALTER ALIAS ON DBMS TO `aliasModifier`" +a|Rows: 1 +|=== + +The ability to list aliases can be granted via the `SHOW ALIAS` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT SHOW ALIAS ON DBMS TO aliasLister +---- + +The resulting role has privileges that only allow modifying aliases. +List all privileges for the role `aliasLister` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE aliasLister PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW ALIAS ON DBMS TO `aliasLister`" +a|Rows: 1 +|=== + +The privileges to list, create, delete, and modify aliases can be granted via the `ALIAS MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager +---- + +The resulting role has all privileges to manage aliases. +List all privileges for the role `aliasManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE aliasManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALIAS MANAGEMENT ON DBMS TO `aliasManager`" +a|Rows: 1 +|=== + +[[access-control-dbms-administration-server-management]] +== The DBMS `SERVER MANAGEMENT` privileges + +The DBMS privileges for server management can be assigned using Cypher administrative commands. +They can be granted, denied, and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Server management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT SERVER MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to show, enable, rename, alter, reallocate, deallocate, and drop servers. + +| [source, syntax, role=noheader] +GRANT SHOW SERVERS + ON DBMS + TO role[, ...] +| Enables the specfied roles to show servers. +|=== + + +[[access-control-dbms-administration-privilege-management]] +== The DBMS `PRIVILEGE MANAGEMENT` privileges + +The DBMS privileges for privilege management can be assigned by using Cypher administrative commands. +They can be granted, denied and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Privilege management privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command | Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SHOW PRIVILEGE + ON DBMS + TO role[, ...] +| Enables the specified roles to list privileges. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] ASSIGN PRIVILEGE + ON DBMS + TO role[, ...] +| Enables the specified roles to assign privileges using the `GRANT` and `DENY` commands. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] REMOVE PRIVILEGE + ON DBMS + TO role[, ...] +| Enables the specified roles to remove privileges using the `REVOKE` command. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT + ON DBMS + TO role[, ...] +| Enables the specified roles to list, assign, and remove privileges. +|=== + +The ability to list privileges can be granted via the `SHOW PRIVILEGE` privilege. + +A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands. +To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required. +The following query shows an example of how to grant the `SHOW PRIVILEGE` privilege: + +[source, cypher, role=noplay] +---- +GRANT SHOW PRIVILEGE ON DBMS TO privilegeShower +---- + +The resulting role has privileges that only allow showing privileges. +List all privileges for the role `privilegeShower` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE privilegeShower PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeShower`" +a|Rows: 1 +|=== + +[NOTE] +==== +Note that no specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands. + +In addition, note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges. +Other users' privileges cannot be listed when using a non-native auth provider. +==== + +The ability to assign privileges to roles can be granted via the `ASSIGN PRIVILEGE` privilege. +A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands. +See an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner +---- + +The resulting role has privileges that only allow assigning privileges. +List all privileges for the role `privilegeAssigner` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ASSIGN PRIVILEGE ON DBMS TO `privilegeAssigner`" +a|Rows: 1 +|=== + +The ability to remove privileges from roles can be granted via the `REMOVE PRIVILEGE` privilege. + +A user with this privilege is allowed to execute `REVOKE` administration commands. +See an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover +---- + +The resulting role has privileges that only allow removing privileges. +List all privileges for the role `privilegeRemover` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT REMOVE PRIVILEGE ON DBMS TO `privilegeRemover`" +a|Rows: 1 +|=== + +The privileges to list, assign, and remove privileges can be granted via the `PRIVILEGE MANAGEMENT` privilege. +See an example: + +[source, cypher, role=noplay] +---- +GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager +---- + +The resulting role has all privileges to manage privileges. +List all privileges for the role `privilegeManager` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT PRIVILEGE MANAGEMENT ON DBMS TO `privilegeManager`" +a|Rows: 1 +|=== + + +[[access-control-dbms-administration-execute]] +== The DBMS `EXECUTE` privileges + +The DBMS privileges for procedure and user defined function execution can be assigned by using Cypher administrative commands. +They can be granted, denied and revoked like other privileges. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Execute privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command +| Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] EXECUTE PROCEDURE[S] name-globbing[, ...] + ON DBMS + TO role[, ...] +| Enables the specified roles to execute the given procedures. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] EXECUTE BOOSTED PROCEDURE[S] name-globbing[, ...] + ON DBMS + TO role[, ...] +| Enables the specified roles to execute the given procedures with elevated privileges. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] EXECUTE ADMIN[ISTRATOR] PROCEDURES + ON DBMS + TO role[, ...] +| Enables the specified roles to execute procedures annotated with `@Admin`. The procedures are executed with elevated privileges. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] EXECUTE [USER [DEFINED]] FUNCTION[S] name-globbing[, ...] + ON DBMS + TO role[, ...] +| Enables the specified roles to execute the given user defined functions. + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, ...] + ON DBMS + TO role[, ...] +| Enables the specified roles to execute the given user defined functions with elevated privileges. +|=== + +The `EXECUTE BOOSTED` privileges replace the `dbms.security.procedures.default_allowed` and `dbms.security.procedures.roles` configuration parameters for procedures and user defined functions. +The configuration parameters are still honored as a set of temporary privileges. +These cannot be revoked, but will be updated on each restart with the current configuration values. + + +[[access-control-execute-procedure]] +=== The `EXECUTE PROCEDURE` privilege + +The ability to execute a procedure can be granted via the `EXECUTE PROCEDURE` privilege. +A role with this privilege is allowed to execute the procedures matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. +The following query shows an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor +---- + +Users with the role `procedureExecutor` can then run any procedure in the `db.schema` namespace. +The procedure is run using the user's own privileges. + +The resulting role has privileges that only allow executing procedures in the `db.schema` namespace. +List all privileges for the role `procedureExecutor` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO `procedureExecutor`" +a|Rows: 1 +|=== + +In order to allow the execution of all but only a few procedures, you can grant `EXECUTE PROCEDURES *` and deny the unwanted procedures. +For example, the following queries allow the execution of all procedures, except those starting with `dbms.killTransaction`: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE PROCEDURE dbms.killTransaction* ON DBMS TO deniedProcedureExecutor +---- + +The resulting role has privileges that only allow executing all procedures except those starting with `dbms.killTransaction`. +List all privileges for the role `deniedProcedureExecutor` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE PROCEDURE dbms.killTransaction* ON DBMS TO `deniedProcedureExecutor`" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedProcedureExecutor`" +a|Rows: 2 +|=== + +Both the `dbms.killTransaction` and the `dbms.killTransactions` procedures are blocked here, as well as any other procedures starting with `dbms.killTransaction`. + + +[[access-control-execute-boosted-procedure]] +=== The `EXECUTE BOOSTED PROCEDURE` privilege + +The ability to execute a procedure with elevated privileges can be granted via the `EXECUTE BOOSTED PROCEDURE` privilege. +A user with this privilege is allowed to execute the procedures matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing] without the execution being restricted to their other privileges. + +There is no need to grant an individual `EXECUTE PROCEDURE` privilege for the procedures either, as granting the `EXECUTE BOOSTED PROCEDURE` includes an implicit `EXECUTE PROCEDURE` grant for them. +A denied `EXECUTE PROCEDURE` still denies executing the procedure. +The following query shows an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE * ON DBMS TO boostedProcedureExecutor; +GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boostedProcedureExecutor +---- + +Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges. +Now they can see everything on the graph and not just the labels and types that the user has `TRAVERSE` privilege on. + +The resulting role has privileges that only allow executing the `db.labels` and the `db.relationshipTypes` procedures, but with elevated execution. +List all privileges for the role `boostedProcedureExecutor` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `boostedProcedureExecutor`" +|"GRANT EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `boostedProcedureExecutor`" +|"GRANT EXECUTE BOOSTED PROCEDURE db.relationshipTypes ON DBMS TO `boostedProcedureExecutor`" +a|Rows: 3 +|=== + +Granting the `EXECUTE BOOSTED PROCEDURE` privilege on its own allows the procedure to be both executed (due to the implicit `EXECUTE PROCEDURE` grant) and proceed with elevated privileges. +A denied `EXECUTE BOOSTED PROCEDURE` on its own behaves slightly differently: it only denies the elevation and not the execution of the procedure. +However, a role with both a granted `EXECUTE BOOSTED PROCEDURE` and a denied `EXECUTE BOOSTED PROCEDURE` will deny the execution as well. +This is explained through the following examples: + +.Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` +[example] +==== +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1 +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1 +---- + +The resulting role has privileges that allow the execution of all procedures using the user's own privileges. +It also prevents the `db.labels` procedure from being elevated. +Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`. + +To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor1`" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor1`" +a|Rows: 2 +|=== +==== + +.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE` +[example] +==== +[source, cypher, role=noplay] +---- +GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2 +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2 +---- + +The resulting role has privileges that allow executing all procedures with elevated privileges except `db.labels`, which is not allowed to be executed at all. +List all privileges for the role `deniedBoostedProcedureExecutor2` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor2`" +|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor2`" +a|Rows: 2 +|=== +==== + +.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` +[example] +==== +[source, cypher, role=noplay] +---- +GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3 +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3 +---- + +The resulting role has privileges that allow executing all procedures with elevated privileges except `db.labels`, which is not allowed to be executed at all. +List all privileges for the role `deniedBoostedProcedureExecutor3` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor3`" +|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor3`" +a|Rows: 2 +|=== +==== + +.Grant `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` +[example] +==== +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor4 +---- + +[source, cypher, role=noplay] +---- +GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor4 +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor4 +---- + +The resulting role has privileges that allow executing all procedures with elevated privileges except the `db.labels` procedure, which is only allowed to execute using the user's own privileges. +List all privileges for the role `deniedBoostedProcedureExecutor4` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedBoostedProcedureExecutor4 PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor4`" +|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor4`" +|"GRANT EXECUTE PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor4`" +a|Rows: 3 +|=== +==== + +.How would the privileges from examples 1 to 4 affect the output of a procedure? +[example] +==== +Assume there is a procedure called `myProc`. + +This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege. + +Now, adapt the privileges from examples 1 to 4 to be applied to this procedure and show what is returned. +With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`. + +With the privileges from example 2, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE PROCEDURE myProc`, execution of the `myProc` procedure is not allowed. + +With the privileges from example 3, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, execution of the `myProc` procedure is not allowed. + +For comparison, when granted: + +* `EXECUTE PROCEDURE myProc`: the `myProc` procedure returns the result `A` and `B`. +* `EXECUTE BOOSTED PROCEDURE myProc`: execution of the `myProc` procedure is not allowed. +* `EXECUTE PROCEDURE myProc` and `EXECUTE BOOSTED PROCEDURE myProc`: the `myProc` procedure returns the result `A`, `B`, and `C`. + +For comparison, when only `EXECUTE BOOSTED PROCEDURE myProc` is granted, the `myProc` procedure returns the result `A`, `B`, and `C`; without the need for granting of the `EXECUTE PROCEDURE myProc` privilege. +==== + + +[[access-control-admin-procedure]] +=== The `EXECUTE ADMIN PROCEDURE` privilege + +The ability to execute admin procedures (annotated with `@Admin`) can be granted via the `EXECUTE ADMIN PROCEDURES` privilege. +This privilege is equivalent to granting the xref::administration/access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[`EXECUTE BOOSTED PROCEDURE` privilege] on each of the admin procedures. +Any newly added `admin` procedure is automatically included in this privilege. +The following query shows an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor +---- + +Users with the role `adminProcedureExecutor` can then run any `admin` procedure with elevated privileges. + +The resulting role has privileges that allow executing all admin procedures. +List all privileges for the role `adminProcedureExecutor` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO `adminProcedureExecutor`" +a|Rows: 1 +|=== + +In order to compare this with the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges, revisit the `myProc` procedure, but this time as an `admin` procedure, which will give the result `A`, `B` and `C` when allowed to execute. + +By starting with a user only granted with the `EXECUTE PROCEDURE myProc` privilege, execution of the `myProc` procedure is not allowed. + +However, for a user granted with the `EXECUTE BOOSTED PROCEDURE myProc` or `EXECUTE ADMIN PROCEDURES` privileges, the `myProc` procedure returns the result `A`, `B` and `C`. + +Any denied `EXECUTE` privilege results in the procedure not being allowed to be executed. +In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED PROCEDURE` or `EXECUTE ADMIN PROCEDURES` is being denied. + + +[[access-control-execute-user-defined-function]] +=== The `EXECUTE USER DEFINED FUNCTION` privilege + +//EXECUTE [USER [DEFINED]] FUNCTION[S] +The ability to execute a user-defined function (UDF) can be granted via the `EXECUTE USER DEFINED FUNCTION` privilege. +A role with this privilege is allowed to execute the UDFs matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. + +[IMPORTANT] +==== +The `EXECUTE USER DEFINED FUNCTION` privilege does not apply to built-in functions, which are always executable. +==== + +.Execute user-defined function +====== +The following query shows an example of how to grant this privilege: + +[source,cypher,role=noplay] +---- +GRANT EXECUTE USER DEFINED FUNCTION apoc.coll.* ON DBMS TO functionExecutor +---- + +Or in short form: + +[source,cypher,role=noplay] +---- +GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO functionExecutor +---- + +Users with the role `functionExecutor` can thus run any UDF in the `apoc.coll` namespace. +The function here is run using the user's own privileges. + +The resulting role has privileges that only allow executing UDFs in the `apoc.coll` namespace. +List all privileges for the role `functionExecutor` as commands by using the following query: + +[source,cypher,role=noplay] +---- +SHOW ROLE functionExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO `functionExecutor`" +a|Rows: 1 +|=== +====== + +To allow the execution of all but a few UDFs, you can grant `+EXECUTE USER DEFINED FUNCTIONS *+` and deny the unwanted functions. + +.Execute user-defined functions +====== +The following queries allow the execution of all UDFs except those starting with `apoc.any.prop`: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE USER DEFINED FUNCTIONS * ON DBMS TO deniedFunctionExecutor +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE USER DEFINED FUNCTION apoc.any.prop* ON DBMS TO deniedFunctionExecutor +---- + +Or in short form: + +[source, cypher, role=noplay] +---- +GRANT EXECUTE FUNCTIONS * ON DBMS TO deniedFunctionExecutor +---- + +[source, cypher, role=noplay] +---- +DENY EXECUTE FUNCTION apoc.any.prop* ON DBMS TO deniedFunctionExecutor +---- + +The resulting role has privileges that only allow the execution of all procedures except those starting with `apoc.any.prop`. +List all privileges for the role `deniedFunctionExecutor` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedFunctionExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY EXECUTE FUNCTION apoc.any.prop* ON DBMS TO `deniedFunctionExecutor`" +|"GRANT EXECUTE FUNCTION * ON DBMS TO `deniedFunctionExecutor`" +a|Rows: 2 +|=== + +The `apoc.any.property` and `apoc.any.properties` are blocked, as well as any other procedures starting with `apoc.any.prop`. +====== + +[[access-control-execute-boosted-user-defined-function]] +=== The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege + +//EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] +The ability to execute a user-defined function (UDF) with elevated privileges can be granted via the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege. +A user with this privilege is allowed to execute the UDFs matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing] without the execution being restricted to their other privileges. + +There is no need to grant an individual `EXECUTE USER DEFINED FUNCTION` privilege for the functions, as granting `EXECUTE BOOSTED USER DEFINED FUNCTION` includes an implicit `EXECUTE USER DEFINED FUNCTION` grant. +However, a denied `EXECUTE USER DEFINED FUNCTION` still prevents the function to be executed. + +[IMPORTANT] +==== +The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges. +==== + +Granting `EXECUTE BOOSTED USER DEFINED FUNCTION` on its own allows the UDF to be both executed (because of the implicit `EXECUTE USER DEFINED FUNCTION` grant) and gives it elevated privileges during the execution. +A denied `EXECUTE BOOSTED USER DEFINED FUNCTION` on its own behaves slightly differently: it only denies the elevation and not the execution of the UDF. +However, a role with only a granted `EXECUTE BOOSTED USER DEFINED FUNCTION` and a denied `EXECUTE BOOSTED USER DEFINED FUNCTION` prevents the execution to be performed as well. +This is the same behavior as for the xref::administration/access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[`EXECUTE BOOSTED PROCEDURE` privilege]. + +.Execute boosted user-defined function +====== +The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege: + +[source,cypher,role=noplay] +---- +GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor +GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor +---- + +Or in short form: + +[source,cypher,role=noplay] +---- +GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor +GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor +---- + +Users with the role `boostedFunctionExecutor` can thus run `apoc.any.properties` with full privileges and see every property on the node/relationship, not just the properties that the user has `READ` privilege on. + +The resulting role has privileges that only allow executing of the UDF `apoc.any.properties`, but with elevated execution. +List all privileges for the role `boostedFunctionExecutor` as commands by using the following query: + +[source,cypher,role=noplay] +---- +SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer",width="100%",cols="m"] +|=== +|command +|"GRANT EXECUTE FUNCTION * ON DBMS TO `boostedFunctionExecutor`" +|"GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO `boostedFunctionExecutor`" +a|Rows: 2 +|=== +====== + + +[[access-control-dbms-administration-setting]] +== The DBMS `SETTING` privileges + +The ability to show configuration settings can be granted via the `SHOW SETTING` privilege. +A role with this privilege is allowed to query the configuration settings matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. + + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Setting privileges command syntax +[options="header", width="100%", cols="3a,2"] +|=== +| Command +| Description + +| [source, syntax, role=noheader] +GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...] + ON DBMS + TO role[, ...] +| Enables the specified roles to query given configuration settings. +|=== + +The following query shows an example of how to grant this privilege: + +[source, cypher, role=noplay] +---- +GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer +---- + +Users with the role `configurationViewer` can then query any setting in the `server.bolt` namespace. + +The updated role `configurationViewer` has privileges that only allow querying settings in the `server.bolt` namespace. +List all privileges for the role `configurationViewer` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT SHOW SETTING server.bolt.* ON DBMS TO `configurationViewer`" +a|Rows: 1 +|=== + +To deny a specific setting from a role, first grant `SHOW SETTINGS *`, and then deny the unwanted setting. +For example, the following queries allow the querying of all settings, except those starting with `dbms.security`: + +[source, cypher, role=noplay] +---- +GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer +---- + +[source, cypher, role=noplay] +---- +DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer +---- + +The resulting role has privileges that allow querying all settings except those starting with `dbms.security`. +List all privileges for the role `deniedConfigurationViewer` as commands by using the following query: + +[source, cypher, role=noplay] +---- +SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY SHOW SETTING dbms.security* ON DBMS TO `deniedConfigurationViewer`" +|"GRANT SHOW SETTING * ON DBMS TO `deniedConfigurationViewer`" +a|Rows: 2 +|=== + +As the query result shows, access to any setting starting with `dbms.security` are blocked, but the rest can still be queried. + + +[[access-control-dbms-administration-all]] +== Granting `ALL DBMS PRIVILEGES` + +The right to perform the following privileges can be achieved with a single command: + +* Create, drop, assign, remove, and show roles. +* Create, alter, drop, show, and impersonate users. +* Create, alter, and drop databases and aliases. +* Enable, alter, rename, reallocate, deallocate, and drop servers +* Show, assign, and remove privileges. +* Execute all procedures with elevated privileges. +* Execute all user defined functions with elevated privileges. +* Show all configuration settings. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[source, syntax, role=noheader] +---- +GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES] + ON DBMS + TO role[, ...] +---- + +For example, to grant the role `dbmsManager` the abilities above, use the following query: + +[source, cypher, role=noplay] +---- +GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `dbmsManager`" +a|Rows: 1 +|=== + +[[access-control-name-globbing]] +== Name-globbing for procedures, user-defined functions, and settings + +The name-globbing for procedure, user defined function, and setting names is a simplified version of globbing for filename expansions. +It only allows two wildcard characters: `+*+` and `?`, which are used for multiple and single character matches. +In this case, `+*+` means 0 or more characters and `?` matches exactly one character. + +[NOTE] +==== +The name-globbing is subject to the xref::syntax/naming.adoc[standard Cypher restrictions on valid identifiers], +with the exception that it may include dots, stars, and question marks without the need for escaping using backticks. + +Each part of the name-globbing separated by dots may be individually escaped. +For example, `++mine.`procedureWith%`++` is allowed, but not `++mine.procedure`With%`++`. +Also, note that wildcard characters behave as wildcards even when escaped. +For example, using `++`*`++` is equivalent to using `+*+`, and thus allows executing all functions or procedures and not only the procedure or function named `+*+`. +==== + +Given the following list of procedures: + +* `mine.public.exampleProcedure` +* `mine.public.exampleProcedure1` +* `mine.public.exampleProcedure2` +* `mine.public.with#Special§Characters` +* `mine.private.exampleProcedure` +* `mine.private.exampleProcedure1` +* `mine.private.exampleProcedure2` +* `mine.private.with#Special§Characters` +* `your.exampleProcedure` + +The following examples demonstrate how name-globbing patterns can be used in controlling access to procedures. +Note that the same rules apply to user-defined functions and settings. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1 +---- + +Users with the role `globbing1` can run all the procedures. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2 +---- + +Users with the role `globbing2` can run procedures `mine.public.exampleProcedure` and `mine.private.exampleProcedure`, but no other procedures. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3 +---- + +Users with the role `globbing3` can run procedures `mine.public.exampleProcedure1`, `mine.private.exampleProcedure1`, and `mine.private.exampleProcedure2`, but no other procedures. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4 +---- + +Users with the role `globbing4` can run procedures `your.exampleProcedure`, `mine.public.exampleProcedure`, and `mine.private.exampleProcedure`, but no other procedures. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5 +---- + +Users with the role `globbing5` can run procedures `mine.public.exampleProcedure`, `mine.public.exampleProcedure1` and `mine.public.exampleProcedure42`, but no other procedures. + +[source, cypher, role=noplay] +---- +GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6 +---- + +Users with the role `globbing6` can run procedures `mine.public.with#Special§Characters`, and `mine.private.with#Special§Characters`, but no other procedures. + +[NOTE] +==== +The name-globbing may be fully or partially escaped. +Both `+*+` and `+?+` are interpreted as wildcards in both cases. +==== + diff --git a/modules/ROOT/pages/administration/access-control/index.adoc b/modules/ROOT/pages/administration/access-control/index.adoc new file mode 100644 index 000000000..5506d1f1c --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/index.adoc @@ -0,0 +1,37 @@ +:description: Neo4j role-based access control and fine-grained security. + +[[access-control]] += Access control + +== Overview + +Neo4j has a complex security model stored in the system graph, which is maintained on a special database called the `system` database. +All administrative commands need to be executed against the `system` database. +When connected to the DBMS over link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/connectors[Bolt], administrative commands are automatically routed to the `system` database. +For more information on how to manage multiple databases, refer to the section on xref::administration/databases.adoc[administering databases]. + +_Role-based access control_ was introduced in Neo4j 3.1. +Since then, it has been possible to create users and assign them to roles to control whether users can read, write and administer the database. +In Neo4j 4.0 this model was enhanced significantly with the addition of _privileges_, which are the underlying access-control rules by which the users rights are defined. + +The original built-in roles still exist with almost the exact same access rights, but they are no-longer statically defined (see xref::administration/access-control/built-in-roles.adoc[Built-in roles]). +Instead, they are defined in terms of their underlying _privileges_, and they can be modified by adding or removing these access rights. + +In addition, any newly created roles can be assigned to any combination of _privileges_, so that you may set specific access controls for them. +Another new major capability is the _sub-graph_ access control, through which read access to the graph can be limited to specific combinations of labels, relationship types, and properties. + +== Categories of access control + +More details about specific categories of access control can be found in the following sections: + +* xref:administration/access-control/manage-users.adoc[] +* xref:administration/access-control/manage-roles.adoc[] +* xref:administration/access-control/manage-privileges.adoc[] +* xref:administration/access-control/built-in-roles.adoc[] +* xref:administration/access-control/privileges-reads.adoc[] +* xref:administration/access-control/privileges-writes.adoc[] +* xref:administration/access-control/database-administration.adoc[] +* xref:administration/access-control/dbms-administration.adoc[] +* xref:administration/access-control/limitations.adoc[] +* xref:administration/access-control/privileges-immutable.adoc[] + diff --git a/modules/ROOT/pages/administration/access-control/limitations.adoc b/modules/ROOT/pages/administration/access-control/limitations.adoc new file mode 100644 index 000000000..25d563b31 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/limitations.adoc @@ -0,0 +1,337 @@ +:description: Known limitations and implications of Neo4js role-based access control security. + +//// +[source, cypher, role=test-setup] +---- +CREATE ROLE users; +CREATE ROLE custom; +CREATE ROLE restricted; +CREATE ROLE free; +---- +//// + +[role=enterprise-edition aura-db-enterprise] +[[access-control-limitations]] += Limitations + +[abstract] +-- +This section lists the known limitations and implications of Neo4js role-based access control security. +-- + +[[access-control-limitations-indexes]] +== Security and Indexes + +As described in xref::indexes-for-search-performance.adoc[Indexes for search performance], Neo4j {neo4j-version} supports the creation and use of indexes to improve the performance of Cypher queries. + +Note that the Neo4j security model impacts the results of queries, regardless if the indexes are used or not. +When using non full-text Neo4j indexes, a Cypher query will always return the same results it would have if no index existed. +This means that, if the security model causes fewer results to be returned due to restricted read access in xref::administration/access-control/manage-privileges.adoc[Graph and sub-graph access control], +the index will also return the same fewer results. + +However, this rule is not fully obeyed by xref::indexes-for-full-text-search.adoc[Indexes for full-text search]. +These specific indexes are backed by _Lucene_ internally. +It is therefore not possible to know for certain whether a security violation has affected each specific entry returned from the index. +In face of this, Neo4j will return zero results from full-text indexes in case it is determined that any result might be violating the security privileges active for that query. + +Since full-text indexes are not automatically used by Cypher, they do not lead to the case where the same Cypher query would return different results simply because such an index was created. +Users need to explicitly call procedures to use these indexes. +The problem is only that, if this behavior is not known by the user, they might expect the full-text index to return the same results that a different, but semantically similar, Cypher query does. + +=== Example with denied properties + +Consider the following example. +The database has nodes with labels `:User` and `:Person`, and they have properties `name` and `surname`. +There are indexes on both properties: + +[source, cypher] +---- +CREATE INDEX singleProp FOR (n:User) ON (n.name); +CREATE INDEX composite FOR (n:User) ON (n.name, n.surname); +CREATE FULLTEXT INDEX userNames FOR (n:User|Person) ON EACH [n.name, n.surname]; +---- + +[NOTE] +==== +Full-text indexes support multiple labels. +See xref::indexes-for-full-text-search.adoc[Indexes for full-text search] for more details on creating and using full-text indexes. +==== + +After creating these indexes, it would appear that the latter two indexes accomplish the same thing. +However, this is not completely accurate. +The composite and full-text indexes behave in different ways and are focused on different use cases. +A key difference is that full-text indexes are backed by _Lucene_, and will use the _Lucene_ syntax for querying. + +This has consequences for users restricted on the labels or properties involved in the indexes. +Ideally, if the labels and properties in the index are denied, they can correctly return zero results from both native indexes and full-text indexes. +However, there are borderline cases where this is not as simple. + +Imagine the following nodes were added to the database: + +[source, cypher] +---- +CREATE (:User {name: 'Sandy'}); +CREATE (:User {name: 'Mark', surname: 'Andy'}); +CREATE (:User {name: 'Andy', surname: 'Anderson'}); +CREATE (:User:Person {name: 'Mandy', surname: 'Smith'}); +CREATE (:User:Person {name: 'Joe', surname: 'Andy'}); +---- + +Consider denying the label `:Person`: + +[source, cypher] +---- +DENY TRAVERSE ON GRAPH * NODES Person TO users +---- + +If the user runs a query that uses the native single property index on `name`: + +[source, cypher] +---- +MATCH (n:User) WHERE n.name CONTAINS 'ndy' RETURN n.name +---- + +This query performs several checks: + +* Scans the index to create a stream of results of nodes with the `name` property, which leads to five results. +* Filters the results to include only nodes where `n.name CONTAINS 'ndy'`, filtering out `Mark` and `Joe`, which leads to three results. +* Filters the results to exclude nodes that also have the denied label `:Person`, filtering out `Mandy`, which leads to two results. + +Two results will be returned from this dataset and only one of them has the `surname` property. + +In order to use the native composite index on `name` and `surname`, the query needs to include a predicate on the `surname` property as well: + +[source, cypher] +---- +MATCH (n:User) +WHERE n.name CONTAINS 'ndy' AND n.surname IS NOT NULL +RETURN n.name +---- + +This query performs several checks, which are almost identical to the single property index query: + +* Scans the index to create a stream of results of nodes with the `name` and `surname` property, which leads to four results. +* Filters the results to include only nodes where `n.name CONTAINS 'ndy'`, filtering out `Mark` and `Joe`, which leads to two results. +* Filters the results to exclude nodes that also have the denied label `:Person`, filtering out `Mandy`, which leads to only one result. + +Only one result was returned from the above dataset. +What if this query with the full-text index was used instead: + +[source, cypher] +---- +CALL db.index.fulltext.queryNodes("userNames", "ndy") YIELD node, score +RETURN node.name +---- + +The problem now is that it is not certain whether the results provided by the index were achieved due to a match to the `name` or the `surname` property. +The steps taken by the query engine would be: + +* Run a _Lucene_ query on the full-text index to produce results containing `ndy` in either property, leading to five results. +* Filter the results to exclude nodes that also have the label `:Person`, filtering out `Mandy` and `Joe`, leading to three results. + +This difference in results is caused by the `OR` relationship between the two properties in the index creation. + +=== Denying properties + +Now consider denying access on properties, like the `surname` property: + +[source, cypher] +---- +DENY READ {surname} ON GRAPH * TO users +---- + +For that, run the same queries again: + +[source, cypher] +---- +MATCH (n:User) +WHERE n.name CONTAINS 'ndy' +RETURN n.name +---- + +This query operates exactly as before, returning the same two results, because nothing in it relates to the denied property. + +However, this is not the same for the query targeting the composite index: + +[source, cypher] +---- +MATCH (n:User) +WHERE n.name CONTAINS 'ndy' AND n.surname IS NOT NULL +RETURN n.name +---- + +Since the `surname` property is denied, it will appear to always be `null` and the composite index empty. Therefore, the query returns no result. + +Now consider the full-text index query: + +[source, cypher] +---- +CALL db.index.fulltext.queryNodes("userNames", "ndy") YIELD node, score +RETURN node.name +---- + +The problem remains, since it is not certain whether the results provided by the index were returned due to a match on the `name` or the `surname` property. +Results from the `surname` property now need to be excluded by the security rules, because they require that the user is unable to see any `surname` properties. +However, the security model is not able to introspect the _Lucene_ query in order to know what it will actually do, whether it works only on the allowed `name` property, or also on the disallowed `surname` property. +What is known is that the earlier query returned a match for `Joe Andy` which should now be filtered out. +Therefore, in order to never return results the user should not be able to see, all results need to be blocked. +The steps taken by the query engine would be: + +* Determine if the full-text index includes denied properties. +* If yes, return an empty results stream. +Otherwise, it will process as described before. + +In this case, the query will return zero results rather than simply returning the results `Andy` and `Sandy`, which might have been expected. + + +[[access-control-limitations-labels]] +== Security and labels + +=== Traversing the graph with multi-labeled nodes + +The general influence of access control privileges on graph traversal is described in detail in xref::administration/access-control/manage-privileges.adoc[Graph and sub-graph access control]. +The following section will only focus on nodes due to their ability to have multiple labels. +Relationships can only have one type of label and thus they do not exhibit the behavior this section aims to clarify. +While this section will not mention relationships further, the general function of the traverse privilege also applies to them. + +For any node that is traversable, due to `GRANT TRAVERSE` or `GRANT MATCH`, +the user can get information about the attached labels by calling the built-in `labels()` function. +In the case of nodes with multiple labels, they can be returned to users that weren't directly granted access to. + +To give an illustrative example, imagine a graph with three nodes: one labeled `:A`, another labeled `:B` and one with the labels `:A` and `:B`. +In this case, there is a user with the role `custom` defined by: + +[source, cypher] +---- +GRANT TRAVERSE ON GRAPH * NODES A TO custom +---- + +If that user were to execute + +[source, cypher] +---- +MATCH (n:A) +RETURN n, labels(n) +---- + +They would get a result with two nodes: the node that was labeled with `:A` and the node with labels `:A :B`. + +In contrast, executing + +[source, cypher] +---- +MATCH (n:B) +RETURN n, labels(n) +---- + +This will return only the one node that has both labels: `:A` and `:B`. +Even though `:B` did not have access to traversals, there is one node with that label accessible in the dataset due to the allow-listed label `:A` that is attached to the same node. + +If a user is denied to traverse on a label they will never get results from any node that has this label attached to it. +Thus, the label name will never show up for them. +As an example, this can be done by executing: + +[source, cypher] +---- +DENY TRAVERSE ON GRAPH * NODES B TO custom +---- + +The query + +[source, cypher] +---- +MATCH (n:A) +RETURN n, labels(n) +---- + +will now return the node only labeled with `:A`, while the query + +[source, cypher] +---- +MATCH (n:B) +RETURN n, labels(n) +---- + +will now return no nodes. + +=== The db.labels() procedure + +In contrast to the normal graph traversal described in the previous section, the built-in `db.labels()` procedure is not processing the data graph itself, but the security rules defined on the system graph. +That means: + +* If a label is explicitly whitelisted (granted), it will be returned by this procedure. +* If a label is denied or isn't explicitly allowed, it will not be returned by this procedure. + +Reusing the previous example, imagine a graph with three nodes: one labeled `:A`, another labeled `:B` and one with the labels `:A` and `:B`. +In this case, there is a user with the role `custom` defined by: + +[source, cypher] +---- +GRANT TRAVERSE ON GRAPH * NODES A TO custom +---- + +This means that only label `:A` is explicitly allow-listed. +Thus, executing + +[source, cypher] +---- +CALL db.labels() +---- + +will only return label `:A`, because that is the only label for which traversal was granted. + + +[[access-control-limitations-db-operations]] +== Security and count store operations + +The rules of a security model may impact some of the database operations. +This means extra security checks are necessary to incur additional data accesses, especially in the case of count store operations. +These are, however, usually very fast lookups and the difference might be noticeable. + +See the following security rules that use a `restricted` and a `free` role as an example: + +[source, cypher] +---- +GRANT TRAVERSE ON GRAPH * NODES Person TO restricted; +DENY TRAVERSE ON GRAPH * NODES Customer TO restricted; +GRANT TRAVERSE ON GRAPH * ELEMENTS * TO free; +---- + +Now, let's look at what the database needs to do in order to execute the following query: + +[source, cypher] +---- +MATCH (n:Person) +RETURN count(n) +---- + +For both roles the execution plan will look like this: + +---- ++--------------------------+ +| Operator | ++--------------------------+ +| +ProduceResults | +| | + +| +NodeCountFromCountStore | ++--------------------------+ +---- + +Internally, however, very different operations need to be executed. +The following table illustrates the difference: + +[%header,cols=2*] +|=== +|User with `free` role +|User with `restricted` role + +|The database can access the count store and retrieve the total number of nodes with the label `:Person`. + +This is a very quick operation. + +|The database cannot access the count store because it must make sure that only traversable nodes with the desired label `:Person` are counted. +Due to this, each node with the `:Person` label needs to be accessed and examined to make sure that they do not have a deny-listed label, such as `:Customer`. + +Due to the additional data accesses that the security checks need to do, this operation will be slower compared to executing the query as an unrestricted user. + +|=== diff --git a/modules/ROOT/pages/administration/access-control/manage-privileges.adoc b/modules/ROOT/pages/administration/access-control/manage-privileges.adoc new file mode 100644 index 000000000..238954cc4 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/manage-privileges.adoc @@ -0,0 +1,1436 @@ +:description: This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. +[role=enterprise-edition aura-db-enterprise] +[[access-control-manage-privileges]] + += Managing privileges + +[abstract] +-- +This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. +-- + +Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. +It is possible to grant or deny access, or use a combination of the two. +The user will be able to access the resource if they have a `GRANT` (allowlist) and do not have a `DENY` (denylist) relevant to that resource. +All other combinations of `GRANT` and `DENY` will result in the matching path being inaccessible. +What this means in practice depends on whether we are talking about a xref::administration/access-control/privileges-reads.adoc[read privilege] or a xref::administration/access-control/privileges-writes.adoc[write privilege]: + +* If an entity is not accessible due to xref::administration/access-control/privileges-reads.adoc[read privileges], the data will become invisible. +It will appear to the user as if they had a smaller database (smaller graph). +* If an entity is not accessible due to xref::administration/access-control/privileges-writes.adoc[write privileges], an error will occur on any attempt to write that data. + +[NOTE] +==== +In this document we will often use the terms _'allows'_ and _'enables'_ in seemingly identical ways. However, there is a subtle difference. +We will use _'enables'_ to refer to the consequences of xref::administration/access-control/privileges-reads.adoc[read privileges] where a restriction will not cause an error, only a reduction in the apparent graph size. +We will use _'allows'_ to refer to the consequence of xref::administration/access-control/privileges-writes.adoc[write privileges] where a restriction can result in an error. +==== + +[NOTE] +==== +If a user was not also provided with the database `ACCESS` privilege, then access to the entire database will be denied. +Information about the database access privilege can be found in xref::administration/access-control/database-administration.adoc#access-control-database-administration-access[The ACCESS privilege]. +==== + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[[access-control-graph-privileges]] +== Graph privilege commands (`GRANT`, `DENY` and `REVOKE`) + +Administrators can use Cypher commands to manage Neo4j graph administrative rights. +The components of the graph privilege commands are: + +* _the command_: +** `GRANT` – gives privileges to roles. +** `DENY` – denies privileges to roles. +** `REVOKE` – removes granted or denied privileges from roles. + +* _mutability_: +** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. See also xref:administration/access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. + +* _graph-privilege_: +** Can be either a xref::administration/access-control/privileges-reads.adoc[read privilege] or xref::administration/access-control/privileges-writes.adoc[write privilege]. + +* _name_: +** The graph or graphs to associate the privilege with. +Because in Neo4j {neo4j-version} you can have only one graph per database, this command uses the database name or alias to refer to that graph. +When using an alias, the command will be executed on the resolved graph. ++ +[NOTE] +==== +If you delete a database and create a new one with the same name, the new one will _NOT_ have the privileges previously assigned to the deleted graph. +==== +** It can be `+*+`, which means all graphs. +Graphs created after this command execution will also be associated with these privileges. + +** `HOME GRAPH` refers to the graph associated with the home database for that user. +The default database will be used as home database if a user does not have one configured. +If the user's home database changes for any reason after privileges have been created, then these privileges will be associated with the graph attached to the new database. +This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user's home database. + +* _entity_ +** The graph elements this privilege applies to: +*** `NODES` label (nodes with the specified label(s)). +*** `RELATIONSHIPS` type (relationships of the specific type(s)). +*** `ELEMENTS` label (both nodes and relationships). +** The label or type can be referred with `+*+`, which means all labels or types. +** Multiple labels or types can be specified, comma-separated. +** Defaults to `ELEMENTS` `+*+` if omitted. +** Some of the commands for write privileges do not allow an _entity_ part. +See xref::administration/access-control/privileges-writes.adoc[Write privileges] for details. +* _role[, ...]_ +** The role or roles to associate the privilege with, comma-separated. + +.General grant +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] +---- + +| Description +a| Grants a privilege to one or multiple roles. + +|=== + +.General deny +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +DENY ... ON ... TO ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +DENY [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] +---- + +| Description +a| Denies a privilege to one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE GRANT ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] GRANT graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] +---- +| Description +a| Revokes a granted privilege from one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE DENY ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] DENY graph-privilege ON { HOME GRAPH \| GRAPH[S] {* \| name[, ...] } } [entity] FROM role[, ...] +---- + +| Description +a| Revokes a denied privilege from one or multiple roles. + +|=== + +.General revoke +ON GRAPH+ privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +REVOKE ... ON ... FROM ...+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +REVOKE [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] +---- + +| Description +| Revokes a granted or denied privilege from one or multiple roles. +|=== + +[NOTE] +==== +`DENY` does NOT erase a granted privilege; they both exist. +Use `REVOKE` if you want to remove a privilege. +==== + +The general `GRANT` and `DENY` syntaxes are illustrated in the following image: + +image::privileges_grant_and_deny_syntax.svg[title="GRANT and DENY Syntax"] + +A more detailed syntax illustration for graph privileges would be the following: + +image::privileges_on_graph_syntax.svg[title="Syntax of GRANT and DENY Graph Privileges. The `{` and `}` are part of the syntax and not used for grouping."] + +The following image shows the hierarchy between different graph privileges: + +image::privileges_hierarchy.svg[title="Graph privileges hierarchy"] + +[[access-control-list-privileges]] +== Listing privileges + +Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. + +.Show privileges command syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- +| Description +| List all privileges. + +|=== + +.Show role privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW ROLE ... PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +| Lists privileges for a specific role. + +|=== + +.Show user privileges syntax +[cols="<15s,<85"] +|=== + +| Command +m| +SHOW USER ... PRIVILEGE+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +| Lists privileges for a specific user, or the current user. + +[NOTE] +==== +Please note that it is only possible for a user to show their own privileges. +Therefore, if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work in a limited capacity. + +Other users' privileges cannot be listed when using a non-native auth provider. +==== +|=== + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For an easy overview of the existing privileges, it is recommended to use the `AS COMMANDS` version of the `SHOW` command. +This returns the column `command` of type `STRING` containing the privileges as the commands that are granted or denied. + +When omitting the `AS COMMANDS` clause, results will include multiple columns describing privileges: + +[options="header", width="100%", cols="4m,6a,2m"] +|=== +| Column | Description | Type + +| access +| Whether the privilege is granted or denied. +| STRING + +| action +| The type of the privilege. +E.g., traverse, read, index management, or role management. +| STRING + +| resource +| The scope of the privilege. +E.g., the entire DBMS, a specific database, a graph, or sub-graph access. +| STRING + +| graph +| The specific database or graph the privilege applies to. +| STRING + +| segment +| The labels, relationship types, procedures, functions, transactions or settings the privilege applies to (if applicable). +| STRING + +| role +| The role the privilege is granted to. +| STRING + +| immutable +| Whether or not the privilege is immutable. + +This column is also available for the `AS COMMAND` variant using `YIELD`. +| BOOLEAN + +| user +| The user the privilege belongs to. + +Note that this is only returned for `SHOW USER [username] PRIVILEGES`. +| STRING + +|=== + +[[access-control-list-all-privileges]] +=== Examples for listing all privileges + +Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. + +[source, syntax] +---- +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES +---- + +Lists all privileges for all roles: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|segment +|role +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"admin" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"admin" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"admin" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"admin" +|false + +|"GRANTED" +|"transaction_management" +|"database" +|"*" +|"USER(*)" +|"admin" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"constraint" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"dbms_actions" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"index" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"start_database" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"stop_database" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"admin" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"architect" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"architect" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"architect" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"architect" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"constraint" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"index" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"architect" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"editor" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"editor" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"editor" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"editor" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"editor" +|false + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"publisher" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"NODE(*)" +|"publisher" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"publisher" +|false + +|"GRANTED" +|"write" +|"graph" +|"*" +|"RELATIONSHIP(*)" +|"publisher" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"publisher" +|false + +|"GRANTED" +|"token" +|"database" +|"*" +|"database" +|"publisher" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"NODE(*)" +|"reader" +|false + +|"GRANTED" +|"match" +|"all_properties" +|"*" +|"RELATIONSHIP(*)" +|"reader" +|false + +|"GRANTED" +|"access" +|"database" +|"*" +|"database" +|"reader" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 39 +|=== + +It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD role, access, action, segment +ORDER BY action +WHERE role = 'admin' +---- + +In this example: + +* The number of columns returned has been reduced with the `YIELD` clause. +* The order of the returned columns has been changed. +* The results have been filtered to only return the `admin` role using a `WHERE` clause. +* The results are ordered by the `action` column using `ORDER BY`. + +`SKIP` and `LIMIT` can also be used to paginate the results. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m"] +|=== +|role +|access +|action +|segment + +|"admin" +|"GRANTED" +|"access" +|"database" + +|"admin" +|"GRANTED" +|"constraint" +|"database" + +|"admin" +|"GRANTED" +|"dbms_actions" +|"database" + +|"admin" +|"GRANTED" +|"index" +|"database" + +|"admin" +|"GRANTED" +|"match" +|"NODE(*)" + +|"admin" +|"GRANTED" +|"match" +|"RELATIONSHIP(*)" + +|"admin" +|"GRANTED" +|"start_database" +|"database" + +|"admin" +|"GRANTED" +|"stop_database" +|"database" + +|"admin" +|"GRANTED" +|"token" +|"database" + +|"admin" +|"GRANTED" +|"transaction_management" +|"USER(*)" + +|"admin" +|"GRANTED" +|"write" +|"NODE(*)" + +|"admin" +|"GRANTED" +|"write" +|"RELATIONSHIP(*)" + +4+a|Rows: 12 +|=== + +`WHERE` can also be used without `YIELD`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES +WHERE graph <> '*' +---- + +In this example, the `WHERE` clause is used to filter privileges down to those that target specific graphs only. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment + +|"GRANTED" +|"access" +|"DEFAULT" +|"database" +|"PUBLIC" +|"database" + +|"DENIED" +|"access" +|"neo4j" +|"database" +|"noAccessUsers" +|"database" + +|"GRANTED" +|"access" +|"neo4j" +|"database" +|"regularUsers" +|"database" + +6+a|Rows: 3 +|=== + +Aggregations in the `RETURN` clause can be used to group privileges. +In this case, by user and `GRANTED` or `DENIED`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) AS privileges +---- + +.Result +[options="header,footer", width="100%", cols="1m,1m,3m"] +|=== +|role +|access +|privileges + +|"PUBLIC" +|"GRANTED" +|[["\*","database","FUNCTION(*)","execute"],["\*","database","PROCEDURE(*)","execute"],["DEFAULT","database","database","access"]] + +|"admin" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","USER(*)","transaction_management"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","dbms_actions"],["*","database","database","index"],["\*","database","database","start_database"],["*","database","database","stop_database"],["*","database","database","token"]] + +|"architect" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","index"],["*","database","database","token"]] + +|"editor" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"]] + +|"noAccessUsers" +|"DENIED" +|[["neo4j","database","database","access"]] + +|"publisher" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","token"]] + +|"reader" +|"GRANTED" +|[["\*","all_properties","NODE(*)","match"],["\*","all_properties","RELATIONSHIP(*)","match"],["*","database","database","access"]] + +|"regularUsers" +|"GRANTED" +|[["neo4j","database","database","access"]] + +3+a|Rows: 8 +|=== + +The `RETURN` clause can also be used to order and paginate the results, which is useful when combined with `YIELD` and `WHERE`. +In this example the query returns privileges for display five-per-page, and skips the first five to display the second page. + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5 +---- + +.Result +[options="header,footer", width="100%", cols="2m,2m,1m,2m,1m,2m,1m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"match" +|"*" +|"all_properties" +|"admin" +|"RELATIONSHIP(*)" +|false + +|"GRANTED" +|"write" +|"*" +|"graph" +|"admin" +|"RELATIONSHIP(*)" +|false + +|"GRANTED" +|"transaction_management" +|"*" +|"database" +|"admin" +|"USER(*)" +|false + +|"GRANTED" +|"access" +|"*" +|"database" +|"admin" +|"database" +|false + +|"GRANTED" +|"constraint" +|"*" +|"database" +|"admin" +|"database" +|false + +6+a|Rows: 5 +|=== + +Available privileges can also be displayed as Cypher commands by adding `AS COMMAND[S]`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" +|"GRANT ACCESS ON DATABASE * TO `admin`" +|"GRANT ACCESS ON DATABASE * TO `architect`" +|"GRANT ACCESS ON DATABASE * TO `editor`" +|"GRANT ACCESS ON DATABASE * TO `publisher`" +|"GRANT ACCESS ON DATABASE * TO `reader`" +|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" +|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" +|"GRANT START ON DATABASE * TO `admin`" +|"GRANT STOP ON DATABASE * TO `admin`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `architect`" +|"GRANT WRITE ON GRAPH * TO `editor`" +|"GRANT WRITE ON GRAPH * TO `publisher`" +a|Rows: 35 +|=== + +Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS COMMANDS +WHERE command CONTAINS 'MANAGEMENT' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +a|Rows: 8 +|=== + +It is also possible to get the privileges listed as revoking commands instead of granting or denying: + +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES AS REVOKE COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE DENY ACCESS ON DATABASE `neo4j` FROM `noAccessUsers`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `admin`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `architect`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `editor`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`" +|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" +|"REVOKE GRANT ACCESS ON DATABASE `neo4j` FROM `regularUsers`" +|"REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`" +|"REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`" +|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM `PUBLIC`" +|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`" +|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`" +|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`" +|"REVOKE GRANT START ON DATABASE * FROM `admin`" +|"REVOKE GRANT STOP ON DATABASE * FROM `admin`" +|"REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `admin`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `architect`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `editor`" +|"REVOKE GRANT WRITE ON GRAPH * FROM `publisher`" +a|Rows: 35 +|=== + +For more info about revoking privileges, please see xref::administration/access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. + +[[access-control-list-privileges-role]] +=== Examples for listing privileges for specific roles + +Available privileges for specific roles can be displayed using `SHOW ROLE name PRIVILEGE[S]`: + +[source, syntax] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW ROLE regularUsers PRIVILEGES +---- + +Lists all privileges for role `regularUsers`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 1 +|=== + +[source, cypher, role=noplay] +---- +SHOW ROLES regularUsers, noAccessUsers PRIVILEGES +---- + +Lists all privileges for roles `regularUsers` and `noAccessUsers`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] +|=== +|access +|action +|graph +|resource +|role +|segment +|immutable + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|false + +6+a|Rows: 2 +|=== + +Similar to the other `SHOW PRIVILEGES` commands, the available privileges for roles can also be listed as Cypher commands with the optional `AS COMMAND[S]`. + +[source, cypher, role=noplay] +---- +SHOW ROLES regularUsers, noAccessUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE * TO `admin`" +|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" +|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" +|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" +|"GRANT START ON DATABASE * TO `admin`" +|"GRANT STOP ON DATABASE * TO `admin`" +|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" +|"GRANT WRITE ON GRAPH * TO `admin`" +a|Rows: 11 +|=== + +The output can be processed using `YIELD` / `WHERE` / `RETURN` here as well: + +[source, cypher, role=noplay] +---- +SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" +|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" +|Rows: 2 +|=== + +Again, it is possible to get the privileges listed as revoking commands instead of granting or denying. +For more info about revoking privileges, please see xref::administration/access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. + +[source, cypher, role=noplay] +---- +SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" +|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" +a|Rows: 3 +|=== + +[[access-control-list-privileges-user]] +=== Examples for listing privileges for specific users + +Available privileges for specific users can be displayed using `SHOW USER name PRIVILEGES`. + +[NOTE] +==== +Note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity as it is only possible for a user to show their own privileges. +Other users' privileges cannot be listed when using a non-native auth provider. +==== + +[source, syntax] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [WHERE expression] + +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES +---- + +Lists all privileges for user `jake`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|"jake" +|false + +7+a|Rows: 4 +|=== + +[source, cypher, role=noplay] +---- +SHOW USERS jake, joe PRIVILEGES +---- + +Lists all privileges for users `jake` and `joe`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] +|=== +|access +|action +|resource +|graph +|resource +|role +|segment +|immutable + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"jake" +|false + +|"GRANTED" +|"access" +|"database" +|"neo4j" +|"database" +|"regularUsers" +|"jake" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"FUNCTION(*)" +|"PUBLIC" +|"joe" +|false + +|"GRANTED" +|"execute" +|"database" +|"*" +|"PROCEDURE(*)" +|"PUBLIC" +|"joe" +|false + +|"GRANTED" +|"access" +|"database" +|"DEFAULT" +|"database" +|"PUBLIC" +|"joe" +|false + +|"DENIED" +|"access" +|"database" +|"neo4j" +|"database" +|"noAccessUsers" +|"joe" +|false + +7+a|Rows: 8 +|=== + +The same command can be used at all times to review available privileges for the current user. +For this purpose, there is a shorter form of the command: `SHOW USER PRIVILEGES`: + +[source, cypher, role=noplay] +---- +SHOW USER PRIVILEGES +---- + +As for the other privilege commands, available privileges for users can also be listed as Cypher commands with the optional `AS COMMAND[S]`. + +[NOTE] +==== +When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. +This can be used to quickly create new roles based on the privileges of specific users. +==== + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"GRANT ACCESS ON DATABASE `neo4j` TO $role" +|"GRANT ACCESS ON HOME DATABASE TO $role" +|"GRANT EXECUTE FUNCTION * ON DBMS TO $role" +|"GRANT EXECUTE PROCEDURE * ON DBMS TO $role" +a|Rows: 4 +|=== + +Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`. +Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges. + +[source, cypher, role=noplay] +---- +SHOW USER jake PRIVILEGES AS REVOKE COMMANDS +WHERE command CONTAINS 'EXECUTE' +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM $role" +|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role" +a|Rows: 2 +|=== + +[[access-control-revoke-privileges]] +== Revoking privileges + +Privileges that were granted or denied earlier can be revoked using the `REVOKE` command: + +[source, syntax] +---- +REVOKE + [ IMMUTABLE ] + [ GRANT | DENY ] graph-privilege + FROM role[, ...] +---- + +An example usage of the `REVOKE` command is given here: + +[source, cypher, role=noplay] +---- +REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers +---- + +While it can be explicitly specified that `REVOKE` should remove a `GRANT` or `DENY`, it is also possible to `REVOKE` both by not specifying them at all, as the next example demonstrates. +Because of this, if there happens to be a `GRANT` and a `DENY` for the same privilege, it would remove both. + +[source, cypher, role=noplay] +---- +REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers +---- + +Adding `IMMUTABLE` explicitly specifies that only immutable privileges should be removed. Omitting it specifies that both immutable and regular privileges should be removed. diff --git a/modules/ROOT/pages/administration/access-control/manage-roles.adoc b/modules/ROOT/pages/administration/access-control/manage-roles.adoc new file mode 100644 index 000000000..16b1afd87 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/manage-roles.adoc @@ -0,0 +1,816 @@ +:description: This section explains how to use Cypher to manage roles in Neo4j. + +[role=enterprise-edition aura-db-enterprise] +[[access-control-manage-roles]] += Managing roles + +//// +[source, cypher, role=test-setup] +---- +CREATE USER bob SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user1 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user2 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE USER user3 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; +CREATE ROLE myrole IF NOT EXISTS; +CREATE ROLE role1 IF NOT EXISTS; +CREATE ROLE role2 IF NOT EXISTS; +---- +//// + +[abstract] +-- +This section explains how to use Cypher to manage roles in Neo4j. +-- + +Roles can be created and managed using a set of Cypher administration commands executed against the `system` database. + +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[access-control-role-syntax]] +== Role management command syntax + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW [ALL\|POPULATED] ROLE[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists roles. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW ROLE +---- + + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]). +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLES WITH USERS + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW [ALL\|POPULATED] ROLE[S] WITH USER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists roles and users assigned to them. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + + +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW ROLE PRIVILEGES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the privileges granted to the specified roles. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW PRIVILEGE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + + +| Command +m| CREATE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] +---- + +| Description +a| +Creates a new role. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| CREATE OR REPLACE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE ROLE name [AS COPY OF otherName] +---- + +| Description +a| +Creates a new role, or if a role with the same name exists, replace it. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE ROLE +---- + +[source, privilege, role="noheader"] +---- +GRANT DROP ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| RENAME ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +RENAME ROLE name [IF EXISTS] TO otherName +---- + +| Description +a| +Changes the name of a role. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-rename-roles[Renaming roles]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT RENAME ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| DROP ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +DROP ROLE name [IF EXISTS] +---- + +| Description +a| +Removes a role. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-drop-roles[Deleting roles]. + +| Required privilege +[source, privilege, role="noheader"] +---- +GRANT DROP ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| GRANT ROLE TO + +| Syntax +a| +[source, syntax, role="noheader"] +---- +GRANT ROLE[S] name[, ...] TO user[, ...] +---- + +| Description +a| +Assigns roles to users. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-assign-roles[Assigning roles to users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT ASSIGN ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| REVOKE ROLE + +| Syntax +a| +[source, syntax, role="noheader"] +---- +REVOKE ROLE[S] name[, ...] FROM user[, ...] +---- + +| Description +a| +Removes roles from users. + +For more information, see xref::administration/access-control/manage-roles.adoc#access-control-revoke-roles[Revoking roles from users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT REMOVE ROLE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) + +|=== + + +[[access-control-list-roles]] +== Listing roles + + +Available roles can be seen using `SHOW ROLES`. +This returns a single column `role` of type `STRING`, containing the role name. + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +This is the same command as `SHOW ALL ROLES`. + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"publisher" +|"reader" + +1+a|Rows: 6 +|=== + +When first starting a Neo4j DBMS, there are a number of built-in roles: + +* `PUBLIC` - a role that all users have granted. +By default it gives access to the home database and to execute privileges for procedures and functions. +* `reader` - can perform traverse and read operations in all databases except `system`. +* `editor` - can perform traverse, read, and write operations in all databases except `system`, but cannot create new labels or relationship types. +* `publisher` - can do the same as `editor`, but also create new labels and relationship types. +* `architect` - can do the same as `publisher` as well as create and manage indexes and constraints. +* `admin` - can do the same as all the above, as well as manage databases, aliases, users, roles, and privileges. + +More information about the built-in roles can be found in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/built-in-roles[Operations Manual -> Built-in roles] + +There are multiple versions of this command, the default being `SHOW ALL ROLES`. +To only show roles that are assigned to users, the command is `SHOW POPULATED ROLES`. +To see which users are assigned to which roles, `WITH USERS` can be added to the command. +This will return an additional `STRING` column, `member`, containing the username. +Since this gives a result with one row for each user, if a role is assigned to two users it will show up twice. + +[source, cypher, role=noplay] +---- +SHOW POPULATED ROLES WITH USERS +---- + +The table of results will show information about the role and what database it belongs to: + +.Result +[options="header,footer", width="100%", cols="m,m"] +|=== +|role +|member + +|"PUBLIC" +|"neo4j" + +|"PUBLIC" +|"bob" + +|"PUBLIC" +|"user1" + +|"PUBLIC" +|"user2" + +|"PUBLIC" +|"user3" + +|"admin" +|"neo4j" + +2+a|Rows: 6 +|=== + +It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: + +[source, cypher, role=noplay] +---- +SHOW ROLES YIELD role +ORDER BY role +WHERE role ENDS WITH 'r' +---- + +In this example: + +* The results have been filtered to only return the roles ending in 'r'. +* The results are ordered by the `action` column using `ORDER BY`. + +It is also possible to use `SKIP` and `LIMIT` to paginate the results. + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"editor" +|"publisher" +|"reader" + +1+a|Rows: 3 +|=== + +[NOTE] +==== +The `SHOW ROLE name PRIVILEGES` command is found in xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. +==== + + +[[access-control-create-roles]] +== Creating roles + +Roles can be created using `CREATE ROLE`: + +[source, syntax] +---- +CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] +---- + +Roles can be created or replaced by using `CREATE OR REPLACE ROLE`: + +[source, syntax] +---- +CREATE OR REPLACE ROLE name [AS COPY OF otherName] +---- + +[NOTE] +==== +The following naming rules apply: + +* The first character must be an ASCII alphabetic character. +* Subsequent characters can be ASCII alphabetic, numeric characters, and underscore. +* Role names are case sensitive. +==== + +A role can be copied, keeping its privileges, using `CREATE ROLE name AS COPY OF otherName`. + +.Copy a role +====== +[source, cypher, role=noplay] +---- +CREATE ROLE mysecondrole AS COPY OF myrole +---- +====== + +Created roles will appear on the list provided by `SHOW ROLES`. + +.List roles +====== +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"mysecondrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== +====== + +The `CREATE ROLE` command is optionally idempotent, with the default behavior to throw an exception if the role already exists. +Adding `IF NOT EXISTS` to the `CREATE ROLE` command will ensure that no exception is thrown and nothing happens should the role already exist. + +.Create role if not exists +====== + +[source, cypher, role=noplay] +---- +CREATE ROLE myrole IF NOT EXISTS +---- + +====== + + +The `CREATE OR REPLACE ROLE` command will result in any existing role being deleted and a new one created. + + +.Create or replace role +====== + +[source, cypher, role=noplay] +---- +CREATE OR REPLACE ROLE myrole +---- + +This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE ROLE myrole`. + +====== + + +[NOTE] +==== +* The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. +==== + + +[[access-control-rename-roles]] +== Renaming roles + +Roles can be renamed using `RENAME ROLE` command: + +[source, cypher, role=noplay] +---- +RENAME ROLE mysecondrole TO mythirdrole +---- + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"mythirdrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== + +[NOTE] +==== +The `RENAME ROLE` command is only available when using native authentication and authorization. +==== + + +[[access-control-assign-roles]] +== Assigning roles to users + +Users can be given access rights by assigning them roles using `GRANT ROLE`: + +[source, cypher, role=noplay] +---- +GRANT ROLE myrole TO bob +---- + +The roles assigned to each user can be seen on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["myrole","PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["PUBLIC"] +|true +|false +| + +|"user2" +|["PUBLIC"] +|true +|false +| + +|"user3" +|["PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + +It is possible to assign multiple roles to multiple users in one command: + +[source, cypher, role=noplay] +---- +GRANT ROLES role1, role2 TO user1, user2, user3 +---- + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["myrole","PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user2" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user3" +|["role1","role2","PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + + +[[access-control-revoke-roles]] +== Revoking roles from users + +Users can lose access rights by revoking their role using `REVOKE ROLE`: + +[source, cypher, role=noplay] +---- +REVOKE ROLE myrole FROM bob +---- + +The roles revoked from users can no longer be seen on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"bob" +|["PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +|"user1" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user2" +|["role1","role2","PUBLIC"] +|true +|false +| + +|"user3" +|["role1","role2","PUBLIC"] +|true +|false +| + +5+a|Rows: 5 +|=== + +It is possible to revoke multiple roles from multiple users in one command: + +[source, cypher, role=noplay] +---- +REVOKE ROLES role1, role2 FROM user1, user2, user3 +---- + + +[[access-control-drop-roles]] +== Deleting roles + +Roles can be deleted using `DROP ROLE` command: + +[source, cypher, role=noplay] +---- +DROP ROLE mythirdrole +---- + +When a role has been deleted, it will no longer appear on the list provided by `SHOW ROLES`: + +[source, cypher, role=noplay] +---- +SHOW ROLES +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|role + +|"PUBLIC" +|"admin" +|"architect" +|"editor" +|"myrole" +|"publisher" +|"reader" + +1+a|Rows: 8 +|=== + +This command is optionally idempotent, with the default behavior to throw an exception if the role does not exist. +Adding `IF EXISTS` to the command will ensure that no exception is thrown and nothing happens should the role not exist: + +[source, cypher, role=noplay] +---- +DROP ROLE mythirdrole IF EXISTS +---- diff --git a/modules/ROOT/pages/administration/access-control/manage-users.adoc b/modules/ROOT/pages/administration/access-control/manage-users.adoc new file mode 100644 index 000000000..3e1d7bba8 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/manage-users.adoc @@ -0,0 +1,864 @@ +:description: This section explains how to use Cypher to manage users in Neo4j. + +[[access-control-manage-users]] += Managing users + +[abstract] +-- +This section explains how to use Cypher to manage users in Neo4j. +-- + +Users can be created and managed using a set of Cypher administration commands executed against the `system` database. +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[access-control-user-syntax]] +== User management command syntax + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW CURRENT USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW CURRENT USER + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the current user. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-current-users[Listing current user]. + +| Required privilege +a| None + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| SHOW USERS + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW USER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists all users. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-list-users[Listing users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== +| Command +m| SHOW USER PRIVILEGES + +| Syntax +a| +[source, syntax, role="noheader"] +---- +SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| +Lists the privileges granted to the specified users or the current user if no user is specified. + +When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. + +For more information, see xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SHOW PRIVILEGE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) + +[source, privilege, role="noheader"] +---- +GRANT SHOW USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) +|=== + + +[cols="<15s,<85"] +|=== +| Command +m| CREATE USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE USER name [IF NOT EXISTS] + SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED}] + [SET HOME DATABASE name] +---- + +| Description +a| +Creates a new user. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-create-users[Creating users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| CREATE OR REPLACE USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE USER name + SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED}] + [SET HOME DATABASE name] +---- + +| Description +a| +Creates a new user, or if a user with the same name exists, replace it. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-create-users[Creating users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT CREATE USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + + +[source, privilege, role="noheader"] +---- +GRANT DROP USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| RENAME USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +RENAME USER name [IF EXISTS] TO otherName +---- + +| Description +a| +Changes the name of a user. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-rename-users[Renaming users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT RENAME USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + +[cols="<15s,<85"] +|=== +| Command +m| ALTER USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +ALTER USER name [IF EXISTS] + [SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password'] + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE \| SUSPENDED} ] + [SET HOME DATABASE name] + [REMOVE HOME DATABASE] +---- + +| Description +a| +Modifies the settings for an existing user. +At least one `SET` or `REMOVE` clause is required. +`SET` and `REMOVE` clauses cannot be combined in the same command. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-alter-users[Modifying users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT SET PASSWORD +---- + +[source, privilege, role="noheader" +---- +GRANT SET USER STATUS +---- + +[source, privilege, role="noheader"] +---- +GRANT SET USER HOME DATABASE +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| ALTER CURRENT USER SET PASSWORD + +| Syntax +a| +[source, syntax, role="noheader"] +---- +ALTER CURRENT USER SET PASSWORD FROM 'oldPassword' TO 'newPassword' +---- + +| Description +a| +Changes the current user's password. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-alter-password[Changing the current user's password]. + +| Required privilege +a| None + +|=== + + +[cols="<15s,<85"] +|=== + +| Command +m| DROP USER + +| Syntax +a| +[source, syntax, role="noheader"] +---- +DROP USER name [IF EXISTS] +---- + +| Description +a| +Removes an existing user. + +For more information, see xref::administration/access-control/manage-users.adoc#access-control-drop-users[Delete users]. + +| Required privilege +a| +[source, privilege, role="noheader"] +---- +GRANT DROP USER +---- + +(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) + +|=== + + +[NOTE] +==== +The `SHOW USER[S] PRIVILEGES` command is only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + + +[[access-control-current-users]] +== Listing current user + +The currently logged-in user can be seen using `SHOW CURRENT USER`, which will produce a table with the following columns: + +[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] +|=== +| Column +| Description +| Type +| Community Edition +| Enterprise Edition + +| user +| User name +| STRING +| {check-mark} +| {check-mark} + +| roles +| Roles granted to the user. + +Will return `null` in community edition. +| LIST OF STRING +| {cross-mark} +| {check-mark} + +| passwordChangeRequired +| If `true`, the user must change their password at the next login. +| BOOLEAN +| {check-mark} +| {check-mark} + +| suspended +| If `true`, the user is currently suspended (cannot log in). + +Will return `null` in community edition. +| BOOLEAN +| {cross-mark} +| {check-mark} + +| home +| The home database configured by the user, or `null` if no home database has been configured. +If this database is unavailable and the user does not specify a database to use, they will not be able to log in. + +Will return `null` in community edition. +| STRING +| {cross-mark} +| {check-mark} +|=== + +[source, cypher, role=noplay] +---- +SHOW CURRENT USER +---- + +.Result +[options="header,footer", width="100%", cols="2m,2m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"jake" +|["PUBLIC"] +|false +|false +| + +5+a|Rows: 1 +|=== + +[NOTE] +==== +This command is only supported for a logged-in user and will return an empty result if authorization has been disabled. +==== + + +[[access-control-list-users]] +== Listing users + +Available users can be seen using `SHOW USERS`, which will produce a table of users with the following columns: + +[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] +|=== +| Column +| Description +| Type +| Community Edition +| Enterprise Edition + +| user +| User name +| STRING +| {check-mark} +| {check-mark} + +| roles +| Roles granted to the user. + +Will return `null` in community edition. +| LIST OF STRING +| {cross-mark} +| {check-mark} + +| passwordChangeRequired +| If `true`, the user must change their password at the next login. +| BOOLEAN +| {check-mark} +| {check-mark} + +| suspended +| If `true`, the user is currently suspended (cannot log in). + +Will return `null` in community edition. +| BOOLEAN +| {cross-mark} +| {check-mark} + +| home +| The home database configured by the user, or `null` if no home database has been configured. +A home database will be resolved if it is either pointing to a database or a database alias. +If this database is unavailable and the user does not specify a database to use, they will not be able to log in. + +Will return `null` in community edition. +| STRING +| {cross-mark} +| {check-mark} +|=== + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[role="queryresult" options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user +|roles +|passwordChangeRequired +|suspended +|home + +|"neo4j" +|["admin","PUBLIC"] +|false +|false +| + +5+a|Rows: 1 +|=== + +When first starting a Neo4j DBMS, there is always a single default user `neo4j` with administrative privileges. +It is possible to set the initial password using link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/set-initial-password[`neo4j-admin dbms set-initial-password `], otherwise it is necessary to change the password after the first login. + +.Show user +====== +This example shows how to: + +* Reorder the columns using a `YIELD` clause. +* Filter the results using a `WHERE` clause. + +[source, cypher, role=noplay] +---- +SHOW USER YIELD user, suspended, passwordChangeRequired, roles, home +WHERE user = 'jake' +---- +====== + +.Show user +====== +It is possible to add a `RETURN` clause to further manipulate the results after filtering. +In this example, the `RETURN` clause is used to filter out the `roles` column and rename the `user` column to `adminUser`. + +[source,cypher,role=noplay] +---- +SHOW USERS YIELD roles, user +WHERE 'admin' IN roles +RETURN user AS adminUser +---- +====== + +[NOTE] +==== +The `SHOW USER name PRIVILEGES` command is described in xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. +==== + + +[[access-control-create-users]] +== Creating users + +Users can be created using `CREATE USER`. + +[source, syntax, role="noheader"] +---- +CREATE USER name [IF NOT EXISTS] + SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] +---- + +Users can be created or replaced using `CREATE OR REPLACE USER`. + +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE USER name + SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] +---- + +* For `SET PASSWORD`: +** The `password` can either be a string value or a string parameter. +** The default Neo4j password length is at least 8 characters. +** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. +`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. +Consequently, it is never possible to get the plaintext of a password back out of the database. +A password can be set in either fashion at any time. +** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. +** The optional `ENCRYPTED` is used to recreate an existing user when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + +With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: +*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. +*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. +* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. +The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. +* The default for `SET STATUS` is `ACTIVE`. +* `SET HOME DATABASE` can be used to configure a home database for a user. +A home database will be resolved if it is either pointing to a database or a database alias. +If no home database is set, the DBMS default database is used as the home database for the user. +* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. + +[NOTE] +==== +User names are case sensitive. +The created user will appear on the list provided by `SHOW USERS`. + +* In Neo4j Community Edition there are no roles, but all users have implied administrator privileges. +* In Neo4j Enterprise Edition all users are automatically assigned the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-public[`PUBLIC` role], giving them a base set of privileges. +==== + + +.Create user +====== +For example, you can create the user `jake` in a suspended state, with the home database `anotherDb`, and the requirement to change the password by using the command: + +[source,cypher,role=noplay] +---- +CREATE USER jake +SET PASSWORD 'abcd1234' CHANGE REQUIRED +SET STATUS SUSPENDED +SET HOME DATABASE anotherDb +---- + +====== + + +.Create user +====== +Or you can create the user `Jake` in an active state, with an encrypted password (taken from the _data/scripts/databasename/restore_metadata.cypher_ of a database backup), and the requirement to not change the password by running: + +[source,cypher,role=noplay] +---- +CREATE USER Jake +SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff2a55c5b825,190ae47c661e0668a0c8be8a21ff78a4a34cdf918cae3c407e907b73932bd16c' CHANGE NOT REQUIRED +SET STATUS ACTIVE +---- + +====== + +[NOTE] +==== +The `SET STATUS {ACTIVE | SUSPENDED}` and `SET HOME DATABASE` parts of the commands are only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + +The `CREATE USER` command is optionally idempotent, with the default behavior to throw an exception if the user already exists. +Appending `IF NOT EXISTS` to the `CREATE USER` command will ensure that no exception is thrown and nothing happens should the user already exist. + + +.Create user if not exists +====== +[source,cypher,role=noplay] +---- +CREATE USER jake IF NOT EXISTS +SET PLAINTEXT PASSWORD 'abcd1234' +---- + +====== + +The `CREATE OR REPLACE USER` command will result in any existing user being deleted and a new one created. + + +.Create or replace user +====== +[source,cypher,role=noplay] +---- +CREATE OR REPLACE USER jake +SET PLAINTEXT PASSWORD 'abcd1234' +---- + +This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`. + +====== + +[NOTE] +==== +The `CREATE OR REPLACE USER` command does not allow the use of `IF NOT EXISTS`. +==== + + +[[access-control-rename-users]] +== Renaming users + +Users can be renamed with the `RENAME USER` command. + +[source, cypher, role=noplay] +---- +RENAME USER jake TO bob +---- + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"bob" +|["PUBLIC"] +|true +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 2 + +|=== + +[NOTE] +==== +The `RENAME USER` command is only available when using native authentication and authorization. +==== + + +[[access-control-alter-users]] +== Modifying users + +Users can be modified with `ALTER USER`. + +[source, syntax, role="noheader"] +---- +ALTER USER name [IF EXISTS] + [SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password'] + [[SET PASSWORD] CHANGE [NOT] REQUIRED] + [SET STATUS {ACTIVE | SUSPENDED}] + [SET HOME DATABASE name] + [REMOVE HOME DATABASE name] +---- + +* At least one `SET` or `REMOVE` clause is required for the command. +* `SET` and `REMOVE` clauses cannot be combined in the same command. +* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. +The `SET PASSWORD` clause must come first, if used. +* For `SET PASSWORD`: +** The `password` can either be a string value or a string parameter. +** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. +`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. +Consequently, it is never possible to get the plaintext of a password back out of the database. +A password can be set in either fashion at any time. +** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. +** The optional `ENCRYPTED` is used to update an existing user's password when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + +With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: +*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. +*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. +* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. +The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. +* For `SET PASSWORD CHANGE [NOT] REQUIRED`, the `SET PASSWORD` is only optional if it directly follows the `SET PASSWORD` clause. +* `SET HOME DATABASE` can be used to configure a home database for a user. +A home database will be resolved if it is either pointing to a database or a database alias. +If no home database is set, the DBMS default database is used as the home database for the user. +* `REMOVE HOME DATABASE` is used to unset the home database for a user. +This results in the DBMS default database being used as the home database for the user. + +For example, you can modify the user `bob` with a new password and active status, and remove the requirement to change his password: + +[source, cypher, role=noplay] +---- +ALTER USER bob +SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED +SET STATUS ACTIVE +---- + +Or you may decide to assign the user `bob` a different home database: + +[source, cypher, role=noplay] +---- +ALTER USER bob +SET HOME DATABASE anotherDbOrAlias +---- + +Or remove the home database from the user `bob`: + +[source, cypher, role=noplay] +---- +ALTER USER bob +REMOVE HOME DATABASE +---- + +[NOTE] +==== +When altering a user, it is only necessary to specify the changes required. +For example, leaving out the `CHANGE [NOT] REQUIRED` part of the query will leave that unchanged. +==== + +[NOTE] +==== +The `SET STATUS {ACTIVE | SUSPENDED}`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts of the command are only available in Neo4j Enterprise Edition. label:enterprise-edition[] +==== + +The changes to the user will appear on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"bob" +|["PUBLIC"] +|false +|false +| + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 2 + +|=== + +The default behavior of this command is to throw an exception if the user does not exist. +Adding an optional parameter `IF EXISTS` to the command makes it idempotent and ensures that no exception is thrown. +Nothing happens should the user not exist. + +[source, cypher, role=noplay] +---- +ALTER USER nonExistingUser IF EXISTS SET PASSWORD 'abcd1234' +---- + + +[[access-control-alter-password]] +== Changing the current user's password + +Users can change their password using `ALTER CURRENT USER SET PASSWORD`. +The old password is required in addition to the new one, and either or both can be a string value or a string parameter. +When a user executes this command it will change their password as well as set the `CHANGE NOT REQUIRED` flag. + +[source, cypher, role=test-skip] +---- +ALTER CURRENT USER +SET PASSWORD FROM 'password1' TO 'password2' +---- + +[NOTE] +==== +This command works only for a logged-in user and cannot be run with auth disabled. +==== + + +[[access-control-drop-users]] +== Delete users + +Users can be deleted with `DROP USER`. + +[source, cypher, role=noplay] +---- +DROP USER bob +---- + +Deleting a user will not automatically terminate associated connections, sessions, transactions, or queries. + +However, when a user has been deleted, it will no longer appear on the list provided by `SHOW USERS`: + +[source, cypher, role=noplay] +---- +SHOW USERS +---- + +.Result +[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] +|=== +|user |roles |passwordChangeRequired |suspended |home + +|"neo4j" +|["admin","PUBLIC"] +|true +|false +| + +5+a|Rows: 1 + +|=== diff --git a/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc b/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc new file mode 100644 index 000000000..6ab3965af --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc @@ -0,0 +1,46 @@ +[role=enterprise-edition not-on-aura] +[[access-control-privileges-immutable]] += Immutable privileges +:description: This section explains how to use Cypher to manage immutable privileges. + +Unlike regular privileges, having xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privilege management] privileges is not sufficient to enable immutable privileges to be added or removed. They can only be administered when auth is disabled -- that is, when the configuration setting <> is set to `false`. + +[[access-control-privileges-immutable-usecase]] +== When to use immutable privileges + +Immutable privileges are useful for restricting the actions of users who themselves are able to xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[administer privileges]. + +For example, you may want to prevent all users from performing Database Management, even the `admin` user (who are themselves able to add or remove privileges). +To do so, you could run: + +[source, cypher] +---- +DENY DATABASE MANAGEMENT ON DBMS TO PUBLIC +---- + +However, this would not be adequate. +In case the `admin` user subsequently runs this: + +[source, cypher] +---- +REVOKE DENY DATABASE MANAGEMENT ON DBMS FROM PUBLIC +---- + +They would effectively regain Database Management privileges. +Instead, run the following query to prevent this scenario: + +[source, cypher, role=test-skip] +---- +DENY IMMUTABLE DATABASE MANAGEMENT ON DBMS TO PUBLIC +---- + + +[[access-control-privileges-immutable-admin]] +== How to administer immutable privileges + +Immutable privileges can only be administered when auth is disabled -- that is, when the configuration setting <> is set to `false`, for example. +Under these conditions, immutable privileges can be added and removed in a similar manner to regular privileges, using the `IMMUTABLE` keyword. + +See the link:{neo4j-docs-base-uri}/operations-manual/{page-version}/tutorial/tutorial-immutable-privileges[Immutable privileges tutorial] for examples of how to administer immutable privileges. + +See xref:administration/access-control/manage-privileges.adoc[Managing Privileges] for more detail on syntax. diff --git a/modules/ROOT/pages/administration/access-control/privileges-reads.adoc b/modules/ROOT/pages/administration/access-control/privileges-reads.adoc new file mode 100644 index 000000000..dc76d6960 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/privileges-reads.adoc @@ -0,0 +1,189 @@ +:description: How to use Cypher to manage read privileges on graphs. + +//// +[source, cypher, role=test-setup] +---- +CREATE ROLE regularUsers; +---- +//// + +[role=enterprise-edition aura-db-enterprise] +[[access-control-privileges-reads]] += Read privileges + +[abstract] +-- +This section explains how to use Cypher to manage read privileges on graphs. +-- + +There are three separate read privileges: + +* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-traverse[`TRAVERSE`] - enables the specified entities to be found. +* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-read[`READ`] - enables the specified properties of the found entities to be read. +* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-match[`MATCH`] - combines both `TRAVERSE` and `READ`, enabling an entity to be found and its properties read. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[[access-control-privileges-reads-traverse]] +== The `TRAVERSE` privilege + +Users can be granted the right to find nodes and relationships using the `GRANT TRAVERSE` privilege. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] TRAVERSE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, we can enable users with the role `regularUsers` to find all nodes with the label `Post` in the database `neo4j`: + +[source, cypher, role=noplay] +---- +GRANT TRAVERSE ON GRAPH neo4j NODES Post TO regularUsers +---- + +The `TRAVERSE` privilege can also be denied. + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] TRAVERSE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, we can disable users with the role `regularUsers` from finding all nodes with the label `Payments`: + +[source, cypher, role=noplay] +---- +DENY TRAVERSE ON HOME GRAPH NODES Payments TO regularUsers +---- + + +[[access-control-privileges-reads-read]] +== The `READ` privilege + +Users can be granted the right to do property reads on nodes and relationships using the `GRANT READ` privilege. +It is very important to note that users can only read properties on entities that they are enabled to find in the first place. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] READ "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, we can enable user with the role `regularUsers` to read all properties on nodes with the label `Post` in the database `neo4j`. +The `+*+` implies that the ability to read all properties also extends to properties that might be added in the future. + +[source, cypher, role=noplay] +---- +GRANT READ { * } ON GRAPH neo4j NODES Post TO regularUsers +---- + +[NOTE] +==== +Granting property `READ` access does not imply that the entities with that property can be found. +For example, if there is also a `DENY TRAVERSE` present on the same entity as a `GRANT READ`, the entity will not be found by a Cypher `MATCH` statement. +==== + +The `READ` privilege can also be denied. + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] READ "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +Although we just granted the role `regularUsers` the right to read all properties, we may want to hide the `secret` property. +The following example shows how to do that: + +[source, cypher, role=noplay] +---- +DENY READ { secret } ON GRAPH neo4j NODES Post TO regularUsers +---- + + +[[access-control-privileges-reads-match]] +== The `MATCH` privilege + +Users can be granted the right to find and do property reads on nodes and relationships using the `GRANT MATCH` privilege. +This is semantically the same as having both `TRAVERSE` and `READ` privileges. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] MATCH "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example if you want to grant the ability to read the properties `language` and `length` for nodes with the label `Message`, as well as the ability to find these nodes to the role `regularUsers`, you can use the following `GRANT MATCH` query: + +[source, cypher, role=noplay] +---- +GRANT MATCH { language, length } ON GRAPH neo4j NODES Message TO regularUsers +---- + +Like all other privileges, the `MATCH` privilege can also be denied. + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] MATCH "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +Please note that the effect of denying a `MATCH` privilege depends on whether concrete property keys are specified or are `+*+`. +If you specify concrete property keys, then `DENY MATCH` will only deny reading those properties. +Finding the elements to traverse would still be enabled. +If you specify `+*+` instead, then both traversal of the element and all property reads will be disabled. +The following queries will show examples for this. + +Denying to read the property `content` on nodes with the label `Message` for the role `regularUsers` would look like the following query. +Although not being able to read this specific property, nodes with that label can still be traversed (and, depending on other grants, other properties on it could still be read). + +[source, cypher, role=noplay] +---- +DENY MATCH { content } ON GRAPH neo4j NODES Message TO regularUsers +---- + +The following query exemplifies how it would look if you wanted to deny both reading all properties and traversing nodes labeled with `Account` in the database `neo4j`: + +[source, cypher, role=noplay] +---- +DENY MATCH { * } ON GRAPH neo4j NODES Account TO regularUsers +---- diff --git a/modules/ROOT/pages/administration/access-control/privileges-writes.adoc b/modules/ROOT/pages/administration/access-control/privileges-writes.adoc new file mode 100644 index 000000000..71f6e2069 --- /dev/null +++ b/modules/ROOT/pages/administration/access-control/privileges-writes.adoc @@ -0,0 +1,407 @@ +:description: How to use Cypher to manage write privileges on graphs. + +//// +[source, cypher, role=test-setup] +---- +CREATE ROLE regularUsers; +---- +//// + +[role=enterprise-edition aura-db-enterprise] +[[access-control-privileges-writes]] += Write privileges + +[abstract] +-- +This section explains how to use Cypher to manage write privileges on graphs. +-- + +Write privileges are defined for different parts of the graph: + +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-create[`CREATE`] - allows creating nodes and relationships. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-delete[`DELETE`] - allows deleting nodes and relationships. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-label[`SET LABEL`] - allows setting the specified node labels using the `SET` clause. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-remove-label[`REMOVE LABEL`] - allows removing the specified node labels using the `REMOVE` clause. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-property[`SET PROPERTY`] - allows setting properties on nodes and relationships. + +There are also compound privileges which combine the above specific privileges: + +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-merge[`MERGE`] - allows `MATCH`, `CREATE` and `SET PROPERTY` to apply the `MERGE` command. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-write[`WRITE`] - allows all `WRITE` operations on an entire graph. +* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-all[`ALL GRAPH PRIVILEGES`] - allows all `READ` and `WRITE` operations on an entire graph. + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[[access-control-privileges-writes-create]] +== The `CREATE` privilege + +The `CREATE` privilege allows a user to create new node and relationship elements on a graph. +See the Cypher xref::clauses/create.adoc[CREATE] clause. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] CREATE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `CREATE` elements on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT CREATE ON GRAPH neo4j ELEMENTS * TO regularUsers +---- + +The `CREATE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] CREATE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to `CREATE` nodes with the label `foo` on all graphs, use: + +[source, cypher, role=noplay] +---- +DENY CREATE ON GRAPH * NODES foo TO regularUsers +---- + +[NOTE] +==== +If the user attempts to create nodes with a label that does not already exist on the database, then the user must also possess the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege. +The same applies to new relationships: the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW RELATIONSHIP TYPE] privilege is required. +==== + + +[[access-control-privileges-writes-delete]] +== The `DELETE` privilege + +The `DELETE` privilege allows a user to delete node and relationship elements on a graph. +See the Cypher xref::clauses/delete.adoc[DELETE] clause. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] DELETE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `DELETE` elements on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT DELETE ON GRAPH neo4j ELEMENTS * TO regularUsers +---- + +The `DELETE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] DELETE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to `DELETE` relationships with the relationship type `bar` on all graphs, use: + +[source, cypher, role=noplay] +---- +DENY DELETE ON GRAPH * RELATIONSHIPS bar TO regularUsers +---- + +[NOTE] +==== +Users with `DELETE` privilege, but restricted `TRAVERSE` privileges, will not be able to do `DETACH DELETE` in all cases. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/access-control#detach-delete-restricted-user[Operations Manual -> Fine-grained access control] for more info. +==== + + +[[access-control-privileges-writes-set-label]] +== The `SET LABEL` privilege + +The `SET LABEL` privilege allows you to set labels on a node using the xref::clauses/set.adoc#set-set-a-label-on-a-node[SET clause]: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET LABEL { * | label[, ...] } + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `SET` any label on nodes of the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET LABEL * ON GRAPH neo4j TO regularUsers +---- + +[NOTE] +==== +Unlike many of the other `READ` and `WRITE` privileges, it is not possible to restrict the `SET LABEL` privilege to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. +==== + +The `SET LABEL` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET LABEL { * | label[, ...] } + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to `SET` the label `foo` on nodes of all graphs, use: + +[source, cypher, role=noplay] +---- +DENY SET LABEL foo ON GRAPH * TO regularUsers +---- + +[NOTE] +==== +If no instances of this label exist on the database, then the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege is also required. +==== + + +[[access-control-privileges-writes-remove-label]] +== The `REMOVE LABEL` privilege + +The `REMOVE LABEL` privilege allows you to remove labels from a node by using the xref::clauses/remove.adoc#remove-remove-a-label-from-a-node[REMOVE clause]: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] REMOVE LABEL { * | label[, ...] } + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `REMOVE` any label from nodes of the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT REMOVE LABEL * ON GRAPH neo4j TO regularUsers +---- + +[NOTE] +==== +Unlike many of the other `READ` and `WRITE` privileges, it is not possible to restrict the `REMOVE LABEL` privilege to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. +==== + +The `REMOVE LABEL` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] REMOVE LABEL { * | label[, ...] } + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, denying the role `regularUsers` the ability to remove the label `foo` from nodes of all graphs, use: + +[source, cypher, role=noplay] +---- +DENY REMOVE LABEL foo ON GRAPH * TO regularUsers +---- + + +[[access-control-privileges-writes-set-property]] +== The `SET PROPERTY` privilege + +The `SET PROPERTY` privilege allows a user to set a property on a node or relationship element in a graph by using the xref::clauses/set.adoc#set-set-a-property[SET clause]: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET PROPERTY "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `SET` any property on all elements of the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET PROPERTY {*} ON HOME GRAPH ELEMENTS * TO regularUsers +---- + +The `SET PROPERTY` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET PROPERTY "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to `SET` the property `foo` on nodes with the label `bar` on all graphs, use: + +[source, cypher, role=noplay] +---- +DENY SET PROPERTY { foo } ON GRAPH * NODES bar TO regularUsers +---- + +[NOTE] +==== +If the user attempts to set a property with a property name that does not already exist on the database, the user must also possess the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW PROPERTY NAME] privilege. +==== + + +[[access-control-privileges-writes-merge]] +== The `MERGE` privilege + +The `MERGE` privilege is a compound privilege that combines `TRAVERSE` and `READ` (i.e. `MATCH`) with `CREATE` and `SET PROPERTY`. +This is intended to enable the use of xref::clauses/merge.adoc[the MERGE command], but it is also applicable to all reads and writes that require these privileges. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] MERGE "{" { * | property[, ...] } "}" + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + [ + ELEMENT[S] { * | label-or-rel-type[, ...] } + | NODE[S] { * | label[, ...] } + | RELATIONSHIP[S] { * | rel-type[, ...] } + ] + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `MERGE` on all elements of the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT MERGE {*} ON GRAPH neo4j ELEMENTS * TO regularUsers +---- + +It is not possible to deny the `MERGE` privilege. +If you wish to prevent a user from creating elements and setting properties: use xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-create[DENY CREATE] or xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-property[DENY SET PROPERTY]. + +[NOTE] +==== +If the user attempts to create nodes with a label that does not already exist on the database, the user must also possess the +xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege. +The same applies to new relationships and properties - the +xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW RELATIONSHIP TYPE] or +xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW PROPERTY NAME] privileges are required. +==== + + +[[access-control-privileges-writes-write]] +== The `WRITE` privilege + +The `WRITE` privilege allows the user to execute any `WRITE` command on a graph. + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] WRITE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` the ability to `WRITE` on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT WRITE ON GRAPH neo4j TO regularUsers +---- + +[NOTE] +==== +Unlike the more specific `WRITE` commands, it is not possible to restrict `WRITE` privileges to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. +If you wish to prevent a user from writing to a subset of database objects, a `GRANT WRITE` can be combined with more specific `DENY` commands to target these elements. +==== + +The `WRITE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] WRITE + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` the ability to `WRITE` on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY WRITE ON GRAPH neo4j TO regularUsers +---- + +[NOTE] +==== +Users with `WRITE` privilege but restricted `TRAVERSE` privileges will not be able to do `DETACH DELETE` in all cases. +See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/access-control#detach-delete-restricted-user[Operations Manual -> Fine-grained access control] for more info. +==== + + +[[access-control-privileges-writes-all]] +== The `ALL GRAPH PRIVILEGES` privilege + +The `ALL GRAPH PRIVILEGES` privilege allows the user to execute any command on a graph: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALL [ [ GRAPH ] PRIVILEGES ] + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `regularUsers` `ALL GRAPH PRIVILEGES` on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT ALL GRAPH PRIVILEGES ON GRAPH neo4j TO regularUsers +---- + +[NOTE] +==== +Unlike the more specific `READ` and `WRITE` commands, it is not possible to restrict `ALL GRAPH PRIVILEGES` to specific +ELEMENTS, +NODES+ or +RELATIONSHIPS+. +If you wish to prevent a user from reading or writing to a subset of database objects, a `GRANT ALL GRAPH PRIVILEGES` can be combined with more specific `DENY` commands to target these elements. +==== + +The `ALL GRAPH PRIVILEGES` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALL [ [ GRAPH ] PRIVILEGES ] + ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `regularUsers` all graph privileges on the graph `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY ALL GRAPH PRIVILEGES ON GRAPH neo4j TO regularUsers +---- diff --git a/modules/ROOT/pages/administration/aliases.adoc b/modules/ROOT/pages/administration/aliases.adoc new file mode 100644 index 000000000..35f7b1f0e --- /dev/null +++ b/modules/ROOT/pages/administration/aliases.adoc @@ -0,0 +1,1523 @@ +:description: How to use Cypher to manage database aliases in Neo4j. +[role=enterprise-edition aura-db-enterprise] +[[alias-management]] += Database alias management + +[abstract] +-- +This section explains how to use Cypher to manage database aliases in Neo4j. +-- + +There are two kinds of database aliases: local and remote. +A local database alias can only target a database within the same DBMS. +A remote database alias may target a database from another Neo4j DBMS. +When a query is run against a database alias, it will be redirected to the target database. +The home database for users can be set to an alias, which will be resolved to the target database on use. +Both local and remote database aliases can be created as part of a xref::administration/databases.adoc#administration-databases-create-composite-database[composite database]. + +A local database alias can be used in all other Cypher commands in place of the target database. +Please note that the local database alias will be resolved while executing the command. +Privileges are defined on the database, and not the local database alias. + +A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, use clauses, setting a user's home database and defining the access privileges to the remote database. +Remote database aliases require configuration to safely connect to the remote target, which is described in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/manage-databases/remote-alias[Connecting remote databases]. +It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias. + +Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database. +The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. +When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database. + +The syntax of the database alias management commands is as follows: + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Alias management command syntax +[options="header", width="100%", cols="1,5a"] +|=== +| Command | Syntax +| Show Database Alias +| +[source, syntax, role=noheader] +----- +SHOW ALIAS[ES] [name] FOR DATABASE[S] +[WHERE expression] +----- +[source, syntax, role=noheader] +----- +SHOW ALIAS[ES] [name] FOR DATABASE[S] +YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] +[WHERE expression] +[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +----- +Lists both local and remote database aliases, optionally filtered on the alias name. + +| Create Local Alias +| +[source, syntax, role=noheader] +----- +CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName +[PROPERTIES "{" key: value[, ...] "}"] +----- +[source, syntax, role=noheader] +----- +CREATE OR REPLACE ALIAS name FOR DATABASE targetName +[PROPERTIES "{" key: value[, ...] "}"] +----- + +| Create Remote Alias +| +[source, syntax, role=noheader] +----- +CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName +AT 'url' USER username PASSWORD 'password' +[DRIVER "{" setting: value[, ...] "}"] +[PROPERTIES "{" key: value[, ...] "}"] +----- +[source, syntax, role=noheader] +----- +CREATE OR REPLACE ALIAS name FOR DATABASE targetName +AT 'url' USER username PASSWORD 'password' +[DRIVER "{" setting: value[, ...] "}"] +[PROPERTIES "{" key: value[, ...] "}"] +----- + +| Alter Local Alias +| +[source, syntax, role=noheader] +----- +ALTER ALIAS name [IF EXISTS] SET DATABASE +[TARGET targetName] +[PROPERTIES "{" key: value[, ...] "}"] +----- + +| Alter Remote Alias +| +[source, syntax, role=noheader] +----- +ALTER ALIAS name [IF EXISTS] SET DATABASE +[TARGET targetName AT 'url'] +[USER username] +[PASSWORD 'password'] +[DRIVER "{" setting: value[, ...] "}"] +[PROPERTIES "{" key: value[, ...] "}"] +----- + +| Drop Alias +| +[source, syntax, role=noheader] +----- +DROP ALIAS name [IF EXISTS] FOR DATABASE +----- +Drop either a local or remote database alias. + +|=== + +This is the list of the allowed driver settings for remote database aliases. + +[[remote-alias-driver-settings]] +.ssl_enforced +[width="100%", cols="1s, 4a"] +|=== +| Description +| +SSL for remote database alias drivers is configured through the target url scheme. +If `ssl_enforced` is set to true, a secure url scheme is enforced. +This will be validated when the command is executed. + +| Valid values +| Boolean + +| Default value +| true + +|=== + +.connection_timeout +[width="100%", cols="1s, 4a"] +|=== + +| Description +| +Socket connection timeout. +A timeout of zero is treated as an infinite timeout and will be bound by the timeout configured on the operating system level. + +| Valid values +| Duration + +| Default value +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout] + +|=== + +.connection_max_lifetime +[width="100%", cols="1s, 4a"] +|=== + +| Description +| +Pooled connections older than this threshold will be closed and removed from the pool. +Setting this option to a low value will cause a high connection churn and might result in a performance hit. +It is recommended to set maximum lifetime to a slightly smaller value than the one configured in network equipment (load balancer, proxy, firewall, etc. can also limit maximum connection lifetime). + +| Valid values +| Duration. + +Zero and negative values result in lifetime not being checked. + +| Default value +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime] + +|=== + +.connection_pool_acquisition_timeout +[width="100%", cols="1s, 4a"] +|=== +| Description +| +Maximum amount of time spent attempting to acquire a connection from the connection pool. +This timeout only kicks in when all existing connections are being used and no new connections can be created because maximum connection pool size has been reached. +Error is raised when connection can’t be acquired within configured time. + +| Valid values +| Duration. + +Negative values are allowed and result in unlimited acquisition timeout. +Value of `0` is allowed and results in no timeout and immediate failure when connection is unavailable. + +| Default value +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout] + +|=== + +.connection_pool_max_size +[width="100%", cols="1s, 4a"] +|=== + +| Description +| +Maximum total number of connections to be managed by a connection pool. +The limit is enforced for a combination of a host and user. + +| Valid values +| Integer. + +Negative values are allowed and result in unlimited pool. +Value of `0` is not allowed. + +| Default value +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size] + +|=== + +.logging_level +[width="100%", cols="1s, 4a"] +|=== + +| Description +| Sets level for driver internal logging. + +| Valid values +| org.neo4j.logging.Level. + +One of `DEBUG`, `INFO`, `WARN`, `ERROR`, or `NONE`. + +| Default value +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level] + +|=== + + +[NOTE] +==== +If transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety. +This prevents issues such as a transaction executing against multiple target databases for the same alias. +==== + + +[[alias-management-show-alias]] +== Listing database aliases + +//// +[source, cypher, role=test-setup] +---- +CREATE DATABASE `movies`; +CREATE ALIAS `films` FOR DATABASE `movies`; +CREATE ALIAS `motion pictures` FOR DATABASE `movies` PROPERTIES { nameContainsSpace: true }; +CREATE DATABASE `northwind-graph-2020`; +CREATE DATABASE `northwind-graph-2021`; +CREATE DATABASE `northwind-graph-2022`; +CREATE DATABASE `sci-fi-books`; +CREATE COMPOSITE DATABASE `library`; +CREATE ALIAS `library`.`sci-fi` FOR DATABASE `sci-fi-books`; +CREATE COMPOSITE DATABASE garden; +CREATE DATABASE `perennial-flowers`; +CREATE ALIAS `library`.`romance` FOR DATABASE `romance-books` AT 'neo4j+s://location:7687' USER alice PASSWORD 'password'; +CREATE ALIAS `movie scripts` FOR DATABASE `scripts` AT "neo4j+s://location:7687" USER alice PASSWORD "password" +DRIVER { + ssl_enforced: true, + connection_timeout: duration({seconds: 5}), + connection_max_lifetime: duration({hours: 1}), + connection_pool_acquisition_timeout: duration({minutes: 1}), + connection_pool_idle_test: duration({minutes: 2}), + connection_pool_max_size: 10, + logging_level: 'info' +}; +---- +//// + +Available database aliases can be seen using `SHOW ALIASES FOR DATABASE`. +The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. + +`SHOW ALIASES FOR DATABASE` will produce a table of database aliases with the following columns: + +[options="header" cols="2m,4a,2m"] +|=== +| Column | Description | Type + +| name +| The fully qualified name of the database alias. label:default-output[] +| STRING + +| database +| The name of the target database. label:default-output[] +| STRING + +| location +| The location of the database, either `local` or `remote`. label:default-output[] +| STRING + +| url +| Target location or `null` if the target is local. label:default-output[] +| STRING + +| user +| User connecting to the remote database or `null` if the target database is local. label:default-output[] +| STRING + +| driver +| +The driver options for connection to the remote database or `null` if the target database is local or if no driver settings are added. +List of xref::administration/aliases.adoc#remote-alias-driver-settings[driver settings] allowed for remote database aliases. +| MAP + +| properties +| Any properties set on the database alias. +| MAP + +|=== + +The detailed information for a particular database alias can be displayed using the command `SHOW ALIASES FOR DATABASE YIELD *`. +When a `YIELD *` clause is provided, the full set of columns is returned. + +.+Show all aliases for a database+ +====== + +A summary of all available database aliases can be displayed using the command `SHOW ALIASES FOR DATABASE`. + +.Query +[source, cypher] +---- +SHOW ALIASES FOR DATABASE +---- + +.Result +[role="queryresult",options="header,footer",cols="5*+ | ++ +| +"library.romance"+ | +romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +| +"library.sci-fi"+ | +sci-fi-books"+ | +"local"+ | ++ | ++ +| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ +| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +5+d|Rows: 5 + +|=== + +====== + +.+Show specific aliases for databases+ +====== + +To list just one database alias, the `SHOW ALIASES` command takes an alias name; + +.Query +[source, cypher] +---- +SHOW ALIAS films FOR DATABASES +---- + +.Result +[role="queryresult",options="header,footer",cols="5*+ | ++ + +5+d|Rows: 1 + +|=== + +.Query +[source, cypher] +---- +SHOW ALIAS library.romance FOR DATABASES +---- + +.Result +[role="queryresult",options="header,footer",cols="5*+ | ++ | ++ | +{}+ +| +"library.romance"+ | +"romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{}+ | +{}+ +| +"library.sci-fi"+ | +"sci-fi-books"+ | +"local"+ | ++ | ++ | ++ | +{}+ +| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ | ++ | +{"namecontainsspace":true}+ +| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{"connection_pool_idle_test":PT2M,"connection_pool_max_size":10,"loggi"connection_pool_idle_test":PT2M,"connection_pool_max_size":10,"logging_level":"INFO","ssl_enforced":true,"connection_pool_acquisition_timeout":PT1M,"connection_timeout":PT5S,"connection_max_lifetime":PT1H} | +{}+ + +7+d|Rows: 5 + +|=== + +====== + + +.+Show count of aliases for a database+ +====== + +The number of database aliases can be seen using a `count()` aggregation with `YIELD` and `RETURN`. + + +.Query +[source, cypher] +---- +SHOW ALIASES FOR DATABASE YIELD * +RETURN count(*) as count +---- + +.Result +[role="queryresult",options="header,footer",cols="1*+ | +"movies"+ +| +"library.romance"+ | +"neo4j+s://location:7687"+ | +"romance-books"+ +| +"movie scripts"+ | +"neo4j+s://location:7687"+ | +"scripts"+ +3+d|Rows: 3 +|=== + +====== + +[[alias-management-create-database-alias]] +== Creating database aliases + +Database aliases can be created using `CREATE ALIAS`. + +The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. + +.Create alias command syntax +[options="header", width="100%", cols="5a,2"] +|=== +| Syntax | Comment +| +[source, syntax, role=noheader] +----- +CREATE [OR REPLACE] ALIAS [compositeDatabaseName.]aliasName [IF NOT EXISTS] FOR DATABASE targetName +[PROPERTIES "{" key: value[, ...] "}"] +----- +| Create a local alias. + +| +[source, syntax, role=noheader] +----- +CREATE [OR REPLACE] ALIAS [compositeDatabaseName.]aliasName [IF NOT EXISTS] FOR DATABASE targetName +AT 'url' USER username PASSWORD 'password' +[DRIVER "{" setting: value[, ...] "}"] +[PROPERTIES "{" key: value[, ...] "}"] +----- +| Create a remote database alias. + +|=== + + +This command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists. +Inserting `IF NOT EXISTS` after the alias name ensures that no error is returned and nothing happens should a database alias with that name already exist. +Adding `OR REPLACE` to the command will result in any existing database alias being deleted and a new one created. +`CREATE OR REPLACE ALIAS` will fail if there is an existing database with the same name. + +[NOTE] +==== +The `IF NOT EXISTS` and `OR REPLACE` parts of this command cannot be used together. +==== + +[NOTE] +==== +Database alias names are subject to the rules specified in the xref:administration/alias-management-escaping[Alias names and escaping] section. +==== + +[[database-management-create-local-database-alias]] +=== Creating local database aliases + +Local aliases are created with a target database. + +.+Creating aliases for local databases+ +====== + +.Query +[source, cypher] +---- +CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2021` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +When a local database alias has been created, it will show up in the `aliases` column provided by the command `SHOW DATABASES` and in the `SHOW ALIASES FOR DATABASE` command. + + +.Query +[source, cypher] +---- +SHOW DATABASE `northwind` +---- + +.Result +[role="queryresult",options="header,footer",cols="13*+ | ++ +5+d|Rows: 1 + +|=== + +====== + +.+Setting properties for local database aliases+ +====== + +Local database aliases can also be given properties. + +.Query +[source, cypher] +---- +CREATE ALIAS `northwind-2022` +FOR DATABASE `northwind-graph-2022` +PROPERTIES { newestNorthwind: true, index: 3 } +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command. + +.Query +[source, cypher] +---- +SHOW ALIAS `northwind-2022` FOR DATABASE YIELD name, properties +---- + +.Result +[role="queryresult",options="header,footer",cols="2* 10, connection_timeout -> PT1M}+ | +{}+ +7+d|Rows: 1 + +|=== + +====== + +.+Setting properties for remote database aliases+ +====== +Just as the local database aliases, the remote database aliases can be given properties. + +.Query +[source, cypher] +---- +CREATE ALIAS `remote-northwind-2021` FOR DATABASE `northwind-graph-2021` AT 'neo4j+s://location:7687' +USER alice PASSWORD 'password' +PROPERTIES { newestNorthwind: false, index: 6 } +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command. + +.Query +[source, cypher] +---- +SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties +---- + +.Result +[role="queryresult",options="header,footer",cols="2*+ | ++ +| +"garden.trees"+ | +"trees"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +5+d|Rows: 1 + +|=== +====== + + +.+Aliases pointing to composite databases+ +====== +Database aliases cannot point to a composite database. + +.Query +[source, cypher, role=test-fail] +---- +CREATE ALIAS yard FOR DATABASE garden +---- + +.Error message +[source, output, role="noheader"] +---- +Failed to create the specified database alias 'yard': Database 'garden' is composite. +---- + +====== + +[[alias-management-alter-database-alias]] +== Altering database aliases + +//// +CREATE ALIAS garden.flowers FOR DATABASE `perennial-flowers`; +CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2020`; // created in the replace alias example +CREATE ALIAS `remote-northwind` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER alice PASSWORD 'password'; +CREATE ALIAS `remote-with-driver-settings` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER alice PASSWORD 'password' +DRIVER { + connection_timeout: duration({ minutes: 1 }), + connection_pool_max_size: 10 + }; +CREATE ALIAS garden.trees FOR DATABASE trees AT 'neo4j+s://location:7687' USER alice PASSWORD 'password' +//// + +Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, url, user credentials, or driver settings. +The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. +Only the clauses used will be altered. + +[NOTE] +==== +Local database aliases cannot be altered to remote aliases, or vice versa. +==== + +.Alter alias command syntax +[options="header", width="100%", cols="5a,2"] +|=== +| Syntax | Comment +| +[source, source, role=noheader] +----- +ALTER ALIAS [compositeDatabaseName.]aliasName [IF EXISTS] SET DATABASE +[TARGET targetName] +[PROPERTIES "{" key: value[, ...] "}"] +----- +| Modify database target of a local alias. + +The clauses can be applied in any order, while at least one clause needs to be set. + +| +[source, source, role=noheader] +----- +ALTER ALIAS [compositeDatabaseName.]aliasName [IF EXISTS] SET DATABASE +[TARGET targetName AT 'url'] +[USER username] +[PASSWORD 'password'] +[DRIVER "{" setting: value[, ...] "}"] +[PROPERTIES "{" key: value[, ...] "}"] +----- +| Modify a remote alias. + +The clauses can be applied in any order, while at least one clause needs to be set. + +|=== + +.+Altering local database aliases+ +====== + +Example of altering a local database alias target. + + +.Query +[source, cypher] +---- +ALTER ALIAS `northwind` +SET DATABASE TARGET `northwind-graph-2021` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +When a local database alias has been altered, it will show up in the `aliases` column for the target database provided by the command `SHOW DATABASES`. + +.Query +[source, cypher] +---- +SHOW DATABASE `northwind-graph-2021` +---- + +.Result +[role="queryresult",options="header,footer",cols="13*+ | ++ | ++ | +{"perennial":true}+ +| +"garden.trees"+ | +"updatedtrees"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{}+ | +{"treeversion":2}+ +| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ | ++ | +{"namecontainsspace":true,"moreinfo":"no, not really"}+ +| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H}+ | +{"namecontainsspace":true}+ +| +"northwind"+ | +"northwind-graph-2021"+ | +"local"+ | ++ | ++ | ++ |+[]+ +| +"remote-northwind"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://other-location:7687"+ | +"alice"+ | +{}+ | +{}+ +| +"remote-with-driver-settings"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"bob"+ | +{logging_level -> "DEBUG", connection_timeout -> PT1M}+ |+[]+ +7+d|Rows: 7 + +|=== + + +.+Using IF EXISTS when altering database aliases+ +====== + +The `ALTER ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist. +Appending `IF EXISTS` to the command ensures that no error is returned and nothing happens should the alias not exist. + + + +.Query +[source, cypher] +---- +ALTER ALIAS `no-alias` IF EXISTS SET DATABASE TARGET `northwind-graph-2021` +---- + +[source, result, role="noheader"] +---- +(no changes, no records) +---- + +====== + +[[alias-management-drop-database-alias]] +== Deleting database aliases + +//// +CREATE ALIAS garden.flowers FOR DATABASE `perennial-flowers` PROPERTIES { perennial: true }; +CREATE ALIAS `northwind-2022` FOR DATABASE `northwind-graph-2022` PROPERTIES { newestNorthwind: true, index: 3 }; +CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2021`; +CREATE ALIAS `remote-northwind-2021` +FOR DATABASE `northwind-graph-2021` AT 'neo4j+s://location:7687' USER alice PASSWORD 'password' +PROPERTIES { newestNorthwind: false, index: 6 }; +CREATE ALIAS `remote-northwind` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://other-location:7687" USER alice PASSWORD 'password'; +CREATE ALIAS `remote-with-driver-settings` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER bob PASSWORD 'newPassword' +DRIVER { + connection_timeout: duration({ minutes: 1 }), + logging_level: "debug" + }; +CREATE ALIAS garden.trees FOR DATABASE updatedTrees AT 'neo4j+s://location:7687' +USER alice PASSWORD 'password' +PROPERTIES { treeVersion: 2 } +//// + + +Both local and remote database aliases can be deleted using the `DROP ALIAS` command. +The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. + + +.+Deleting local database aliases+ +====== + +Delete a local database alias. + + +.Query +[source, cypher] +---- +DROP ALIAS `northwind` FOR DATABASE +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +When a database alias has been deleted, it will no longer show up in the `aliases` column provided by the command `SHOW DATABASES`. + +.Query +[source, cypher] +---- +SHOW DATABASE `northwind-graph-2021` +---- + +.Result +[role="queryresult",options="header,footer",cols="13*+ | ++ +| +"garden.trees"+ | +"updatedtrees"+ | +"local"+ | +"neo4j+s://location:7687"+ | +"alice"+ +| +"library.romance"+ | +"romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +| +"library.sci-fi"+ | +"sci-fi-books"+ | +"local"+ | ++ | ++ +| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ +| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +| +"northwind-2022"+ | +"northwind-graph-2022"+ | +"local"+ | ++ | ++ +| +"remote-northwind"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://other-location:7687"+ | +"alice"+ +| +"remote-northwind-2021"+ | +"northwind-graph-2021"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ +| +"remote-with-driver-settings"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"bob"+ +5+d|Rows: 9 + +|=== + +.+Using IF EXISTS when deleting database aliases+ +====== + +The `DROP ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist. +Inserting `IF EXISTS` after the alias name ensures that no error is returned and nothing happens should the alias not exist. + +.Query +[source, cypher] +---- +DROP ALIAS `northwind` IF EXISTS FOR DATABASE +---- + +[source, result, role="noheader"] +---- +(no changes, no records) +---- + +====== + +[[alias-management-escaping]] +== Alias names and escaping +//// +[source, cypher, role=test-setup] +---- +CREATE DATABASE `northwind-graph`; +CREATE COMPOSITE DATABASE `my-composite-database-with-dashes`; +CREATE COMPOSITE DATABASE `my.composite.database.with.dots`; +CREATE COMPOSITE DATABASE mySimpleCompositeDatabase; +CREATE COMPOSITE DATABASE `myCompositeDatabase.withDot`; +---- +//// + +Database alias names are subject to the xref::syntax/naming.adoc[standard Cypher restrictions on valid identifiers]. + +The following naming rules apply: + +* A name is a valid identifier. +* Name length can be up to 65534 characters. +* Names cannot end with dots. +* Unescaped dots signify that the database alias belongs to a composite database, separating the composite database name and the alias name. +* Names that begin with an underscore or with the prefix `system` are reserved for internal use. +* Non-alphabetic characters, including numbers, symbols, dots, and whitespace characters, can be used in names, but must be escaped using backticks. + +The name restrictions and escaping rules apply to all the different database alias commands. + +[NOTE] +==== +Having dots (`.`) in the database alias names is not recommended. +This is due to the difficulty of determining if a dot is part of the database alias name or a delimiter for a database alias in a composite database. +==== + +When it comes to escaping names using backticks, there are some additional things to consider around database aliases in composite databases: + +.+Escaping database alias and composite database names+ +====== + +The composite database name and the database alias name need to be escaped individually. +The following example creates a database alias named `my alias with spaces` as a constituent in the composite database named `my-composite-database-with-dashes`: + +.Query +[source, cypher] +---- +CREATE ALIAS `my-composite-database-with-dashes`.`my alias with spaces` FOR DATABASE `northwind-graph` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +When not escaped individually, a database alias with the full name `my alias with.dots and spaces` gets created instead: + +.Query +[source, cypher] +---- +CREATE ALIAS `my alias with.dots and spaces` FOR DATABASE `northwind-graph` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +====== + +.+Handling multiple dots+ +====== + +//Examples where dots are not separators between composite name and alias name are impossible to test, because the right escaping cannot be inferred automatically. + +Database alias names may also include dots. +Though these always need to be escaped in order to avoid ambiguity with the composite database and database alias split character. + +.Query +[source, cypher, role=test-skip] +---- +CREATE ALIAS `my.alias.with.dots` FOR DATABASE `northwind-graph` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +.Query +[source, cypher, role=test-skip] +---- +CREATE ALIAS `my.composite.database.with.dots`.`my.other.alias.with.dots` FOR DATABASE `northwind-graph` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +====== + +.+Single dots and local database aliases+ label:deprecated[] +====== +There is a special case for local database aliases with a single dot without any existing composite database. +If a composite database `some` exists, the query below will create a database alias named `alias` within the composite database `some`. +If no such database exists, however, the same query will instead create a database alias named `some.alias`: + +.Query +[source, cypher] +---- +CREATE ALIAS some.alias FOR DATABASE `northwind-graph` +---- + +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +====== + +.+Handling parameters+ +====== + +When using parameters, names cannot be escaped. +When the given parameter includes dots, the first dot will be considered the divider for the composite database. + +Consider the query with parameter: + +.Parameters +[source, javascript] +---- +{ + "aliasname": "mySimpleCompositeDatabase.myAlias" +} +---- + +.Query +[source, cypher] +---- +CREATE ALIAS $aliasname FOR DATABASE `northwind-graph` +---- + +If the composite database `mysimplecompositedatabase` exists, then a database alias `myalias` will be created in that composite database. +If no such composite database exists, then a database alias `mysimplecompositedatabase.myalias` will be created. + +On the contrary, a database alias `myalias` cannot be created in composite `mycompositedatabase.withdot` using parameters. +Consider the same query but with the following parameter: + +.Parameters +[source, javascript] +---- +{ + "aliasname": "myCompositeDatabase.withDot.myAlias" +} +---- + +Since the first dot will be used as a divider, the command will attempt to create the database alias `withdot.myalias` in the composite database `mycompositedatabase`. +If `mycompositedatabase` doesn't exist, the command will create a database alias with the name `mycompositedatabase.withdot.myalias`, which is not part of any composite database. + +In these cases, it is recommended to avoid parameters and explicitly escape the composite database name and alias name separately to avoid ambiguity. + +====== + +.+Handling parameters+ +====== + +Further special handling with parameters is needed for database aliases and similarly named composite databases. + +Consider the set-up: + +.Query +[source, cypher, role="noheader test-skip"] +---- +CREATE COMPOSITE DATABASE foo +CREATE ALIAS `foo.bar` FOR DATABASE `northwind-graph` +---- + +The alias `foo.bar` does not belong to the composite database `foo`. + +Dropping this alias using parameters fails with an error about a missing alias: + +.Parameters +[source, javascript] +---- +{ + "aliasname": "foo.bar" +} +---- + +.Query +[source, cypher, role=test-fail] +---- +DROP ALIAS $aliasname FOR DATABASE +---- + +.Error message +[source, output, role="noheader"] +---- +Failed to delete the specified database alias 'foo.bar': Database alias does not exist. +---- + +Had the composite database `foo` not existed, the database alias `foo.bar` would have been dropped. + +In these cases, it is recommended to avoid parameters and explicitly escape the composite database name and alias name separately to avoid ambiguity. + +====== diff --git a/modules/ROOT/pages/administration/databases.adoc b/modules/ROOT/pages/administration/databases.adoc new file mode 100644 index 000000000..41ad9a00e --- /dev/null +++ b/modules/ROOT/pages/administration/databases.adoc @@ -0,0 +1,1172 @@ +:description: How to use Cypher to manage databases in Neo4j DBMS: creating, modifying, deleting, starting, and stopping individual databases within a single server. + +//// +[source, cypher, role=test-setup] +---- +CREATE DATABASE `movies`; +CREATE ALIAS `films` FOR DATABASE `movies`; +CREATE ALIAS `motion pictures` FOR DATABASE `movies`; +---- +//// + +[[administration-databases]] += Database management + +[abstract] +-- +This section explains how to use Cypher to manage databases in Neo4j DBMS: creating, modifying, deleting, starting, and stopping individual databases within a single server. +-- + +Neo4j supports the management of multiple databases within the same DBMS. +The metadata for these databases, including the associated security model, is maintained in a special database called the `system` database. +All multi-database administrative commands must be run against the `system` database. +These administrative commands are automatically routed to the `system` database when connected to the DBMS over Bolt. + +The syntax of the database management commands is as follows: + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +.Database management command syntax +[options="header", width="100%", cols="1m,5a"] +|=== +| Command | Syntax + +| SHOW DATABASE +| +[source, syntax, role="noheader"] +---- +SHOW { DATABASE[S] name \| DATABASE[S] \| DEFAULT DATABASE \| HOME DATABASE } +[WHERE expression] +---- + +[source, syntax, role="noheader"] +---- +SHOW { DATABASE[S] name \| DATABASE[S] \| DEFAULT DATABASE \| HOME DATABASE } +YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] +[WHERE expression] +[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| CREATE DATABASE +| +[source, syntax, role="noheader"] +---- +CREATE DATABASE name [IF NOT EXISTS] +[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]] +[OPTIONS "{" option: value[, ...] "}"] +[WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE DATABASE name +[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]] +[OPTIONS "{" option: value[, ...] "}"] +[WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +| CREATE COMPOSITE DATABASE +| +[source, synatx, role="noheader"] +---- +CREATE COMPOSITE DATABASE name [IF NOT EXISTS] +[OPTIONS "{" "}"] +[WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +[source, syntax, role="noheader"] +---- +CREATE OR REPLACE COMPOSITE DATABASE name +[OPTIONS "{" "}"] +[WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +| ALTER DATABASE +| +[source, syntax, role="noheader"] +---- +ALTER DATABASE name [IF EXISTS] +{ +SET ACCESS {READ ONLY \| READ WRITE} \| +SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] +} +---- + +| STOP DATABASE +| +[source, syntax, role="noheader"] +---- +STOP DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +| START DATABASE +| +[source, syntax, role="noheader"] +---- +START DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +| DROP DATABASE +| +[source, syntax, role="noheader"] +---- +DROP [COMPOSITE] DATABASE name [IF EXISTS] [{DUMP\|DESTROY} [DATA]] [WAIT [n [SEC[OND[S]]]]\|NOWAIT] +---- + +|=== + +[[administration-databases-show-databases]] +== Listing databases + +There are four different commands for listing databases: + +* Listing all databases. +* Listing a particular database. +* Listing the default database. +* Listing the home database. + +These commands return the following columns: + +.Listing databases output +[options="header", width="100%", cols="4m,6a,2m"] +|=== +| Column | Description | Type + +| name +| The name of the database. label:default-output[] +| STRING + +| type +| The type of the database: `system`, `standard`, or `composite`. label:default-output[] +| STRING + +| aliases +| The names of any aliases the database may have. label:default-output[] +| LIST OF STRING + +| access +| The database access mode, either `read-write` or `read-only`. label:default-output[] + +[NOTE] +==== +A database may be described as read-only when using `ALTER DATABASE ... SET ACCESS READ ONLY`. +==== +| STRING + +| databaseID +| The database unique ID. +| STRING + +| serverID +| The server instance ID. +| STRING + +| address +| +Instance address in a clustered DBMS. +The default for a standalone database is `neo4j://localhost:7687`. label:default-output[] +| STRING + +| role +| The current role of the database (`primary`, `secondary`, `unknown`). label:default-output[] +| STRING + +| writer +|`true` for the database node that accepts writes (this node is the leader for this database in a cluster or this is a standalone instance). label:default-output[] +| BOOLEAN + +| requestedStatus +| The expected status of the database. label:default-output[] +| STRING + +| currentStatus +| The actual status of the database. label:default-output[] +| STRING + +| statusMessage +| A message explaining the status of the database, often explaining why it is not in the correct state. label:default-output[] +| STRING + +| default +| +Show if this is the default database for the DBMS. label:default-output[] + +[NOTE] +==== +Not returned by `SHOW HOME DATABASE` or `SHOW DEFAULT DATABASE`. +==== +| BOOLEAN + +| home +| +Shown if this is the home database for the current user. label:default-output[] + +[NOTE] +==== +Not returned by `SHOW HOME DATABASE` or `SHOW DEFAULT DATABASE`. +==== +| BOOLEAN + +| `currentPrimariesCount` +| Number of primaries for this database reported as running currently. +It is the same as the number of rows where `role=primary` and `name=this database`. +| INTEGER + +| `currentSecondariesCount` +| Number of secondaries for this database reported as running currently. +It is the same as the number of rows where `role=secondary` and `name=this database`. +| INTEGER + +| `requestedPrimariesCount` +| The requested number of primaries for this database. +May be lower than current if the DBMS is currently reducing the number of copies of the database, or higher if it is currently increasing the number of copies. +| INTEGER + +| `requestedSecondariesCount` +| The requested number of secondaries for this database. +May be lower than current if the DBMS is currently reducing the number of copies of the database, or higher if it is currently increasing the number of copies. +| INTEGER + +| creationTime +| The date and time at which the database was created. +| DATETIME + +| lastStartTime +| The date and time at which the database was last started. +| DATETIME + +| lastStopTime +| The date and time at which the database was last stopped. +| DATETIME + +| store +a| +Information about the storage engine and the store format. + +The value is a string formatted as: + +[source, syntax, role="noheader"] +---- +{storage engine}-{store format}-{major version}.{minor version} +---- +| STRING + +| lastCommittedTxn +| The ID of the last transaction received. +| INTEGER + +| replicationLag +| +Number of transactions the current database is behind compared to the database on the primary instance. +The lag is expressed in negative integers. In standalone environments, the value is always `0`. +| INTEGER + +|constituents +|The names of any constituents the database may have. label:default-output[] +| LIST OF STRING + +|=== + + +.+SHOW DATABASES+ +====== + +A summary of all available databases can be displayed using the command `SHOW DATABASES`. + +.Query +[source, cypher] +---- +SHOW DATABASES +---- + +.Result +[role="queryresult",options="header,footer",cols="13* Composite database introduction]. + +Composite databases can be created using `CREATE COMPOSITE DATABASE`. + +Composite database names are subject to the same rules as xref:administration-databases-create-database[standard databases]. +One difference is however that the deprecated syntax using dots without enclosing the name in backticks is not available. +Both dots and dashes need to be enclosed within backticks when using composite databases. + +[NOTE] +==== +Having dots (`.`) in the composite database names is not recommended. +This is due to the difficulty of determining if a dot is part of the composite database name or a delimiter for a database alias in a composite database. +==== + +.Query +[source, cypher] +---- +CREATE COMPOSITE DATABASE inventory +---- + +[role="statsonlyqueryresult"] +0 rows, System updates: 1 + +[NOTE] +==== +Composite database names are subject to the same rules as standard databases. +One difference is however that the deprecated syntax using dots without enclosing the name in backticks is not available. +Both dots and dashes needs to be enclosed within backticks when using composite databases. + + +==== + +When a composite database has been created, it will show up in the listing provided by the command `SHOW DATABASES`. + + +.Query +[source, cypher] +---- +SHOW DATABASES YIELD name, type, access, role, writer, constituents +---- + +.Result +[role="queryresult",options="header,footer",cols="6*+ | +false+ | +[]+ +| +"library"+ | +"composite"+ | +"read-only"+ | ++ | +false+ | +["library.sci-fi","library.romance"]+ +| +"movies"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +| +"neo4j"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +| +"romance"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +| +"sci-fi-books"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +| +"system"+ | +"system"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +| +"topology-example"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ +6+d|Rows: 8 +|=== + +In order to create database aliases in the composite database, give the composite database as namespace for the alias. +For information about creating aliases in composite databases, see xref:administration/aliases.adoc#alias-management-create-composite-database-alias[here]. + + +[role=enterprise-edition not-on-aura] +[[administration-databases-create-database-existing]] +=== Handling Existing Databases + +These commands are optionally idempotent, with the default behavior to fail with an error if the database already exists. +Appending `IF NOT EXISTS` to the command ensures that no error is returned and nothing happens should the database already exist. +Adding `OR REPLACE` to the command will result in any existing database being deleted and a new one created. + +These behavior flags apply to both standard and composite databases (e.g. a composite database may replace a standard one or another composite.) + + +.+CREATE DATABASE+ +====== + +.Query +[source, cypher] +---- +CREATE COMPOSITE DATABASE customers IF NOT EXISTS +---- + + +====== + + +.+CREATE OR REPLACE DATABASE+ +====== + +.Query +[source, cypher] +---- +CREATE OR REPLACE DATABASE customers +---- + +This is equivalent to running `DROP DATABASE customers IF EXISTS` followed by `CREATE DATABASE customers`. + +[NOTE] +==== +The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together. +==== + +====== + + +[role=enterprise-edition not-on-aura] +[[administration-databases-create-database-options]] +=== Options + +The `CREATE DATABASE` command can have a map of options, e.g. `OPTIONS {key: 'value'}`. + +[NOTE] +==== +There are no available `OPTIONS` values for composite databases. +==== + + +[options="header"] +|=== + +| Key | Value | Description + +| `existingData` +| `use` +| +Controls how the system handles existing data on disk when creating the database. +Currently this is only supported with `existingDataSeedInstance` and must be set to `use` which indicates the existing data files should be used for the new database. + +| `existingDataSeedInstance` +| instance ID of the cluster node +| +Defines which instance is used for seeding the data of the created database. +The instance id can be taken from the id column of the `dbms.cluster.overview()` procedure. Can only be used in clusters. + +| `seedURI` +| URI to a backup or a dump from an existing database. +| +Defines an identical seed from an external source which will be used to seed all servers. + +| `seedConfig` +| comma separated list of configuration values. +| +Defines additional configuration specified by comma separated `name=value` pairs that might be required by certain seed providers. + +| `seedCredentials` +| credentials +| +Defines credentials that needs to be passed into certain seed providers. + +|=== + + +[NOTE] +==== +The `existingData`, `existingDataSeedInstance`, `seedURI`, `seedConfig` and `seedCredentials` options cannot be combined with the `OR REPLACE` part of this command. +For details about the use of these seeding options, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/clustering/databases/#cluster-seed[Operations Manual -> Seed a cluster]. +==== + + +[role=enterprise-edition not-on-aura] +[[administration-databases-alter-database]] +== Altering databases + +Standard databases can be modified using the command `ALTER DATABASE`. + +[role=enterprise-edition not-on-aura] +[[administration-databases-alter-database-access]] +=== Access + +By default, a database has read-write access mode on creation. +The database can be limited to read-only mode on creation using the configuration parameters `dbms.databases.default_to_read_only`, `dbms.databases.read_only`, and `dbms.database.writable`. +For details, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/manage-databases/configuration#manage_database_parameters[Configuration parameters]. + +A database that was created with read-write access mode can be changed to read-only. +To change it to read-only, you can use the `ALTER DATABASE` command with the sub-clause `SET ACCESS READ ONLY`. +Subsequently, the database access mode can be switched back to read-write using the sub-clause `SET ACCESS READ WRITE`. +Altering the database access mode is allowed at all times, whether a database is online or offline. + +If conflicting modes are set by the `ALTER DATABASE` command and the configuration parameters, i.e. one says read-write and the other read-only, the database will be read-only and prevent write queries. + +[NOTE] +==== +Modifying access mode is only available to standard databases and not composite databases. +==== + + +.+ALTER DATABASE+ +====== + +.Query +[source, cypher] +---- +ALTER DATABASE customers SET ACCESS READ ONLY +---- + +.Result +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +====== + + +.+SHOW DATABASES+ +====== + +The database access mode can be seen in the `access` output column of the command `SHOW DATABASES`. + +.Query +[source, cypher] +---- +SHOW DATABASES yield name, access +---- + +.Result +[role="queryresult",options="header,footer",cols="2* Alter topology] for more information. +==== + + +.+SHOW DATABASE+ +====== + +.Query +[source, cypher] +---- +SHOW DATABASES yield name, currentPrimariesCount, currentSecondariesCount, requestedPrimariesCount, requestedSecondariesCount +---- + +====== + +For more details on primary and secondary server roles, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/clustering/introduction#clustering-introduction-operational[Operations Manual -> Clustering overview]. + +[NOTE] +==== +Modifying database topology is only available to standard databases and not composite databases. +==== + +`ALTER DATABASE` commands are optionally idempotent, with the default behavior to fail with an error if the database does not exist. +Appending `IF EXISTS` to the command ensures that no error is returned and nothing happens should the database not exist. + +.Query +[source, cypher] +---- +ALTER DATABASE nonExisting IF EXISTS SET TOPOLOGY 1 PRIMARY 0 SECONDARY +---- + +[role="statsonlyqueryresult"] +0 rows + + +[role=enterprise-edition not-on-aura] +[[administration-databases-stop-database]] +== Stopping databases + +Databases can be stopped using the command `STOP DATABASE`. + + +.+STOP DATABASE+ +====== + +.Query +[source, cypher] +---- +STOP DATABASE customers +---- + +.Result +[source, result, role="noheader"] +---- +System updates: 1 +Rows: 0 +---- + +[NOTE] +==== +Both standard databases and composite databases can be stopped using this command. +==== + +====== + + +.+SHOW DATABASE+ +====== + +The status of the stopped database can be seen using the command `SHOW DATABASE name`. + +.Query +[source, cypher] +---- +SHOW DATABASE customers YIELD name, requestedStatus, currentStatus +---- + +.Result +[role="queryresult",options="header,footer",cols="3*/data/dumps`). +This can be achieved by appending `DUMP DATA` to the command (or `DESTROY DATA` to explicitly request the default behavior). +These dumps are equivalent to those produced by `neo4j-admin dump` and can be similarly restored using `neo4j-admin load`. + +.Query +[source, cypher] +---- +DROP DATABASE `topology-example` DUMP DATA +---- + +The options `IF EXISTS` and `DUMP DATA`/ `DESTROY DATA` can also be combined. +An example could look like this: + +.Query +[source, cypher] +---- +DROP DATABASE customers IF EXISTS DUMP DATA +---- + +====== + +It is also possible to ensure that only composite databases are dropped. A `DROP COMPOSITE` request would then fail if the targeted database is a standard database. + +.+DROP COMPOSITE DATABASE+ +====== + +.Query +[source, cypher] +---- +DROP COMPOSITE DATABASE inventory +---- + +[role="statsonlyqueryresult"] +0 rows, System updates: 1 + +To ensure the database to be dropped is standard and not composite, the user first needs to check the `type` column of `SHOW DATABASES` manually. + +====== + + +[role=enterprise-edition not-on-aura] +[[administration-wait-nowait]] +== Wait options + +Aside from `SHOW DATABASES` and `ALTER DATABASE`, all database management commands accept an optional `WAIT`/`NOWAIT` clause. +The `WAIT`/`NOWAIT` clause allows you to specify a time limit in which the command must complete and return. + +The options are: + +* `WAIT n SECONDS` - Return once completed or when the specified time limit of `n` seconds is up. +* `WAIT` - Return once completed or when the default time limit of 300 seconds is up. +* `NOWAIT` - Return immediately. + +A command using a `WAIT` clause will automatically commit the current transaction when it executes successfully, as the command needs to run immediately for it to be possible to `WAIT` for it to complete. +Any subsequent commands executed will therefore be performed in a new transaction. +This is different to the usual transactional behavior, and for this reason it is recommended that these commands be run in their own transaction. +The default behavior is `NOWAIT`, so if no clause is specified the transaction will behave normally and the action is performed in the background post-commit. + +[NOTE] +==== +A command with a `WAIT` clause may be interrupted whilst it is waiting to complete. +In this event the command will continue to execute in the background and will not be aborted. +==== + + +.+CREATE DATABASE+ +====== + +.Query +[source, cypher] +---- +CREATE DATABASE slow WAIT 5 SECONDS +---- + +.Result +[role="queryresult",options="header,footer",cols="4*>>>>>> 16e3680 (New Administration chapter (#504)) diff --git a/modules/ROOT/pages/administration/servers.adoc b/modules/ROOT/pages/administration/servers.adoc new file mode 100644 index 000000000..6b5f13d5b --- /dev/null +++ b/modules/ROOT/pages/administration/servers.adoc @@ -0,0 +1,441 @@ +:description: This section explains how to use Cypher to manage servers in Neo4j. +[role=enterprise-edition] +[[server-management]] += Server management + +Servers can be added and managed using a set of Cypher administration commands executed against the `system` database. + +When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. + + +[[server-management-syntax]] +== Server management command syntax + +[NOTE] +==== +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +==== + +[cols="<15s,<85"] +|=== +| Command +m| ENABLE SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +ENABLE SERVER 'serverId' [OPTIONS "{" option: value[,...] "}"] +---- + +| Description +a| Adds a server that has been discovered to the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| ALTER SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +ALTER SERVER 'name' SET OPTIONS "{" option: value[,...] "}" +---- + +| Description +a| Changes the constraints for a server. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| RENAME SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +RENAME SERVER 'name' TO 'newName' +---- + +| Description +a| Changes the name of a server. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| REALLOCATE DATABASES + +| Syntax +a| +[source, syntax, role=noheader] +---- +[DRYRUN] REALLOCATE DATABASE[S] +---- + +| Description +a| Re-balances databases among the servers in the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| DEALLOCATE DATABASES + +| Syntax +a| +[source, syntax, role=noheader] +---- +[DRYRUN] DEALLOCATE DATABASE[S] FROM SERVER[S] 'name'[, ...] +---- + +| Description +a| Removes all databases from the given servers. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| DROP SERVER + +| Syntax +a| +[source, syntax, role=noheader] +---- +DROP SERVER 'name' +---- + +| Description +a| Removes a server not hosting any databases from the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SERVER MANAGEMENT` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[cols="<15s,<85"] +|=== +| Command +m| SHOW SERVERS + +| Syntax +a| +[source, syntax, role=noheader] +---- +SHOW SERVER[S] + [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] + [WHERE expression] + [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] +---- + +| Description +a| Lists all servers visible to the cluster. +For more information see <>. + +| Required privilege +a| `GRANT SHOW SERVERS` + +(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) +|=== + +[[server-management-show-servers]] +== Listing servers + +`SHOW SERVERS` displays all servers running in the cluster, including servers that have yet to be enabled as well as dropped servers. + +The table of results shows information about the servers: + +[options="header", width="100%", cols="2a,4,2m,1,1"] +|=== +| Column +| Description +| Type +| Default output +| Full output + +| name +| Name of the server. +| STRING +| {check-mark} +| {check-mark} + +| serverId +| Id of the server. +| STRING +| +| {check-mark} + +| address +| Bolt address of the server (if enabled). +| STRING +| {check-mark} +| {check-mark} + +| httpAddress +| Http address of the server (if enabled). +| STRING +| +| {check-mark} + +| httpsAddress +| Https address of the server (if enabled). +| STRING +| +| {check-mark} + +| state +| Information of the state of the server: `free`, `enabled`, `deallocating`, or `dropped`. +| STRING +| {check-mark} +| {check-mark} + +| health +| The availability of the server: `available` or `unavailable`. +| STRING +| {check-mark} +| {check-mark} + +| hosting +| A list of databases currently hosted on the server. +| LIST OF STRING +| {check-mark} +| {check-mark} + +| requestedHosting +| A list of databases that should be hosted on the server, decided by the allocator. +| LIST OF STRING +| +| {check-mark} + +| tags +| Tags are user provided strings that can be used while allocating databases. +| LIST OF STRING +| +| {check-mark} + +| allowedDatabases +| A list of databases allowed to be hosted on the server. +| LIST OF STRING +| +| {check-mark} + +| deniedDatabases +| A list of databases not allowed to be hosted on the server. +| LIST OF STRING +| +| {check-mark} + +| modeConstraint +| Constraint for the allocator to allocate only databases in this mode on the server. +| STRING +| +| {check-mark} + +| version +| Neo4j version the server is running. +| STRING +| +| {check-mark} +|=== + +A summary of all servers can be displayed using the command `SHOW SERVERS`. + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m"] +|=== +|name|address|state|health|hosting + +| "server1" | "localhost:20000" | "Enabled" | "Available" | ["system","neo4j"] +| "server2" | "localhost:20007" | "Enabled" | "Available" | ["system","neo4j"] +| "server3" | "localhost:20014" | "Enabled" | "Available" | ["system","neo4j"] +| "0c030000-267b-49a8-801f-78bd0b5c6445" | "localhost:20021" | "Free" | "Available" | ["system"] +|=== + +[role=not-on-aura] +[[server-management-enable-server]] +== Enabling servers + +A server can be added to the cluster with the `ENABLE SERVER 'name'` command. +The servers initial name is its id. +The server must be in the `free` state to be added to the cluster. +If the server is already `enabled` and the command is executed with the same options specified nothing is changed. +In any other case trying to enable a server fails. + +The possible options allowed when enabling a server are: + +[options="header", width="100%", cols="2a,2,^.^"] +|=== +| Option +| Allowed values +| Description + +| modeConstraint +| `PRIMARY`, `SECONDARY`, `NONE` +| Databases may only be hosted on the server in the mode specified by the constraint. +`None` means there is no constraint and any mode is allowed. + +| allowedDatabases +| list of database names +| Only databases matching the specified names may be hosted on the server. +This may not be specified in combination with `deniedDatabases`. + +| deniedDatabases +| list of database names +| Only databases **not** matching the specified names may be hosted on the server. +This may not be specified in combination with `allowedDatabases`. + +| tags +| list of server tags +| List of server tags used during database allocation and for load balancing and routing policies. +|=== + +[NOTE] +==== +Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. +The composite databases are available everywhere and hold no data on their own. +==== + +[NOTE] +==== +When a server is enabled, if `tags` are not provided in `OPTIONS`, the default server tags are taken from the setting `initial.server.tags`. +==== + +[role=not-on-aura] +[[server-management-alter-server]] +== Modifying servers + +The constraints on a server can be changed with `ALTER SERVER 'name' SET OPTIONS { option: value }`. +Either the name or the id of the server can be used. + +The possible options allowed when altering a server are: + +[options="header", width="100%", cols="2a,2,^.^"] +|=== +| Option +| Allowed values +| Description + +| modeConstraint +| `PRIMARY`, `SECONDARY`, `NONE` +| Databases may only be hosted on the server in the mode specified by the constraint. +`None` means there is no constraint and any mode is allowed. + +| allowedDatabases +| list of database names +| Only databases matching the specified names may be hosted on the server. +This may not be specified in combination with `deniedDatabases`. + +| deniedDatabases +| list of database names +| Only databases **not** matching the specified names may be hosted on the server. +This may not be specified in combination with `allowedDatabases`. + +| tags +| list of server tags +| List of server tags used during database allocation and for load balancing and routing policies. +|=== + +[NOTE] +==== +Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. +The composite databases are available everywhere and hold no data on their own. +==== + +[NOTE] +==== +Input provided to `SET OPTIONS {...}` replaces **all** existing options, rather than being combined with them. +For instance, if `SET OPTIONS {modeConstraint:'SECONDARY'}` is run followed by `SET OPTIONS {allowedDatabases:['foo']}`, the second `ALTER` removes the mode constraint. +==== + +[[server-management-rename-server]] +== Renaming servers + +The name of a server can be altered with `RENAME SERVER 'name' TO 'newName'`. +Either the id or current name of the server can be used to identify the server. +The new name of the server must be unique. + +[[server-management-reallocate]] +== Reallocate databases + +After enabling a server, `REALLOCATE DATABASES` can be used to make the cluster re-balance databases across all servers that are part of the cluster. +Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|database|fromServerName|fromServerId|toServerName|toServerId|mode + +| "db1" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-4" | "00000002-25a9-4984-9ad2-dc39024c9238" | "primary" +| "db3" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-5" | "00000003-0df7-4057-81fd-1cf43c9ef5f7" | "primary" +|=== + +[NOTE] +==== +`DRYRUN` is introduced in Neo4j 5.2, and thus is not available in earlier minor releases of v5. +==== + +[role=not-on-aura] +[[server-management-deallocate]] +== Deallocate databases + +A server can be set to not host any databases with `DEALLOCATE DATABASES FROM SERVER 'name'`, in preparation for removing the server from the cluster. +Either the id or name of the server can be used. +All databases that the server is hosting are moved to other servers. +The server changes state to `deallocating`. +A deallocated server cannot readily be enabled again. + +Multiple servers can be deallocated at the same time, `DEALLOCATE DATABASES FROM SERVER 'server-1', 'server-2'`. +The command fails if there aren't enough servers available to move the databases to. + +Using `DRYRUN DEALLOCATE DATABASES FROM 'server-1', 'server-2'` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: + +.Result +[options="header,footer", width="100%", cols="m,m,m,m,m,m"] +|=== +|database|fromServerName|fromServerId|toServerName|toServerId|mode +| "db1" | "server-1" | "00000001-8c04-4731-a2fd-7b0289c511ce" | "server-4" | "00000002-5b91-43c1-8b25-5289f674563e" | "primary" +| "db1" | "server-2" | "00000000-7e53-427c-a987-24634c4745f3" | "server-5" | "00000003-0e98-44c8-9844-f0a4eb95b0d8" | "primary" +|=== + +[role=not-on-aura] +[[server-management-drop-server]] +== Drop server + +When a server has been deallocated and is no longer hosting any databases it can be removed from the cluster with `DROP SERVER 'name'`. +Either the id or name of the server can be used. +As long as the server is running, it is listed when showing servers with the state `dropped`. diff --git a/modules/ROOT/pages/clauses/listing-functions.adoc b/modules/ROOT/pages/clauses/listing-functions.adoc index 59ce2a0e9..b0353c56d 100644 --- a/modules/ROOT/pages/clauses/listing-functions.adoc +++ b/modules/ROOT/pages/clauses/listing-functions.adoc @@ -81,7 +81,11 @@ m| STRING [NOTE] ==== +<<<<<<< HEAD More details about the syntax descriptions can be found link:{neo4j-docs-base-uri}/operations-manual/current/database-administration/syntax/#administration-syntax-reading[here]. +======= +More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. +>>>>>>> 16e3680 (New Administration chapter (#504)) ==== List functions, either all or only built-in or user-defined:: From e0c40cdff467ddb4d98d15116179ff6ada8f2378 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Thu, 20 Apr 2023 11:58:28 +0200 Subject: [PATCH 22/32] Merge 5.7 PRs to 5.x (#519) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Satia Herfert Co-authored-by: Hannes Sandberg Co-authored-by: Nacho Cordón Co-authored-by: Therese Magnusson Co-authored-by: Pontus Melke --- .../ROOT/pages/administration/databases.adoc | 3 +- modules/ROOT/pages/clauses/call-subquery.adoc | 255 +++++++++++++++++- modules/ROOT/pages/clauses/merge.adoc | 1 - 3 files changed, 249 insertions(+), 10 deletions(-) diff --git a/modules/ROOT/pages/administration/databases.adoc b/modules/ROOT/pages/administration/databases.adoc index 41ad9a00e..5f26bcf04 100644 --- a/modules/ROOT/pages/administration/databases.adoc +++ b/modules/ROOT/pages/administration/databases.adoc @@ -93,6 +93,7 @@ ALTER DATABASE name [IF EXISTS] SET ACCESS {READ ONLY \| READ WRITE} \| SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] } +[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ---- | STOP DATABASE @@ -1125,7 +1126,7 @@ To ensure the database to be dropped is standard and not composite, the user fir [[administration-wait-nowait]] == Wait options -Aside from `SHOW DATABASES` and `ALTER DATABASE`, all database management commands accept an optional `WAIT`/`NOWAIT` clause. +Aside from `SHOW DATABASES`, all database management commands accept an optional `WAIT`/`NOWAIT` clause. The `WAIT`/`NOWAIT` clause allows you to specify a time limit in which the command must complete and return. The options are: diff --git a/modules/ROOT/pages/clauses/call-subquery.adoc b/modules/ROOT/pages/clauses/call-subquery.adoc index 34dd53746..e973adc66 100644 --- a/modules/ROOT/pages/clauses/call-subquery.adoc +++ b/modules/ROOT/pages/clauses/call-subquery.adoc @@ -415,6 +415,11 @@ RETURN p.name, youngerPersonsCount Subqueries can be made to execute in separate, inner transactions, producing intermediate commits. This can come in handy when doing large write operations, like batch updates, imports, and deletes. To execute a subquery in separate transactions, you add the modifier `IN TRANSACTIONS` after the subquery. +An outer transaction is opened to report back the accumulated statistics for the inner transactions +(created and deleted nodes, relationships, etc) and it will succeed or fail depending on the results +of those inner transactions. +For more information, see <>. +Canceling that outer transaction will cancel the inner ones. The following example uses a CSV file and the `LOAD CSV` clause to import more data to the example graph. It creates nodes in separate transactions using `+CALL { ... } IN TRANSACTIONS+`: @@ -435,7 +440,7 @@ It creates nodes in separate transactions using `+CALL { ... } IN TRANSACTIONS+` LOAD CSV FROM 'file:///friends.csv' AS line CALL { WITH line - CREATE (:PERSON {name: line[1], age: toInteger(line[2])}) + CREATE (:Person {name: line[1], age: toInteger(line[2])}) } IN TRANSACTIONS ---- @@ -601,15 +606,20 @@ The batch size of `2 ROWS` is an example given the small data set used here. For larger data sets, you might want to use larger batch sizes, such as `10000 ROWS`. ==== +=== Error behaviour [[txs_error_behaviour]] +Users can choose one of three different option flags to control the behaviour +in case of an error occurring in any of the inner transactions of `+CALL { ... } IN TRANSACTIONS+`: -=== Errors - -If an error occurs in `+CALL { ... } IN TRANSACTIONS+` the entire query fails and -both the current inner transaction and the outer transaction are rolled back. +* `ON ERROR CONTINUE` to ignore a recoverable error and continue the execution of subsequent inner transactions. +The outer transaction succeeds. +It will cause the expected variables from the failed inner query to be bound as null for that specific transaction. +* `ON ERROR BREAK` to ignore a recoverable error and stop the execution of subsequent inner transactions. The outer transaction succeeds. +It will cause expected variables from the failed inner query to be bound as null for all onward transactions (including the failed one). +* `ON ERROR FAIL` to acknowledge a recoverable error and stop the execution of subsequent inner transactions. The outer transaction fails. This is the default behaviour if no flag is explicitly specified. [IMPORTANT] ==== -On error, any previously committed inner transactions remain committed, and are not rolled back. +On error, any previously committed inner transactions remain committed, and are not rolled back. Any failed inner transactions are rolled back. ==== In the following example, the last subquery execution in the second inner transaction fails @@ -621,7 +631,7 @@ due to division by zero. UNWIND [4, 2, 1, 0] AS i CALL { WITH i - CREATE (:Example {num: 100/i}) + CREATE (:Person {num: 100/i}) } IN TRANSACTIONS OF 2 ROWS RETURN i ---- @@ -637,7 +647,7 @@ When the failure occurred, the first transaction had already been committed, so .Query [source, cypher] ---- -MATCH (e:Example) +MATCH (e:Person) RETURN e.num ---- @@ -650,6 +660,235 @@ RETURN e.num 1+d|Rows: 2 |=== +In the following example, `ON ERROR CONTINUE` is used after a failed inner transaction to execute the remaining inner transactions and not fail the outer transaction: + +.Query +[source, cypher] +---- +UNWIND [1, 0, 2, 4] AS i +CALL { + WITH i + CREATE (n:Person {num: 100/i}) // Note, fails when i = 0 + RETURN n +} IN TRANSACTIONS + OF 1 ROW + ON ERROR CONTINUE +RETURN n.num; +---- + +.Result +[role="queryresult",options="header,footer",cols="1*>. + +After each execution of the inner query finishes (successfully or not), a status value is created that records information about the execution and the transaction that executed it: + +* If the inner execution produces one or more rows as output, then a binding to this status value is added to each row, under the selected variable name. +* If the inner execution fails then a single row is produced containing a binding to this status value under the selected variable, and null bindings for all variables that should have been returned by the inner query (if any). + +The status value is a map value with the following fields: + +* `started`: `true` when the inner transaction was started, `false` otherwise. +* `committed`, true when the inner transaction changes were successfully committed, false otherwise. +* `transactionId`: the inner transaction id, or null if the transaction was not started. +* `errorMessage`, the inner transaction error message, or null in case of no error. + +Example of reporting status with `ON ERROR CONTINUE`: + +.Query +[source, cypher, indent=0, role=test-result-skip] +---- +UNWIND [1, 0, 2, 4] AS i +CALL { + WITH i + CREATE (n:Person {num: 100/i}) // Note, fails when i = 0 + RETURN n +} IN TRANSACTIONS + OF 1 ROW + ON ERROR CONTINUE + REPORT STATUS AS s +RETURN n.num, s; +---- + +.Result +[role="queryresult",options="header,footer",cols="2*(wallStreet:Movie {title: 'Wall Street'}) RETURN charlie.name, type(r), wallStreet.title ---- - This is due to the all-or-nothing semantics of `MERGE`, which causes the query to fail if there exists a relationship with the given `year` property but there is no match for the full pattern. In this example, since no match was found for the pattern, `MERGE` will try to create the full pattern including a relationship with `{year: 1987}`, which will lead to constraint violation error. From 13b07455f366cc80af67873e4bad108961bdfe2b Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Fri, 12 May 2023 13:57:36 +0100 Subject: [PATCH 23/32] update all links to configs (#553) Cherry-picked from #552 --- modules/ROOT/pages/administration/aliases.adoc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/ROOT/pages/administration/aliases.adoc b/modules/ROOT/pages/administration/aliases.adoc index 35f7b1f0e..6318c0511 100644 --- a/modules/ROOT/pages/administration/aliases.adoc +++ b/modules/ROOT/pages/administration/aliases.adoc @@ -148,7 +148,7 @@ A timeout of zero is treated as an infinite timeout and will be bound by the tim | Duration | Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout] +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout] |=== @@ -168,7 +168,7 @@ It is recommended to set maximum lifetime to a slightly smaller value than the o Zero and negative values result in lifetime not being checked. | Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime] +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime] |=== @@ -188,7 +188,7 @@ Negative values are allowed and result in unlimited acquisition timeout. Value of `0` is allowed and results in no timeout and immediate failure when connection is unavailable. | Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout] +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout] |=== @@ -208,7 +208,7 @@ Negative values are allowed and result in unlimited pool. Value of `0` is not allowed. | Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size] +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size] |=== @@ -225,7 +225,7 @@ Value of `0` is not allowed. One of `DEBUG`, `INFO`, `WARN`, `ERROR`, or `NONE`. | Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/reference/configuration-settings#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level] +| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level] |=== From fa7cb9172e2c48ebcfe61612900f4aee93b2a5d9 Mon Sep 17 00:00:00 2001 From: David Oliver Date: Tue, 16 May 2023 16:31:07 +0100 Subject: [PATCH 24/32] Add 5.8 documentation for publication (#559) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Jens Pryce-Ã…klundh <112686610+JPryce-Aklundh@users.noreply.github.com> Co-authored-by: Bastien Louërat Co-authored-by: Therese Magnusson Co-authored-by: Lasse Heemann --- .../access-control/dbms-administration.adoc | 2 ++ .../ROOT/pages/administration/databases.adoc | 4 +++- .../ROOT/pages/administration/servers.adoc | 9 +++++---- modules/ROOT/pages/clauses/call-subquery.adoc | 3 +++ modules/ROOT/pages/constraints/syntax.adoc | 1 + ...ions-additions-removals-compatibility.adoc | 20 +++++++++++++++++++ 6 files changed, 34 insertions(+), 5 deletions(-) diff --git a/modules/ROOT/pages/administration/access-control/dbms-administration.adoc b/modules/ROOT/pages/administration/access-control/dbms-administration.adoc index 900c30032..af66a453b 100644 --- a/modules/ROOT/pages/administration/access-control/dbms-administration.adoc +++ b/modules/ROOT/pages/administration/access-control/dbms-administration.adoc @@ -1959,6 +1959,8 @@ a|Rows: 2 [[access-control-dbms-administration-setting]] == The DBMS `SETTING` privileges +_This feature was introduced in Neo4j 5.6._ + The ability to show configuration settings can be granted via the `SHOW SETTING` privilege. A role with this privilege is allowed to query the configuration settings matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. diff --git a/modules/ROOT/pages/administration/databases.adoc b/modules/ROOT/pages/administration/databases.adoc index 5f26bcf04..2bd9f67d6 100644 --- a/modules/ROOT/pages/administration/databases.adoc +++ b/modules/ROOT/pages/administration/databases.adoc @@ -309,7 +309,7 @@ If a user has not been granted `ACCESS` privilege to any databases nor any of th ==== [NOTE] ==== -Databases hosted on servers that are offline are also returned by the `SHOW DATABASES` command. +As of Neo4j 5.3, databases hosted on servers that are offline are also returned by the `SHOW DATABASES` command. For such databases, the `address` column displays `NULL`, the `currentStatus` column displays `unknown`, and the `statusMessage` displays `Server is unavailable`. ==== @@ -1126,6 +1126,8 @@ To ensure the database to be dropped is standard and not composite, the user fir [[administration-wait-nowait]] == Wait options +_The_ `WAIT` _subclause was added as an option to the_ `ALTER DATABASE` _command in Neo4j 5.7._ + Aside from `SHOW DATABASES`, all database management commands accept an optional `WAIT`/`NOWAIT` clause. The `WAIT`/`NOWAIT` clause allows you to specify a time limit in which the command must complete and return. diff --git a/modules/ROOT/pages/administration/servers.adoc b/modules/ROOT/pages/administration/servers.adoc index 6b5f13d5b..8b7a3949d 100644 --- a/modules/ROOT/pages/administration/servers.adoc +++ b/modules/ROOT/pages/administration/servers.adoc @@ -322,6 +322,7 @@ This may not be specified in combination with `allowedDatabases`. | tags | list of server tags | List of server tags used during database allocation and for load balancing and routing policies. +label:new[Introduced in 5.6] |=== [NOTE] @@ -368,6 +369,7 @@ This may not be specified in combination with `allowedDatabases`. | tags | list of server tags | List of server tags used during database allocation and for load balancing and routing policies. +label:new[Introduced in 5.6] |=== [NOTE] @@ -392,9 +394,12 @@ The new name of the server must be unique. [[server-management-reallocate]] == Reallocate databases +_The_ `DRYRUN` _feature was introduced in Neo4j 5.2._ + After enabling a server, `REALLOCATE DATABASES` can be used to make the cluster re-balance databases across all servers that are part of the cluster. Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: + .Result [options="header,footer", width="100%", cols="m,m,m,m,m,m"] |=== @@ -404,10 +409,6 @@ Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would hav | "db3" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-5" | "00000003-0df7-4057-81fd-1cf43c9ef5f7" | "primary" |=== -[NOTE] -==== -`DRYRUN` is introduced in Neo4j 5.2, and thus is not available in earlier minor releases of v5. -==== [role=not-on-aura] [[server-management-deallocate]] diff --git a/modules/ROOT/pages/clauses/call-subquery.adoc b/modules/ROOT/pages/clauses/call-subquery.adoc index e973adc66..caf00c8de 100644 --- a/modules/ROOT/pages/clauses/call-subquery.adoc +++ b/modules/ROOT/pages/clauses/call-subquery.adoc @@ -607,6 +607,9 @@ For larger data sets, you might want to use larger batch sizes, such as `10000 R ==== === Error behaviour [[txs_error_behaviour]] + +_This feature was introduced in Neo4j 5.7._ + Users can choose one of three different option flags to control the behaviour in case of an error occurring in any of the inner transactions of `+CALL { ... } IN TRANSACTIONS+`: diff --git a/modules/ROOT/pages/constraints/syntax.adoc b/modules/ROOT/pages/constraints/syntax.adoc index 79756e280..b67bf8aec 100644 --- a/modules/ROOT/pages/constraints/syntax.adoc +++ b/modules/ROOT/pages/constraints/syntax.adoc @@ -256,6 +256,7 @@ This is the default if none is given. |[PROPERTY] UNIQUE[NESS] | Returns all property uniqueness constraints, for both nodes and relationships. +_This feature was introduced in Neo4j 5.3._ |NODE [PROPERTY] EXIST[ENCE] | Returns the node property existence constraints. diff --git a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc index 029336e67..2566d5773 100644 --- a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc +++ b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc @@ -2288,6 +2288,7 @@ The existing `UNIQUENESS` filter will now return both node and relationship prop === New features + [cols="2", options="header"] |=== | Feature @@ -2388,6 +2389,25 @@ New privilege that controls a user's access to desired configuration settings. [[cypher-deprecations-additions-removals-5.5]] == Neo4j 5.5 +=== New features + +[cols="2", options="header"] +|=== +| Feature +| Details + +a| +label:functionality[] +label:new[] + +New operator: `IntersectionNodeByLabelsScan` + +a| +The `IntersectionNodeByLabelsScan` operator fetches all nodes that have all of the provided labels from the node label index. +More information can be found xref::execution-plans/operators.adoc#query-plan-intersection-node-by-labels-scan[here]. + +|=== + === Deprecated features [cols="2", options="header"] From bc8a197d9cb78363e9473d1f3305f492f45a8203 Mon Sep 17 00:00:00 2001 From: Neil Dewhurst Date: Wed, 17 May 2023 13:05:53 +0100 Subject: [PATCH 25/32] Add NODES 23 ad (#561) --- preview.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/preview.yml b/preview.yml index b70cd4e8a..ec69d8afd 100644 --- a/preview.yml +++ b/preview.yml @@ -53,3 +53,10 @@ asciidoc: cross-mark: icon:times[] neo4j-base-uri: https://neo4j.com neo4j-docs-base-uri: https://neo4j.com/docs + page-ad-overline-link: https://r.neo4j.com/nodes-2023 + page-ad-overline: 26 October 2023 + page-ad-title: NODES 23 + page-ad-description: Join us for the biggest graph community conference dedicated to learning how to integrate graph technologies into ML and dev projects. + page-ad-link: https://neo4j.registration.goldcast.io/events/6fb85147-ca27-4310-9dec-cb345c53bd6f + page-ad-underline-role: button + page-ad-underline: Save your spot From 73bd1307e141ad32781510278e3a7ab76435a9af Mon Sep 17 00:00:00 2001 From: Neil Dewhurst Date: Mon, 22 May 2023 10:46:43 +0100 Subject: [PATCH 26/32] 5.8 dev reconciliation (#564) This PR updates 5.x with updates from PRs into dev that were not cherry-picked into 5.x at any point. While it looks like a lot of commits were missing, in the end it amounts to changes in 14 files, some of which are trivial and do not affect the content or output. I'd be happy to use 'squash and merge' to reduce this update to a single commit in 5.x --- README.adoc | 1 - .../access-control/built-in-roles.adoc | 3 +- .../access-control/manage-users.adoc | 1 + .../ROOT/pages/administration/aliases.adoc | 6 +++ .../ROOT/pages/administration/databases.adoc | 9 ----- modules/ROOT/pages/functions/list.adoc | 39 +++++++++++++++++++ .../pages/introduction/cypher-overview.adoc | 9 +++++ 7 files changed, 56 insertions(+), 12 deletions(-) diff --git a/README.adoc b/README.adoc index 7c30b3327..d794ea363 100644 --- a/README.adoc +++ b/README.adoc @@ -40,7 +40,6 @@ To view the built site, launch a local server: . `npm start` . In a browser tab, go to `localhost:8000` - === Live preview When you run `npm start`, the project is monitored for updates to asciidoc files. diff --git a/modules/ROOT/pages/administration/access-control/built-in-roles.adoc b/modules/ROOT/pages/administration/access-control/built-in-roles.adoc index cd29e7da2..24ebdaf37 100644 --- a/modules/ROOT/pages/administration/access-control/built-in-roles.adoc +++ b/modules/ROOT/pages/administration/access-control/built-in-roles.adoc @@ -453,8 +453,7 @@ To restore the role to its original capabilities two steps are needed. First, execute `DROP ROLE admin`. Secondly, run these queries: -// we cannot test this right now cause we would delete the role the test user is logged with - +// cannot test as it would require deleting the role the test user is logged with [source, cypher, role=noplay test-skip] ---- CREATE ROLE admin diff --git a/modules/ROOT/pages/administration/access-control/manage-users.adoc b/modules/ROOT/pages/administration/access-control/manage-users.adoc index 3e1d7bba8..b1d25ee05 100644 --- a/modules/ROOT/pages/administration/access-control/manage-users.adoc +++ b/modules/ROOT/pages/administration/access-control/manage-users.adoc @@ -817,6 +817,7 @@ Users can change their password using `ALTER CURRENT USER SET PASSWORD`. The old password is required in addition to the new one, and either or both can be a string value or a string parameter. When a user executes this command it will change their password as well as set the `CHANGE NOT REQUIRED` flag. +// can't test, don't want to hardcode test user password [source, cypher, role=test-skip] ---- ALTER CURRENT USER diff --git a/modules/ROOT/pages/administration/aliases.adoc b/modules/ROOT/pages/administration/aliases.adoc index 6318c0511..708d3d79b 100644 --- a/modules/ROOT/pages/administration/aliases.adoc +++ b/modules/ROOT/pages/administration/aliases.adoc @@ -575,6 +575,7 @@ SHOW ALIAS `northwind` FOR DATABASE ====== Local database aliases can also be given properties. +These properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. .Query [source, cypher] @@ -761,6 +762,7 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD * .+Setting properties for remote database aliases+ ====== Just as the local database aliases, the remote database aliases can be given properties. +These properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. .Query [source, cypher] @@ -1083,6 +1085,8 @@ ALTER ALIAS `movie scripts` SET DATABASE PROPERTIES { nameContainsSpace: true } System updates: 1 Rows: 0 ---- + +The updated properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. ====== .+Altering local and remote aliases in composite databases+ @@ -1113,6 +1117,8 @@ System updates: 1 Rows: 0 ---- +The updated properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. + ====== The changes for all database aliases will show up in the `SHOW ALIASES FOR DATABASE` command. diff --git a/modules/ROOT/pages/administration/databases.adoc b/modules/ROOT/pages/administration/databases.adoc index 2bd9f67d6..708e31405 100644 --- a/modules/ROOT/pages/administration/databases.adoc +++ b/modules/ROOT/pages/administration/databases.adoc @@ -611,15 +611,6 @@ CREATE COMPOSITE DATABASE inventory [role="statsonlyqueryresult"] 0 rows, System updates: 1 -[NOTE] -==== -Composite database names are subject to the same rules as standard databases. -One difference is however that the deprecated syntax using dots without enclosing the name in backticks is not available. -Both dots and dashes needs to be enclosed within backticks when using composite databases. - - -==== - When a composite database has been created, it will show up in the listing provided by the command `SHOW DATABASES`. diff --git a/modules/ROOT/pages/functions/list.adoc b/modules/ROOT/pages/functions/list.adoc index 912f319e8..44c06ea4a 100644 --- a/modules/ROOT/pages/functions/list.adoc +++ b/modules/ROOT/pages/functions/list.adoc @@ -19,7 +19,11 @@ The following graph is used for the examples below: image::graph-list-functions.svg[Example graph connecting people after their roles as administrator, designer, and developer,role=popup,width=600] +<<<<<<< HEAD To recreate the graph, run the following query against an empty Neo4j database: +======= +To recreate the graph, run the following query in an empty Neo4j database: +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher, role=test-setup] ---- @@ -60,7 +64,10 @@ CREATE ====== .Query +<<<<<<< HEAD // tag::functions_list_keys[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Alice' @@ -74,8 +81,13 @@ A `LIST` containing the names of all the properties on the node bound to [role="queryresult",options="header,footer",cols="1*>>>>>> bec9309 (5.8 dev reconciliation (#564)) 1+d|Rows: 1 |=== @@ -109,7 +121,10 @@ A `LIST` containing the names of all the properties on the node bound to ====== .Query +<<<<<<< HEAD // tag::functions_list_labels[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Alice' @@ -157,7 +172,10 @@ A `LIST` containing all the labels of the node bound to `a` is returned. ====== .Query +<<<<<<< HEAD // tag::functions_list_nodes[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -208,7 +226,10 @@ The only exception where the range does not contain `start` are empty ranges. ====== .Query +<<<<<<< HEAD // tag::functions_list_range[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN range(0, 10), range(2, 18, 3), range(0, 5, -1) @@ -257,7 +278,10 @@ As such, Cypher's `reduce()` is analogous to the `fold` or `reduce` methods in f ====== .Query +<<<<<<< HEAD // tag::functions_list_reduce[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -305,7 +329,10 @@ The `age` property of all `NODE` values in the `PATH` are summed and returned as ====== .Query +<<<<<<< HEAD // tag::functions_list_relationships[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -354,7 +381,10 @@ A `LIST` containing all the `RELATIONSHIP` values in the `PATH` `p ====== .Query +<<<<<<< HEAD // tag::functions_list_reverse[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- WITH [4923,'abc',521, null, 487] AS ids @@ -391,7 +421,10 @@ RETURN reverse(ids) ====== .Query +<<<<<<< HEAD // tag::functions_list_tail[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Eskil' @@ -492,7 +525,10 @@ toBooleanList(['a string', true, 'false', null, ['A','B']]) as mixedList ====== .Query +<<<<<<< HEAD // tag::functions_list_to_float_list[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN toFloatList(null) as noList, @@ -542,7 +578,10 @@ toFloatList(['a string', 2.5, '3.14159', null, ['A','B']]) as mixedList ====== .Query +<<<<<<< HEAD // tag::functions_list_to_integer_list[] +======= +>>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN toIntegerList(null) as noList, diff --git a/modules/ROOT/pages/introduction/cypher-overview.adoc b/modules/ROOT/pages/introduction/cypher-overview.adoc index 865cde7bf..2f3e659eb 100644 --- a/modules/ROOT/pages/introduction/cypher-overview.adoc +++ b/modules/ROOT/pages/introduction/cypher-overview.adoc @@ -13,6 +13,15 @@ MERGE (keanu)-[:ACTED_IN]->(matrix) ---- //// +//// +[source, cypher, role=test-setup] +---- +MERGE (matrix:Movie {title: 'The Matrix', rating: 10}) +MERGE (keanu:Person {name: 'Keanu Reeves'}) +MERGE (keanu)-[:ACTED_IN]->(matrix) +---- +//// + == What is Cypher? Cypher is Neo4j’s declarative graph query language. From ccc5315a99db19446583ec03b71c511b2e93b398 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Pryce-=C3=85klundh?= <112686610+JPryce-Aklundh@users.noreply.github.com> Date: Tue, 23 May 2023 15:31:14 +0200 Subject: [PATCH 27/32] Reorder deprecations, additions and removals file to have consistent order on the subsections (#569) Original PR: https://github.com/neo4j/docs-cypher/pull/568 authored-by: Therese Magnusson --- ...ions-additions-removals-compatibility.adoc | 21 +------------------ 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc index 2566d5773..f21405589 100644 --- a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc +++ b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc @@ -2189,7 +2189,7 @@ The `trackedSince` column returns the time when usage statistics tracking starte | Feature | Details -a| +a| label:functionality[] label:new[] @@ -2389,25 +2389,6 @@ New privilege that controls a user's access to desired configuration settings. [[cypher-deprecations-additions-removals-5.5]] == Neo4j 5.5 -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:new[] - -New operator: `IntersectionNodeByLabelsScan` - -a| -The `IntersectionNodeByLabelsScan` operator fetches all nodes that have all of the provided labels from the node label index. -More information can be found xref::execution-plans/operators.adoc#query-plan-intersection-node-by-labels-scan[here]. - -|=== - === Deprecated features [cols="2", options="header"] From 978d6290562638bcda691e74d1955d98ea29915a Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 21 May 2025 11:53:42 +0200 Subject: [PATCH 28/32] fixing rebase --- modules/ROOT/content-nav.adoc | 18 +- .../access-control/built-in-roles.adoc | 500 ---- .../database-administration.adoc | 981 -------- .../access-control/dbms-administration.adoc | 2172 ----------------- .../administration/access-control/index.adoc | 37 - .../access-control/limitations.adoc | 337 --- .../access-control/manage-privileges.adoc | 1436 ----------- .../access-control/manage-roles.adoc | 816 ------- .../access-control/manage-users.adoc | 865 ------- .../access-control/privileges-immutable.adoc | 46 - .../access-control/privileges-reads.adoc | 189 -- .../access-control/privileges-writes.adoc | 407 --- .../ROOT/pages/administration/aliases.adoc | 1529 ------------ .../ROOT/pages/administration/databases.adoc | 1166 --------- modules/ROOT/pages/administration/index.adoc | 84 - .../ROOT/pages/administration/servers.adoc | 442 ---- .../gql-conformance/analogous-cypher.adoc | 3 +- .../pages/appendix/gql-conformance/index.adoc | 2 +- .../gql-conformance/supported-mandatory.adoc | 3 +- .../gql-conformance/supported-optional.adoc | 2 +- modules/ROOT/pages/clauses/call-subquery.adoc | 959 -------- .../ROOT/pages/clauses/listing-functions.adoc | 4 - modules/ROOT/pages/clauses/where.adoc | 4 - modules/ROOT/pages/constraints/syntax.adoc | 3 +- ...ions-additions-removals-compatibility.adoc | 1600 +----------- .../pages/expressions/map-expressions.adoc | 2 +- modules/ROOT/pages/functions/list.adoc | 39 - modules/ROOT/pages/index.adoc | 98 - modules/ROOT/pages/introduction/aura.adoc | 52 - .../pages/introduction/cypher-overview.adoc | 11 +- modules/ROOT/pages/values-and-types/maps.adoc | 36 + preview.yml | 9 +- 32 files changed, 47 insertions(+), 13805 deletions(-) delete mode 100644 modules/ROOT/pages/administration/access-control/built-in-roles.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/database-administration.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/dbms-administration.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/index.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/limitations.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/manage-privileges.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/manage-roles.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/manage-users.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/privileges-immutable.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/privileges-reads.adoc delete mode 100644 modules/ROOT/pages/administration/access-control/privileges-writes.adoc delete mode 100644 modules/ROOT/pages/administration/aliases.adoc delete mode 100644 modules/ROOT/pages/administration/databases.adoc delete mode 100644 modules/ROOT/pages/administration/servers.adoc delete mode 100644 modules/ROOT/pages/clauses/call-subquery.adoc delete mode 100644 modules/ROOT/pages/index.adoc delete mode 100644 modules/ROOT/pages/introduction/aura.adoc create mode 100644 modules/ROOT/pages/values-and-types/maps.adoc diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc index c2b9426cb..5b1425487 100644 --- a/modules/ROOT/content-nav.adoc +++ b/modules/ROOT/content-nav.adoc @@ -138,22 +138,6 @@ ** xref:syntax/parameters.adoc[] ** xref:syntax/comments.adoc[] -* xref:administration/index.adoc[] -** xref:administration/databases.adoc[] -** xref:administration/aliases.adoc[] -** xref:administration/servers.adoc[] -** xref:administration/access-control/index.adoc[] -*** xref:administration/access-control/manage-users.adoc[] -*** xref:administration/access-control/manage-roles.adoc[] -*** xref:administration/access-control/manage-privileges.adoc[] -*** xref:administration/access-control/built-in-roles.adoc[] -*** xref:administration/access-control/privileges-reads.adoc[] -*** xref:administration/access-control/privileges-writes.adoc[] -*** xref:administration/access-control/database-administration.adoc[] -*** xref:administration/access-control/dbms-administration.adoc[] -*** xref:administration/access-control/limitations.adoc[] -*** xref:administration/access-control/privileges-immutable.adoc[] - * xref:deprecations-additions-removals-compatibility.adoc[] * Appendix @@ -167,4 +151,4 @@ ** xref:appendix/tutorials/index.adoc[] *** xref:appendix/tutorials/basic-query-tuning.adoc[] *** xref:appendix/tutorials/advanced-query-tuning.adoc[] -*** xref:appendix/tutorials/shortestpath-planning.adoc[] +*** xref:appendix/tutorials/shortestpath-planning.adoc[] \ No newline at end of file diff --git a/modules/ROOT/pages/administration/access-control/built-in-roles.adoc b/modules/ROOT/pages/administration/access-control/built-in-roles.adoc deleted file mode 100644 index 24ebdaf37..000000000 --- a/modules/ROOT/pages/administration/access-control/built-in-roles.adoc +++ /dev/null @@ -1,500 +0,0 @@ -:description: The default privileges of the built-in roles in Neo4j and how to recreate them if needed. -[role=enterprise-edition aura-db-enterprise] -[[access-control-built-in-roles]] -= Built-in roles and privileges - -[abstract] --- -This section explains the default privileges of the built-in roles in Neo4j and how to recreate them if needed. --- - -All of the commands described in this chapter require that the user executing the commands has the rights to do so. -The privileges listed in the following sections are the default set of privileges for each built-in role: - -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-public[The `PUBLIC` role] -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-reader[The `reader` role] -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-editor[The `editor` role] -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-publisher[The `publisher` role] -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-architect[The `architect` role] -* xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-admin[The `admin` role] - -[[access-control-built-in-roles-public]] -== The `PUBLIC` role - -All users are granted the `PUBLIC` role, and it can not be revoked or dropped. -By default, it gives access to the default database and allows executing all procedures and user-defined functions. - -[IMPORTANT] -==== -The `PUBLIC` role cannot be dropped or revoked from any user, but the specific privileges for the role can be modified. -In contrast to the `PUBLIC` role, the other built-in roles can be granted, revoked, dropped, and re-created. -==== - -[[access-control-built-in-roles-public-list]] -=== Listing `PUBLIC` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE PUBLIC PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" -|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" -a|Rows: 3 -|=== - - -[[access-control-built-in-roles-public-recreate]] -=== Recreating the `PUBLIC` role - -The `PUBLIC` role can not be dropped and thus there is no need to recreate the role itself. -To restore the role to its original capabilities, two steps are needed. - -First, all `GRANT` or `DENY` privileges on this role should be revoked (see output of `SHOW ROLE PUBLIC PRIVILEGES AS REVOKE COMMANDS` on what to revoke). -Secondly, run these queries: - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON HOME DATABASE TO PUBLIC ----- - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURES * ON DBMS TO PUBLIC ----- - -[source, cypher, role=noplay] ----- -GRANT EXECUTE USER DEFINED FUNCTIONS * ON DBMS TO PUBLIC ----- - -The resulting `PUBLIC` role now has the same privileges as the original built-in `PUBLIC` role. - - -[[access-control-built-in-roles-reader]] -== The `reader` role - -The `reader` role can perform read-only queries on all graphs except for the `system` database. - - -[[access-control-built-in-roles-reader-list]] -=== Listing `reader` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE reader PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `reader`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" -|"GRANT SHOW CONSTRAINT ON DATABASE * TO `reader`" -|"GRANT SHOW INDEX ON DATABASE * TO `reader`" -a|Rows: 5 -|=== - - -[[access-control-built-in-roles-reader-recreate]] -=== Recreating the `reader` role - -//// -[source, cypher, role=test-setup] ----- -DROP ROLE reader; ----- -//// - -To restore the role to its original capabilities two steps are needed. -First, execute `DROP ROLE reader`. -Secondly, run these queries: - -[source, cypher, role=noplay] ----- -CREATE ROLE reader ----- - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON DATABASE * TO reader ----- - -[source, cypher, role=noplay] ----- -GRANT MATCH {*} ON GRAPH * TO reader ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW CONSTRAINT ON DATABASE * TO reader ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW INDEX ON DATABASE * TO reader ----- - -The resulting `reader` role now has the same privileges as the original built-in `reader` role. - - -[[access-control-built-in-roles-editor]] -== The `editor` role - -The `editor` role can perform read and write operations on all graphs except for the `system` database, but it cannot create new labels, property keys or relationship types. - -[[access-control-built-in-roles-editor-list]] -=== Listing `editor` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE editor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" -|"GRANT SHOW CONSTRAINT ON DATABASE * TO `editor`" -|"GRANT SHOW INDEX ON DATABASE * TO `editor`" -|"GRANT WRITE ON GRAPH * TO `editor`" -a|Rows: 6 -|=== - - -[[access-control-built-in-roles-editor-recreate]] -=== Recreating the `editor` role - -//// -[source, cypher, role=test-setup] ----- -DROP ROLE editor; ----- -//// - -To restore the role to its original capabilities two steps are needed. -First, execute `DROP ROLE editor`. -Secondly, run these queries: - -[source, cypher, role=noplay] ----- -CREATE ROLE editor ----- - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON DATABASE * TO editor ----- - -[source, cypher, role=noplay] ----- -GRANT MATCH {*} ON GRAPH * TO editor ----- - -[source, cypher, role=noplay] ----- -GRANT WRITE ON GRAPH * TO editor ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW CONSTRAINT ON DATABASE * TO editor ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW INDEX ON DATABASE * TO editor ----- - -The resulting `editor` role now has the same privileges as the original built-in `editor` role. - - -[[access-control-built-in-roles-publisher]] -== The `publisher` role - -The `publisher` role can do the same as xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-editor[`editor`], as well as create new labels, property keys and relationship types. - - -[[access-control-built-in-roles-publisher-list]] -=== Listing `publisher` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE publisher PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" -|"GRANT SHOW CONSTRAINT ON DATABASE * TO `publisher`" -|"GRANT SHOW INDEX ON DATABASE * TO `publisher`" -|"GRANT WRITE ON GRAPH * TO `publisher`" -a|Rows: 7 -|=== - - -[[access-control-built-in-roles-publisher-recreate]] -=== Recreating the `publisher` role - -//// -[source, cypher, role=test-setup] ----- -DROP ROLE publisher; ----- -//// - -To restore the role to its original capabilities two steps are needed. -First, execute `DROP ROLE publisher`. -Secondly, run these queries: - -[source, cypher, role=noplay] ----- -CREATE ROLE publisher ----- - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON DATABASE * TO publisher ----- - -[source, cypher, role=noplay] ----- -GRANT MATCH {*} ON GRAPH * TO publisher ----- - -[source, cypher, role=noplay] ----- -GRANT WRITE ON GRAPH * TO publisher ----- - -[source, cypher, role=noplay] ----- -GRANT NAME MANAGEMENT ON DATABASE * TO publisher ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW CONSTRAINT ON DATABASE * TO publisher ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW INDEX ON DATABASE * TO publisher ----- - -The resulting `publisher` role now has the same privileges as the original built-in `publisher` role. - - -[[access-control-built-in-roles-architect]] -== The `architect` role - -The `architect` role can do the same as the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-publisher[`publisher`], as well as create and manage indexes and constraints. - - -[[access-control-built-in-roles-architect-list]] -=== Listing `architect` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE architect PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `architect`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT SHOW CONSTRAINT ON DATABASE * TO `architect`" -|"GRANT SHOW INDEX ON DATABASE * TO `architect`" -|"GRANT WRITE ON GRAPH * TO `architect`" -a|Rows: 9 -|=== - - -[[access-control-built-in-roles-architect-recreate]] -=== Recreating the `architect` role - -//// -[source, cypher, role=test-setup] ----- -DROP ROLE architect; ----- -//// - -To restore the role to its original capabilities two steps are needed. -First, execute `DROP ROLE architect`. -Secondly, run these queries: - -[source, cypher, role=noplay] ----- -CREATE ROLE architect ----- - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON DATABASE * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT MATCH {*} ON GRAPH * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT WRITE ON GRAPH * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT NAME MANAGEMENT ON DATABASE * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW CONSTRAINT ON DATABASE * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT SHOW INDEX ON DATABASE * TO architect ----- - -[source, cypher, role=noplay] ----- -GRANT INDEX MANAGEMENT ON DATABASE * TO architect ----- - -The resulting `architect` role now has the same privileges as the original built-in `architect` role. - - -[[access-control-built-in-roles-admin]] -== The `admin` role - -The `admin` role can do the same as the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-architect[`architect`], as well as manage databases, aliases, users, roles and privileges. - -The `admin` role has the ability to perform administrative tasks. -These include the rights to perform the following classes of tasks: - -* Manage xref::administration/access-control/database-administration.adoc[database security] to control the rights to perform actions on specific databases: -** Manage access to a database and the right to start and stop a database. -** Manage xref::indexes-for-search-performance.adoc[indexes] and xref::constraints/index.adoc[constraints]. -** Allow the creation of labels, relationship types or property names. -** Manage transactions -* Manage xref::administration/access-control/dbms-administration.adoc[DBMS security] to control the rights to perform actions on the entire system: -** Manage xref::administration/databases.adoc[multiple databases]. -** Manage xref::administration/access-control/manage-users.adoc[users] and xref::administration/access-control/manage-roles.adoc[roles]. -** Change configuration parameters. -** Manage sub-graph privileges. -** Manage procedure security. - -These rights are conferred using privileges that can be managed through the xref::administration/access-control/manage-privileges.adoc#access-control-graph-privileges[`GRANT`, `DENY` and `REVOKE` commands]. - - -[[access-control-built-in-roles-admin-list]] -=== Listing `admin` role privileges - -[source, cypher, role=noplay] ----- -SHOW ROLE admin PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `admin`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT SHOW CONSTRAINT ON DATABASE * TO `admin`" -|"GRANT SHOW INDEX ON DATABASE * TO `admin`" -|"GRANT START ON DATABASE * TO `admin`" -|"GRANT STOP ON DATABASE * TO `admin`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `admin`" -a|Rows: 13 -|=== - -If the built-in `admin` role has been altered or dropped, and needs to be restored to its original state, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/password-and-user-recovery[Operations Manual -> Password and user recovery]. - -[[access-control-built-in-roles-admin-recreate]] -=== Recreating the `admin` role - -To restore the role to its original capabilities two steps are needed. -First, execute `DROP ROLE admin`. -Secondly, run these queries: - -// cannot test as it would require deleting the role the test user is logged with -[source, cypher, role=noplay test-skip] ----- -CREATE ROLE admin ----- - -[source, cypher, role=noplay] ----- -GRANT ALL DBMS PRIVILEGES ON DBMS TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT TRANSACTION MANAGEMENT ON DATABASE * TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT START ON DATABASE * TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT STOP ON DATABASE * TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT MATCH {*} ON GRAPH * TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT WRITE ON GRAPH * TO admin ----- - -[source, cypher, role=noplay] ----- -GRANT ALL ON DATABASE * TO admin ----- - -The resulting `admin` role now has the same effective privileges as the original built-in `admin` role. - -Additional information about restoring the `admin` role can be found in the link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/password-and-user-recovery#recover-admin-role[Operations Manual -> Recover the admin role]. - diff --git a/modules/ROOT/pages/administration/access-control/database-administration.adoc b/modules/ROOT/pages/administration/access-control/database-administration.adoc deleted file mode 100644 index 874047c73..000000000 --- a/modules/ROOT/pages/administration/access-control/database-administration.adoc +++ /dev/null @@ -1,981 +0,0 @@ -:description: How to use Cypher to manage Neo4j database administrative privileges. - -//// -[source, cypher, role=test-setup] ----- -CREATE ROLE regularUsers; -CREATE ROLE databaseAdminUsers; -CREATE DATABASE `remote-db`; -CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; ----- -//// - -[role=enterprise-edition aura-db-enterprise] -[[access-control-database-administration]] -= Database administration - -[abstract] --- -This section explains how to use Cypher to manage Neo4j database administrative privileges. --- - -Administrators can use the following Cypher commands to manage Neo4j database administrative rights. - -The components of the database privilege commands are: - -* _command_: -** `GRANT` – gives privileges to roles. -** `DENY` – denies privileges to roles. -** `REVOKE` – removes granted or denied privileges from roles. - -* _mutability_: -** `IMMUTABLE` - When used in conjunction with `GRANT` or `DENY`, specifies that a privilege cannot subsequently be removed unless auth is disabled. -Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. -See also xref:administration/access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. - -* _database-privilege_ -** `ACCESS` - allows access to a specific database or remote database alias. -** `START` - allows the specified database to be started. -** `STOP` - allows the specified database to be stopped. -** `CREATE INDEX` - allows indexes to be created on the specified database. -** `DROP INDEX` - allows indexes to be deleted on the specified database. -** `SHOW INDEX` - allows indexes to be listed on the specified database. -** `INDEX [MANAGEMENT]` - allows indexes to be created, deleted, and listed on the specified database. -** `CREATE CONSTRAINT` - allows constraints to be created on the specified database. -** `DROP CONSTRAINT` - allows constraints to be deleted on the specified database. -** `SHOW CONSTRAINT` - allows constraints to be listed on the specified database. -** `CONSTRAINT [MANAGEMENT]` - allows constraints to be created, deleted, and listed on the specified database. -** `CREATE NEW [NODE] LABEL` - allows new node labels to be created. -** `CREATE NEW [RELATIONSHIP] TYPE` - allows new relationship types to be created. -** `CREATE NEW [PROPERTY] NAME` - allows property names to be created, so that nodes and relationships can have properties assigned with these names. -** `NAME [MANAGEMENT]` - allows all of the name management capabilities: node labels, relationship types, and property names. -** `ALL [[DATABASE] PRIVILEGES]` - allows access, index, constraint, and name management for the specified database or remote database alias. -** `SHOW TRANSACTION` - allows listing transactions and queries for the specified users on the specified database. -** `TERMINATE TRANSACTION` - allows ending transactions and queries for the specified users on the specified database. -** `TRANSACTION [MANAGEMENT]` - allows listing and ending transactions and queries for the specified users on the specified database. - -* _name_ -** The database to associate the privilege with. -+ -[NOTE] -==== -If you delete a database and create a new one with the same name, the new one will NOT have the same privileges previously assigned to the deleted one. -==== -** The _name_ component can be `+*+`, which means all databases. -Databases created after this command execution will also be associated with these privileges. -** The `DATABASE[S] _name_` part of the command can be replaced by `HOME DATABASE`. -This refers to the home database configured for a user or, if that user does not have a home database configured, the default database. -If the user's home database changes for any reason after this command execution, the new one will be associated with these privileges. -This can be quite powerful as it allows permissions to be switched from one database to another simply by changing a user's home database. - -* _role[, ...]_ -** The role or roles to associate the privilege with, comma-separated. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.General grant +ON DATABASE+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } TO role[, ...] ----- - -| Description -| Grants a privilege to one or multiple roles. - -|=== - - -.General deny +ON DATABASE+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +DENY ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -DENY [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } TO role[, ...] ----- - -| Description -| Denies a privilege to one or multiple roles. - -|=== - - -.General revoke +ON DATABASE+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE GRANT ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] GRANT database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] ----- - -| Description -| Revoke a granted privilege from one or multiple roles. - -|=== - - -.General revoke +ON DATABASE+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE DENY ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] DENY database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] ----- - -| Description -| Revokes a denied privilege from one or multiple roles. - -|=== - - -.General revoke +ON DATABASE+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } FROM role[, ...] ----- - -| Description -| Revokes a granted or denied privilege from one or multiple roles. - -|=== - - -[NOTE] -==== -`DENY` does *not* erase a granted privilege. -Use `REVOKE` if you want to remove a privilege. -==== - -The hierarchy between the different database privileges is shown in the image below. - -image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] - - - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT ACCESS+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] ACCESS - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -a| -Grants the specified roles the privilege to access: - -* The home database. -* Specific database(s) or remote database alias(es). -* All databases and remote database aliases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { START \| STOP }+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { START \| STOP } - ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to start or stop the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { CREATE \| DROP \| SHOW } INDEX+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to create, delete, or show indexes on the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT INDEX+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to manage indexes on the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { CREATE \| DROP \| SHOW } CONSTRAINT+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to create, delete, or show constraints on the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CONSTRAINT+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to manage constraints on the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW LABEL+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to create new node labels in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW TYPE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to create new relationship types in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW NAME+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to create new property names in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT NAME+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] NAME [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to manage new labels, relationship types, and property names in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT ALL+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles all privileges for the home, a specific, or all databases and remote database aliases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { SHOW \| TERMINATE } TRANSACTION+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { SHOW \| TERMINATE } TRANSACTION[S] [( { * \| user[, ...] } )] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to list and end the transactions and queries of all users or a particular user(s) in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT TRANSACTION+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Grants the specified roles the privilege to manage the transactions and queries of all users or a particular user(s) in the home database, specific database(s), or all databases. - -|=== - - -image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] - - -[[access-control-database-administration-access]] -== The database `ACCESS` privilege - -The `ACCESS` privilege enables users to connect to a database or a remote database alias. -With `ACCESS` you can run calculations, for example, `+RETURN 2 * 5 AS answer+` or call functions `RETURN timestamp() AS time`. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] ACCESS - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to access the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT ACCESS ON DATABASE neo4j TO regularUsers ----- - -The `ACCESS` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] ACCESS - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to access to the remote database alias `remote-db`, use: - -[source, cypher, role=noplay] ----- -DENY ACCESS ON DATABASE `remote-db` TO regularUsers ----- - -The privileges granted can be seen using the `SHOW PRIVILEGES` command: - -[source, cypher, role=noplay] ----- -SHOW ROLE regularUsers PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY ACCESS ON DATABASE `remote-db` TO `regularUsers`" -|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" -a|Rows: 2 -|=== - - -[[access-control-database-administration-startstop]] -== The database `START`/`STOP` privileges - -The `START` privilege can be used to enable the ability to start a database: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] START - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to start the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT START ON DATABASE neo4j TO regularUsers ----- - -The `START` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] START - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -DENY START ON DATABASE system TO regularUsers ----- - -The `STOP` privilege can be used to enable the ability to stop a database: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] STOP - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to stop the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT STOP ON DATABASE neo4j TO regularUsers ----- - -The `STOP` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] STOP - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -DENY STOP ON DATABASE system TO regularUsers ----- - -The privileges granted can be seen using the `SHOW PRIVILEGES` command: - -[source, cypher, role=noplay] ----- -SHOW ROLE regularUsers PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY ACCESS ON DATABASE `remote-db` TO `regularUsers`" -|"DENY START ON DATABASE `system` TO `regularUsers`" -|"DENY STOP ON DATABASE `system` TO `regularUsers`" -|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" -|"GRANT START ON DATABASE `neo4j` TO `regularUsers`" -|"GRANT STOP ON DATABASE `neo4j` TO `regularUsers`" -a|Rows: 6 -|=== - -[NOTE] -==== -Note that `START` and `STOP` privileges are not included in the xref::administration/access-control/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. -==== - - -[[access-control-database-administration-index]] -== The `INDEX MANAGEMENT` privileges - -Indexes can be created, deleted, or listed with the `CREATE INDEX`, `DROP INDEX`, and `SHOW INDEXES` commands. -The privilege to do this can be granted with `GRANT CREATE INDEX`, `GRANT DROP INDEX`, and `GRANT SHOW INDEX` commands. -The privilege to do all three can be granted with `GRANT INDEX MANAGEMENT` command. - - - - -.Index management privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { CREATE \| DROP \| SHOW } INDEX+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create, delete, or show indexes in the home database, specific database(s), or all databases. - -|=== - - - -.Index management privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT INDEX+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to manage indexes in the home database, specific database(s), or all databases. - -|=== - - -For example, to grant the role `regularUsers` the ability to create indexes on the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT CREATE INDEX ON DATABASE neo4j TO regularUsers ----- - - -[[access-control-database-administration-constraints]] -== The `CONSTRAINT MANAGEMENT` privileges - -Constraints can be created, deleted, or listed with the `CREATE CONSTRAINT`, `DROP CONSTRAINT` and `SHOW CONSTRAINTS` commands. -The privilege to do this can be granted with `GRANT CREATE CONSTRAINT`, `GRANT DROP CONSTRAINT`, `GRANT SHOW CONSTRAINT` commands. -The privilege to do all three can be granted with `GRANT CONSTRAINT MANAGEMENT` command. - - -.Constraint management privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT { CREATE \| DROP \| SHOW } CONSTRAINT+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create, delete, or show constraints on the home database, specific database(s), or all databases. - -|=== - - -.Constraint management privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CONSTRAINT+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enable the specified roles to manage constraints on the home database, specific database(s), or all databases. - -|=== - - -For example, to grant the role `regularUsers` the ability to create constraints on the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT CREATE CONSTRAINT ON DATABASE neo4j TO regularUsers ----- - - -[[access-control-database-administration-tokens]] -== The `NAME MANAGEMENT` privileges - -The right to create new labels, relationship types, and property names is different from the right to create nodes, relationships, and properties. -The latter is managed using database `WRITE` privileges, while the former is managed using specific `+GRANT/DENY CREATE NEW ...+` commands for each type. - - -.Node label management privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW LABEL+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create new node labels in the home database, specific database(s), or all databases. - -|=== - - -.Relationship type management privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW TYPE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create new relationship types in the home database, specific database(s), or all databases. - -|=== - - -.Property name management privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT CREATE NEW NAME+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create new property names in the home database, specific database(s), or all databases. - -|=== - - -.Node label, relationship type, and property name privileges management syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT NAME+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] NAME [MANAGEMENT] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to create new labels, relationship types, and property names in the home database, specific database(s), or all databases. - -|=== - - -For example, to grant the role `regularUsers` the ability to create new properties on nodes or relationships on the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT CREATE NEW PROPERTY NAME ON DATABASE neo4j TO regularUsers ----- - - -[[access-control-database-administration-all]] -== Granting `ALL DATABASE PRIVILEGES` - -The right to access a database, create and drop indexes and constraints and create new labels, relationship types or property names can be achieved with a single command: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] - ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } - TO role[, ...] ----- - -[NOTE] -==== -Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. -These privileges are associated with administrators while other database privileges are of use to domain and application developers. -==== - -For example, granting the abilities above on the database `neo4j` to the role `databaseAdminUsers` is done using the following query. - -[source, cypher, role=noplay] ----- -GRANT ALL DATABASE PRIVILEGES ON DATABASE neo4j TO databaseAdminUsers ----- - -The privileges granted can be seen using the `SHOW PRIVILEGES` command: - -[source, cypher, role=noplay] ----- -SHOW ROLE databaseAdminUsers PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALL DATABASE PRIVILEGES ON DATABASE `neo4j` TO `databaseAdminUsers`" -a|Rows: 1 -|=== - - -[[access-control-database-administration-transaction]] -== Granting `TRANSACTION MANAGEMENT` privileges - -The right to run the commands `SHOW TRANSACTIONS`, `TERMINATE TRANSACTIONS`, and the deprecated procedures `dbms.listTransactions`, `dbms.listQueries`, `dbms.killQuery`, `dbms.killQueries`, `dbms.killTransaction` and `dbms.killTransactions` is now managed through the `SHOW TRANSACTION` and `TERMINATE TRANSACTION` privileges. - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT SHOW TRANSACTION+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] SHOW TRANSACTION[S] [( { * \| user[, ...] } )] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to list transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT TERMINATE TRANSACTION+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] TERMINATE TRANSACTION[S] [( { * \| user[, ...] } )] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to end running transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. - -|=== - - -.Database privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT TRANSACTION+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] - ON { HOME DATABASE \| DATABASE[S] { * \| name[, ...] } } - TO role[, ...] ----- - -| Description -| Enables the specified roles to manage transactions and queries for user(s) or all users in the home database, specific database(s), or all databases. - -|=== - - -[NOTE] -==== -Note that the `TRANSACTION MANAGEMENT` privileges are not included in the xref::administration/access-control/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. -==== - -For example, to grant the role `regularUsers` the ability to list transactions for user `jake` on the database `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT SHOW TRANSACTION (jake) ON DATABASE neo4j TO regularUsers ----- diff --git a/modules/ROOT/pages/administration/access-control/dbms-administration.adoc b/modules/ROOT/pages/administration/access-control/dbms-administration.adoc deleted file mode 100644 index af66a453b..000000000 --- a/modules/ROOT/pages/administration/access-control/dbms-administration.adoc +++ /dev/null @@ -1,2172 +0,0 @@ -:description: How to use Cypher to manage Neo4j DBMS administrative privileges. - -//// -[source, cypher, role=test-setup] ----- -CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE ROLE roleAdder IF NOT EXISTS; -CREATE ROLE roleNameModifier IF NOT EXISTS; -CREATE ROLE roleDropper IF NOT EXISTS; -CREATE ROLE roleAssigner IF NOT EXISTS; -CREATE ROLE roleRemover IF NOT EXISTS; -CREATE ROLE roleShower IF NOT EXISTS; -CREATE ROLE roleManager IF NOT EXISTS; -CREATE ROLE userAdder IF NOT EXISTS; -CREATE ROLE userNameModifier IF NOT EXISTS; -CREATE ROLE userModifier IF NOT EXISTS; -CREATE ROLE passwordModifier IF NOT EXISTS; -CREATE ROLE statusModifier IF NOT EXISTS; -CREATE ROLE userDropper IF NOT EXISTS; -CREATE ROLE userShower IF NOT EXISTS; -CREATE ROLE userManager IF NOT EXISTS; -CREATE ROLE userImpersonator IF NOT EXISTS; -CREATE ROLE databaseAdder IF NOT EXISTS; -CREATE ROLE compositeDatabaseAdder IF NOT EXISTS; -CREATE ROLE databaseDropper IF NOT EXISTS; -CREATE ROLE compositeDatabaseDropper IF NOT EXISTS; -CREATE ROLE databaseModifier IF NOT EXISTS; -CREATE ROLE accessModifier IF NOT EXISTS; -CREATE ROLE compositeDatabaseManager IF NOT EXISTS; -CREATE ROLE databaseManager IF NOT EXISTS; -CREATE ROLE aliasAdder IF NOT EXISTS; -CREATE ROLE aliasDropper IF NOT EXISTS; -CREATE ROLE aliasModifier IF NOT EXISTS; -CREATE ROLE aliasLister IF NOT EXISTS; -CREATE ROLE aliasManager IF NOT EXISTS; -CREATE ROLE privilegeShower IF NOT EXISTS; -CREATE ROLE privilegeAssigner IF NOT EXISTS; -CREATE ROLE privilegeRemover IF NOT EXISTS; -CREATE ROLE privilegeManager IF NOT EXISTS; -CREATE ROLE procedureExecutor IF NOT EXISTS; -CREATE ROLE deniedProcedureExecutor IF NOT EXISTS; -CREATE ROLE boostedProcedureExecutor IF NOT EXISTS; -CREATE ROLE deniedBoostedProcedureExecutor1 IF NOT EXISTS; -CREATE ROLE deniedBoostedProcedureExecutor2 IF NOT EXISTS; -CREATE ROLE deniedBoostedProcedureExecutor3 IF NOT EXISTS; -CREATE ROLE deniedBoostedProcedureExecutor4 IF NOT EXISTS; -CREATE ROLE adminProcedureExecutor IF NOT EXISTS; -CREATE ROLE functionExecutor IF NOT EXISTS; -CREATE ROLE deniedFunctionExecutor IF NOT EXISTS; -CREATE ROLE boostedFunctionExecutor IF NOT EXISTS; -CREATE ROLE globbing1 IF NOT EXISTS; -CREATE ROLE globbing2 IF NOT EXISTS; -CREATE ROLE globbing3 IF NOT EXISTS; -CREATE ROLE globbing4 IF NOT EXISTS; -CREATE ROLE globbing5 IF NOT EXISTS; -CREATE ROLE globbing6 IF NOT EXISTS; -CREATE ROLE dbmsManager IF NOT EXISTS; -CREATE ROLE configurationViewer IF NOT EXISTS; -CREATE ROLE deniedConfigurationViewer IF NOT EXISTS; ----- -//// - -[role=enterprise-edition aura-db-enterprise] -[[access-control-dbms-administration]] -= DBMS administration - -[abstract] --- -This section explains how to use Cypher to manage Neo4j DBMS administrative privileges. --- - -All DBMS privileges are relevant system-wide. -Like user management, they do not belong to one specific database or graph. -For more details on the differences between graphs, databases and the DBMS, refer to xref::introduction/cypher_neo4j.adoc[]. - -image::privileges_grant_and_deny_syntax_dbms_privileges.svg[title="Syntax of GRANT and DENY DBMS Privileges"] - -image::privileges_hierarchy_dbms.svg[title="DBMS privileges hierarchy"] - -The xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges. -These include: - -* Create, delete, and modify databases and aliases. -* Change configuration parameters. -* Manage transactions. -* Manage users and roles. -* Manage sub-graph privileges. -* Manage procedure security. - -To enable a user to perform these tasks, you can grant them the `admin` role, but it is also possible to make a custom role with a subset of these privileges. -All privileges are also assignable using Cypher commands. -For more details, see the following sections: - -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[Role management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[User management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-impersonation[Impersonation privileges management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-database-management[Database management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[Alias management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[Privilege management] -* xref::administration/access-control/database-administration.adoc#access-control-database-administration-transaction[Transaction management] -* xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-execute[Procedure and user-defined function security] - -[[access-control-dbms-administration-custom]] -== Using a custom role to manage DBMS privileges - -In order to have an administrator role with a subset of privileges that includes all DBMS privileges, but not all database privileges, you can copy the `admin` role and revoke or deny the unwanted privileges. -A second option is to build a custom administrator from scratch by granting the wanted privileges instead. - -As an example, an administrator role can be created to only manage users and roles by using the second option: - -. First, create the new role: -+ -[source, cypher, role=noplay] ----- -CREATE ROLE usermanager ----- -. Then grant the privilege to manage users: -+ -[source, cypher, role=noplay] ----- -GRANT USER MANAGEMENT ON DBMS TO usermanager ----- -. And to manage roles: -+ -[source, cypher, role=noplay] ----- -GRANT ROLE MANAGEMENT ON DBMS TO usermanager ----- - -The resulting role has privileges that only allow user and role management. -To list all privileges for the role `usermanager` as commands, run this query: - -[source, cypher, role=noplay] ----- -SHOW ROLE usermanager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ROLE MANAGEMENT ON DBMS TO `usermanager`" -|"GRANT USER MANAGEMENT ON DBMS TO `usermanager`" -a|Rows: 2 -|=== - -Note that this role does not allow all DBMS capabilities. -For example, the role is missing privileges for management, creation and drop of databases as well as execution of `admin` procedures. -To create a more powerful administrator, you can grant a different set of privileges. - -In the following example, a new administrator role is created to perform almost all DBMS capabilities, excluding database management. -However, the role still has some limited database capabilities, such as managing transactions: - -. Again, start by creating a new role: -+ -[source, cypher, role=noplay] ----- -CREATE ROLE customAdministrator ----- -. Then grant the privilege for all DBMS capabilities: -+ -[source, cypher, role=noplay] ----- -GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator ----- -. And explicitly deny the privilege to manage databases and aliases: -+ -[source, cypher, role=noplay] ----- -DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator ----- -. Next, grant the transaction management privilege: -+ -[source, cypher, role=noplay] ----- -GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator ----- - -The resulting role has privileges that include all DBMS privileges except creating, dropping, and modifying databases and aliases, as well as managing transactions. -Use the following query to list all privileges for the role `customAdministrator` as commands: - -[source, cypher, role=noplay] ----- -SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY DATABASE MANAGEMENT ON DBMS TO `customAdministrator`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `customAdministrator`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `customAdministrator`" -a|Rows: 3 -|=== - - -[[access-control-dbms-administration-role-management]] -== The DBMS `ROLE MANAGEMENT` privileges - -The DBMS privileges for role management are assignable using Cypher administrative commands. -They can be granted, denied and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Role management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] CREATE ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to create new roles. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] RENAME ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to change the name of roles. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] DROP ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to delete roles. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ASSIGN ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to assign roles to users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] REMOVE ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to remove roles from users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SHOW ROLE - ON DBMS - TO role[, ...] -| Enables the specified roles to list roles. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ROLE MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to create, delete, assign, remove, and list roles. - -|=== - -The ability to add roles can be granted via the `CREATE ROLE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT CREATE ROLE ON DBMS TO roleAdder ----- - -The resulting role has privileges that only allow adding roles. -List all privileges for the role `roleAdder` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleAdder PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CREATE ROLE ON DBMS TO `roleAdder`" -a|Rows: 1 -|=== - -The ability to rename roles can be granted via the `RENAME ROLE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT RENAME ROLE ON DBMS TO roleNameModifier ----- - -The resulting role has privileges that only allow renaming roles. -List all privileges for the role `roleNameModifier` using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT RENAME ROLE ON DBMS TO `roleNameModifier`" -a|Rows: 1 -|=== - -The ability to delete roles can be granted via the `DROP ROLE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DROP ROLE ON DBMS TO roleDropper ----- - -The resulting role has privileges that only allow deleting roles. -List all privileges for the role `roleDropper` by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleDropper PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DROP ROLE ON DBMS TO `roleDropper`" -a|Rows: 1 -|=== - -The ability to assign roles to users can be granted via the `ASSIGN ROLE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ASSIGN ROLE ON DBMS TO roleAssigner ----- - -The resulting role has privileges that only allow assigning/granting roles. -List all privileges for the role `roleAssigner` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ASSIGN ROLE ON DBMS TO `roleAssigner`" -a|Rows: 1 -|=== - -The ability to remove roles from users can be granted via the `REMOVE ROLE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT REMOVE ROLE ON DBMS TO roleRemover ----- - -The resulting role has privileges that only allow removing/revoking roles. -List all privileges for the role `roleRemover` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleRemover PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT REMOVE ROLE ON DBMS TO `roleRemover`" -a|Rows: 1 -|=== - -The ability to show roles can be granted via the `SHOW ROLE` privilege. -A role with this privilege is allowed to execute the `SHOW ROLES` and `SHOW POPULATED ROLES` administration commands. -For the `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both this privilege and the `SHOW USER` privilege are required. -The following query shows an example of how to grant the `SHOW ROLE` privilege: - -In order to use `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both the `SHOW ROLE` and the `SHOW USER` privileges are required. -See an example of how to grant the `SHOW ROLE` privilege: - -[source, cypher, role=noplay] ----- -GRANT SHOW ROLE ON DBMS TO roleShower ----- - -The resulting role has privileges that only allow showing roles. -List all privileges for the role `roleShower` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleShower PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW ROLE ON DBMS TO `roleShower`" -a|Rows: 1 -|=== - -The privileges to create, rename, delete, assign, remove, and list roles can be granted via the `ROLE MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ROLE MANAGEMENT ON DBMS TO roleManager ----- - -The resulting role has all privileges to manage roles. -List all privileges for the role `roleManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE roleManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ROLE MANAGEMENT ON DBMS TO `roleManager`" -a|Rows: 1 -|=== - - -[[access-control-dbms-administration-user-management]] -== The DBMS `USER MANAGEMENT` privileges - -The DBMS privileges for user management can be assigned using Cypher administrative commands. -They can be granted, denied and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.User management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] CREATE USER - ON DBMS - TO role[, ...] -| Enables the specified roles to create new users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] RENAME USER - ON DBMS - TO role[, ...] -| Enables the specified roles to change the name of users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ALTER USER - ON DBMS - TO role[, ...] -| Enables the specified roles to modify users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SET PASSWORD[S] - ON DBMS - TO role[, ...] -| Enables the specified roles to modify users' passwords and whether those passwords must be changed upon first login. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SET USER HOME DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to modify users' home database. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SET USER STATUS - ON DBMS - TO role[, ...] -| Enables the specified roles to modify the account status of users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] DROP USER - ON DBMS - TO role[, ...] -| Enables the specified roles to delete users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SHOW USER - ON DBMS - TO role[, ...] -| Enables the specified roles to list users. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] USER MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to create, delete, modify, and list users. - -|=== - -The ability to add users can be granted via the `CREATE USER` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT CREATE USER ON DBMS TO userAdder ----- - -The resulting role has privileges that only allow adding users. -List all privileges for the role `userAdder` as commands by using this query: - -[source, cypher, role=noplay] ----- -SHOW ROLE userAdder PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CREATE USER ON DBMS TO `userAdder`" -a|Rows: 1 -|=== - -The ability to rename users can be granted via the `RENAME USER` privilege. -The following query shows an example of this: - -[source, cypher, role=noplay] ----- -GRANT RENAME USER ON DBMS TO userNameModifier ----- - -The resulting role has privileges that only allow renaming users: - -[source, cypher, role=noplay] ----- -SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS ----- - -Lists all privileges for role `userNameModifier`: - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT RENAME USER ON DBMS TO `userNameModifier`" -a|Rows: 1 -|=== - -The ability to modify users can be granted via the `ALTER USER` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ALTER USER ON DBMS TO userModifier ----- - -The resulting role has privileges that only allow modifying users. -List all privileges for the role `userModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE userModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALTER USER ON DBMS TO `userModifier`" -a|Rows: 1 -|=== - -A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED` and `SET STATUS` parts: - -[source, cypher, role=noplay] ----- -ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED ----- - -The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the `SET PASSWORDS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SET PASSWORDS ON DBMS TO passwordModifier ----- - -The resulting role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login. -List all privileges for the role `passwordModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SET PASSWORD ON DBMS TO `passwordModifier`" -a|Rows: 1 -|=== - -A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts: - -[source, cypher, role=noplay] ----- -ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED ----- - -The ability to modify the account status of users can be granted via the `SET USER STATUS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SET USER STATUS ON DBMS TO statusModifier ----- - -The resulting role has privileges that only allow modifying the account status of users. -List all privileges for the role `statusModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE statusModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SET USER STATUS ON DBMS TO `statusModifier`" -a|Rows: 1 -|=== - -A user that is granted the `SET USER STATUS` privilege is allowed to run the `ALTER USER` administration command with only the `SET STATUS` part: - -[source, cypher, role=noplay] ----- -ALTER USER jake SET STATUS ACTIVE ----- - -In order to be able to modify the home database of users, grant the `SET USER HOME DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SET USER HOME DATABASE ON DBMS TO statusModifier ----- - -The resulting role has privileges that only allow modifying the home database of users. -List all privileges for the role `statusModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE statusModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SET USER HOME DATABASE ON DBMS TO `statusModifier`" -|"GRANT SET USER STATUS ON DBMS TO `statusModifier`" -a|Rows: 2 -|=== - -A user that is granted the `SET USER HOME DATABASE` privilege is allowed to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part: - -[source, cypher, role=noplay] ----- -ALTER USER jake SET HOME DATABASE otherDb ----- - -[source, cypher, role=noplay] ----- -ALTER USER jake REMOVE HOME DATABASE ----- - -[NOTE] -==== -Note that the combination of the `SET PASSWORDS`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action. -==== - -The ability to delete users can be granted via the `DROP USER` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DROP USER ON DBMS TO userDropper ----- - -The resulting role has privileges that only allow deleting users. -List all privileges for the role `userDropper` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE userDropper PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DROP USER ON DBMS TO `userDropper`" -a|Rows: 1 -|=== - -The ability to show users can be granted via the `SHOW USER` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SHOW USER ON DBMS TO userShower ----- - -The resulting role has privileges that only allow showing users. -List all privileges for the role `userShower` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE userShower PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW USER ON DBMS TO `userShower`" -a|Rows: 1 -|=== - -The privileges to create, rename, modify, delete, and list users can be granted via the `USER MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT USER MANAGEMENT ON DBMS TO userManager ----- - -The resulting role has all privileges to manage users. -List all privileges for the role `userManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE userManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW USER ON DBMS TO `userManager`" -a|Rows: 1 -|=== - -[[access-control-dbms-administration-impersonation]] -== The DBMS `IMPERSONATE` privileges - -The DBMS privileges for impersonation can be assigned through Cypher administrative commands. -They can be granted, denied, and revoked like other privileges. - -Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands). - -The ability to impersonate users can be granted via the `IMPERSONATE` privilege. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Impersonation privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] IMPERSONATE [(*)] - ON DBMS - TO role[, ...] -| Enables the specified roles to impersonate any user. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] IMPERSONATE (user[, ...]) - ON DBMS - TO role[, ...] -| Enables the specified roles to impersonate the specified users. - -|=== - -The following query shows an example of this. -Note that `userImpersonator` must be an existing role in order to make this query work: - -.Query -[source, cypher, role=noplay] ----- -GRANT IMPERSONATE (*) ON DBMS TO userImpersonator ----- - -The resulting role has privileges that allow impersonating all users: - -.Query -[source, cypher, role=noplay] ----- -SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -| command -| "GRANT IMPERSONATE (*) ON DBMS TO `userImpersonator`" -a|Rows: 1 -|=== - -It is also possible to deny and revoke that privilege. -See an example which shows of how the `userImpersonator` user would be able to impersonate all users, except `alice`: - -.Query -[source, cypher, role=noplay] ----- -DENY IMPERSONATE (alice) ON DBMS TO userImpersonator ----- - -To grant (or revoke) the permissions to impersonate a specific user or a subset of users, you can first list them with this query: - -.Query -[source, cypher, role=noplay] ----- -GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator ----- - - -[[access-control-dbms-administration-database-management]] -== The DBMS `DATABASE MANAGEMENT` privileges - -The DBMS privileges for database management can be assigned by using Cypher administrative commands. -They can be granted, denied and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Database management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] CREATE DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to create new standard databases and aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] DROP DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to delete standard databases and aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ALTER DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to modify standard databases and aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SET DATABASE ACCESS - ON DBMS - TO role[, ...] -| Enables the specified roles to modify access to standard databases. - -| [source, syntax, role=noheader] -GRANT CREATE COMPOSITE DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to create new composite databases. - -| [source, syntax, role=noheader] -GRANT DROP COMPOSITE DATABASE - ON DBMS - TO role[, ...] -| Enables the specified roles to delete composite databases. - -| [source, syntax, role=noheader] -GRANT COMPOSITE DATABASE MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to create and delete composite databases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] DATABASE MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to create, delete, and modify databases and aliases. - -|=== - - -The ability to create standard databases and aliases can be granted via the `CREATE DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT CREATE DATABASE ON DBMS TO databaseAdder ----- - -The resulting role has privileges that only allow creating standard databases and aliases. -List all privileges for the role `databaseAdder` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CREATE DATABASE ON DBMS TO `databaseAdder`" -a|Rows: 1 -|=== - -The ability to create composite databases can be granted via the `CREATE COMPOSITE DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT CREATE COMPOSITE DATABASE ON DBMS TO compositeDatabaseAdder ----- - -The resulting role has privileges that only allow creating composite databases. -List all privileges for the role `compositeDatabaseAdder` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CREATE COMPOSITE DATABASE ON DBMS TO `compositeDatabaseAdder`" -a|Rows: 1 -|=== - -The ability to delete standard databases and aliases can be granted via the `DROP DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DROP DATABASE ON DBMS TO databaseDropper ----- - -The resulting role has privileges that only allow deleting standard databases and aliases. -List all privileges for the role `databaseDropper` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DROP DATABASE ON DBMS TO `databaseDropper`" -a|Rows: 1 -|=== - -The ability to delete composite databases can be granted via the `DROP COMPOSITE DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DROP COMPOSITE DATABASE ON DBMS TO compositeDatabaseDropper ----- - -The resulting role has privileges that only allow deleting composite databases. -List all privileges for the role `compositeDatabaseDropper` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DROP COMPOSITE DATABASE ON DBMS TO `compositeDatabaseDropper`" -a|Rows: 1 -|=== - -The ability to modify standard databases and aliases can be granted via the `ALTER DATABASE` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ALTER DATABASE ON DBMS TO databaseModifier ----- - -The resulting role has privileges that only allow modifying standard databases and aliases. -List all privileges for the role `databaseModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALTER DATABASE ON DBMS TO `databaseModifier`" -a|Rows: 1 -|=== - -The ability to modify access to standard databases can be granted via the `SET DATABASE ACCESS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SET DATABASE ACCESS ON DBMS TO accessModifier ----- - -The resulting role has privileges that only allow modifying access to standard databases. -List all privileges for the role `accessModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE accessModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SET DATABASE ACCESS ON DBMS TO `accessModifier`" -a|Rows: 1 -|=== - -The ability to create and delete composite databases can be granted via the `COMPOSITE DATABASE MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager ----- - -The resulting role has all privileges to manage composite databases. -List all privileges for the role `compositeDatabaseManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO `compositeDatabaseManager`" -a|Rows: 1 -|=== - -The ability to create, delete, and modify databases and aliases can be granted via the `DATABASE MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager ----- - -The resulting role has all privileges to manage standard and composite databases as well as aliases. -List all privileges for the role `databaseManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE databaseManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DATABASE MANAGEMENT ON DBMS TO `databaseManager`" -a|Rows: 1 -|=== - -[[access-control-dbms-administration-alias-management]] -== The DBMS `ALIAS MANAGEMENT` privileges - -The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases. -They can be granted, denied and revoked like other privileges. -It is also possible to manage aliases with xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-database-management[database management commands]. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Alias management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] CREATE ALIAS -ON DBMS -TO role[, ...] -| Enables the specified roles to create new aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] DROP ALIAS -ON DBMS -TO role[, ...] -| Enables the specified roles to delete aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ALTER ALIAS -ON DBMS -TO role[, ...] -| Enables the specified roles to modify aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SHOW ALIAS -ON DBMS -TO role[, ...] -| Enables the specified roles to list aliases. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ALIAS MANAGEMENT -ON DBMS -TO role[, ...] -| Enables the specified roles to list, create, delete, and modify aliases. - -|=== - -The ability to create aliases can be granted via the `CREATE ALIAS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT CREATE ALIAS ON DBMS TO aliasAdder ----- - -The resulting role has privileges that only allow creating aliases. -List all privileges for the role `aliasAdder` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CREATE ALIAS ON DBMS TO `aliasAdder`" -a|Rows: 1 -|=== - -The ability to delete aliases can be granted via the `DROP ALIAS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT DROP ALIAS ON DBMS TO aliasDropper ----- - -The resulting role has privileges that only allow deleting aliases. -See all privileges for the role `aliasDropper` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT DROP ALIAS ON DBMS TO `aliasDropper`" -a|Rows: 1 -|=== - -The ability to modify aliases can be granted via the `ALTER ALIAS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ALTER ALIAS ON DBMS TO aliasModifier ----- - -The resulting role has privileges that only allow modifying aliases. -List all privileges for the role `aliasModifier` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALTER ALIAS ON DBMS TO `aliasModifier`" -a|Rows: 1 -|=== - -The ability to list aliases can be granted via the `SHOW ALIAS` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT SHOW ALIAS ON DBMS TO aliasLister ----- - -The resulting role has privileges that only allow modifying aliases. -List all privileges for the role `aliasLister` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE aliasLister PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW ALIAS ON DBMS TO `aliasLister`" -a|Rows: 1 -|=== - -The privileges to list, create, delete, and modify aliases can be granted via the `ALIAS MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager ----- - -The resulting role has all privileges to manage aliases. -List all privileges for the role `aliasManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE aliasManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALIAS MANAGEMENT ON DBMS TO `aliasManager`" -a|Rows: 1 -|=== - -[[access-control-dbms-administration-server-management]] -== The DBMS `SERVER MANAGEMENT` privileges - -The DBMS privileges for server management can be assigned using Cypher administrative commands. -They can be granted, denied, and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Server management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT SERVER MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to show, enable, rename, alter, reallocate, deallocate, and drop servers. - -| [source, syntax, role=noheader] -GRANT SHOW SERVERS - ON DBMS - TO role[, ...] -| Enables the specfied roles to show servers. -|=== - - -[[access-control-dbms-administration-privilege-management]] -== The DBMS `PRIVILEGE MANAGEMENT` privileges - -The DBMS privileges for privilege management can be assigned by using Cypher administrative commands. -They can be granted, denied and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Privilege management privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command | Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SHOW PRIVILEGE - ON DBMS - TO role[, ...] -| Enables the specified roles to list privileges. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] ASSIGN PRIVILEGE - ON DBMS - TO role[, ...] -| Enables the specified roles to assign privileges using the `GRANT` and `DENY` commands. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] REMOVE PRIVILEGE - ON DBMS - TO role[, ...] -| Enables the specified roles to remove privileges using the `REVOKE` command. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT - ON DBMS - TO role[, ...] -| Enables the specified roles to list, assign, and remove privileges. -|=== - -The ability to list privileges can be granted via the `SHOW PRIVILEGE` privilege. - -A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands. -To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required. -The following query shows an example of how to grant the `SHOW PRIVILEGE` privilege: - -[source, cypher, role=noplay] ----- -GRANT SHOW PRIVILEGE ON DBMS TO privilegeShower ----- - -The resulting role has privileges that only allow showing privileges. -List all privileges for the role `privilegeShower` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE privilegeShower PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeShower`" -a|Rows: 1 -|=== - -[NOTE] -==== -Note that no specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands. - -In addition, note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges. -Other users' privileges cannot be listed when using a non-native auth provider. -==== - -The ability to assign privileges to roles can be granted via the `ASSIGN PRIVILEGE` privilege. -A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands. -See an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner ----- - -The resulting role has privileges that only allow assigning privileges. -List all privileges for the role `privilegeAssigner` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ASSIGN PRIVILEGE ON DBMS TO `privilegeAssigner`" -a|Rows: 1 -|=== - -The ability to remove privileges from roles can be granted via the `REMOVE PRIVILEGE` privilege. - -A user with this privilege is allowed to execute `REVOKE` administration commands. -See an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover ----- - -The resulting role has privileges that only allow removing privileges. -List all privileges for the role `privilegeRemover` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT REMOVE PRIVILEGE ON DBMS TO `privilegeRemover`" -a|Rows: 1 -|=== - -The privileges to list, assign, and remove privileges can be granted via the `PRIVILEGE MANAGEMENT` privilege. -See an example: - -[source, cypher, role=noplay] ----- -GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager ----- - -The resulting role has all privileges to manage privileges. -List all privileges for the role `privilegeManager` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT PRIVILEGE MANAGEMENT ON DBMS TO `privilegeManager`" -a|Rows: 1 -|=== - - -[[access-control-dbms-administration-execute]] -== The DBMS `EXECUTE` privileges - -The DBMS privileges for procedure and user defined function execution can be assigned by using Cypher administrative commands. -They can be granted, denied and revoked like other privileges. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Execute privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command -| Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] EXECUTE PROCEDURE[S] name-globbing[, ...] - ON DBMS - TO role[, ...] -| Enables the specified roles to execute the given procedures. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] EXECUTE BOOSTED PROCEDURE[S] name-globbing[, ...] - ON DBMS - TO role[, ...] -| Enables the specified roles to execute the given procedures with elevated privileges. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] EXECUTE ADMIN[ISTRATOR] PROCEDURES - ON DBMS - TO role[, ...] -| Enables the specified roles to execute procedures annotated with `@Admin`. The procedures are executed with elevated privileges. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] EXECUTE [USER [DEFINED]] FUNCTION[S] name-globbing[, ...] - ON DBMS - TO role[, ...] -| Enables the specified roles to execute the given user defined functions. - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, ...] - ON DBMS - TO role[, ...] -| Enables the specified roles to execute the given user defined functions with elevated privileges. -|=== - -The `EXECUTE BOOSTED` privileges replace the `dbms.security.procedures.default_allowed` and `dbms.security.procedures.roles` configuration parameters for procedures and user defined functions. -The configuration parameters are still honored as a set of temporary privileges. -These cannot be revoked, but will be updated on each restart with the current configuration values. - - -[[access-control-execute-procedure]] -=== The `EXECUTE PROCEDURE` privilege - -The ability to execute a procedure can be granted via the `EXECUTE PROCEDURE` privilege. -A role with this privilege is allowed to execute the procedures matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. -The following query shows an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor ----- - -Users with the role `procedureExecutor` can then run any procedure in the `db.schema` namespace. -The procedure is run using the user's own privileges. - -The resulting role has privileges that only allow executing procedures in the `db.schema` namespace. -List all privileges for the role `procedureExecutor` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO `procedureExecutor`" -a|Rows: 1 -|=== - -In order to allow the execution of all but only a few procedures, you can grant `EXECUTE PROCEDURES *` and deny the unwanted procedures. -For example, the following queries allow the execution of all procedures, except those starting with `dbms.killTransaction`: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE PROCEDURE dbms.killTransaction* ON DBMS TO deniedProcedureExecutor ----- - -The resulting role has privileges that only allow executing all procedures except those starting with `dbms.killTransaction`. -List all privileges for the role `deniedProcedureExecutor` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE PROCEDURE dbms.killTransaction* ON DBMS TO `deniedProcedureExecutor`" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedProcedureExecutor`" -a|Rows: 2 -|=== - -Both the `dbms.killTransaction` and the `dbms.killTransactions` procedures are blocked here, as well as any other procedures starting with `dbms.killTransaction`. - - -[[access-control-execute-boosted-procedure]] -=== The `EXECUTE BOOSTED PROCEDURE` privilege - -The ability to execute a procedure with elevated privileges can be granted via the `EXECUTE BOOSTED PROCEDURE` privilege. -A user with this privilege is allowed to execute the procedures matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing] without the execution being restricted to their other privileges. - -There is no need to grant an individual `EXECUTE PROCEDURE` privilege for the procedures either, as granting the `EXECUTE BOOSTED PROCEDURE` includes an implicit `EXECUTE PROCEDURE` grant for them. -A denied `EXECUTE PROCEDURE` still denies executing the procedure. -The following query shows an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE * ON DBMS TO boostedProcedureExecutor; -GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boostedProcedureExecutor ----- - -Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges. -Now they can see everything on the graph and not just the labels and types that the user has `TRAVERSE` privilege on. - -The resulting role has privileges that only allow executing the `db.labels` and the `db.relationshipTypes` procedures, but with elevated execution. -List all privileges for the role `boostedProcedureExecutor` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `boostedProcedureExecutor`" -|"GRANT EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `boostedProcedureExecutor`" -|"GRANT EXECUTE BOOSTED PROCEDURE db.relationshipTypes ON DBMS TO `boostedProcedureExecutor`" -a|Rows: 3 -|=== - -Granting the `EXECUTE BOOSTED PROCEDURE` privilege on its own allows the procedure to be both executed (due to the implicit `EXECUTE PROCEDURE` grant) and proceed with elevated privileges. -A denied `EXECUTE BOOSTED PROCEDURE` on its own behaves slightly differently: it only denies the elevation and not the execution of the procedure. -However, a role with both a granted `EXECUTE BOOSTED PROCEDURE` and a denied `EXECUTE BOOSTED PROCEDURE` will deny the execution as well. -This is explained through the following examples: - -.Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` -[example] -==== -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1 ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1 ----- - -The resulting role has privileges that allow the execution of all procedures using the user's own privileges. -It also prevents the `db.labels` procedure from being elevated. -Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`. - -To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor1`" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor1`" -a|Rows: 2 -|=== -==== - -.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE` -[example] -==== -[source, cypher, role=noplay] ----- -GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2 ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2 ----- - -The resulting role has privileges that allow executing all procedures with elevated privileges except `db.labels`, which is not allowed to be executed at all. -List all privileges for the role `deniedBoostedProcedureExecutor2` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor2`" -|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor2`" -a|Rows: 2 -|=== -==== - -.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` -[example] -==== -[source, cypher, role=noplay] ----- -GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3 ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3 ----- - -The resulting role has privileges that allow executing all procedures with elevated privileges except `db.labels`, which is not allowed to be executed at all. -List all privileges for the role `deniedBoostedProcedureExecutor3` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor3`" -|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor3`" -a|Rows: 2 -|=== -==== - -.Grant `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE` -[example] -==== -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor4 ----- - -[source, cypher, role=noplay] ----- -GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor4 ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor4 ----- - -The resulting role has privileges that allow executing all procedures with elevated privileges except the `db.labels` procedure, which is only allowed to execute using the user's own privileges. -List all privileges for the role `deniedBoostedProcedureExecutor4` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedBoostedProcedureExecutor4 PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor4`" -|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor4`" -|"GRANT EXECUTE PROCEDURE db.labels ON DBMS TO `deniedBoostedProcedureExecutor4`" -a|Rows: 3 -|=== -==== - -.How would the privileges from examples 1 to 4 affect the output of a procedure? -[example] -==== -Assume there is a procedure called `myProc`. - -This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege. - -Now, adapt the privileges from examples 1 to 4 to be applied to this procedure and show what is returned. -With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`. - -With the privileges from example 2, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE PROCEDURE myProc`, execution of the `myProc` procedure is not allowed. - -With the privileges from example 3, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, execution of the `myProc` procedure is not allowed. - -For comparison, when granted: - -* `EXECUTE PROCEDURE myProc`: the `myProc` procedure returns the result `A` and `B`. -* `EXECUTE BOOSTED PROCEDURE myProc`: execution of the `myProc` procedure is not allowed. -* `EXECUTE PROCEDURE myProc` and `EXECUTE BOOSTED PROCEDURE myProc`: the `myProc` procedure returns the result `A`, `B`, and `C`. - -For comparison, when only `EXECUTE BOOSTED PROCEDURE myProc` is granted, the `myProc` procedure returns the result `A`, `B`, and `C`; without the need for granting of the `EXECUTE PROCEDURE myProc` privilege. -==== - - -[[access-control-admin-procedure]] -=== The `EXECUTE ADMIN PROCEDURE` privilege - -The ability to execute admin procedures (annotated with `@Admin`) can be granted via the `EXECUTE ADMIN PROCEDURES` privilege. -This privilege is equivalent to granting the xref::administration/access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[`EXECUTE BOOSTED PROCEDURE` privilege] on each of the admin procedures. -Any newly added `admin` procedure is automatically included in this privilege. -The following query shows an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor ----- - -Users with the role `adminProcedureExecutor` can then run any `admin` procedure with elevated privileges. - -The resulting role has privileges that allow executing all admin procedures. -List all privileges for the role `adminProcedureExecutor` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO `adminProcedureExecutor`" -a|Rows: 1 -|=== - -In order to compare this with the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges, revisit the `myProc` procedure, but this time as an `admin` procedure, which will give the result `A`, `B` and `C` when allowed to execute. - -By starting with a user only granted with the `EXECUTE PROCEDURE myProc` privilege, execution of the `myProc` procedure is not allowed. - -However, for a user granted with the `EXECUTE BOOSTED PROCEDURE myProc` or `EXECUTE ADMIN PROCEDURES` privileges, the `myProc` procedure returns the result `A`, `B` and `C`. - -Any denied `EXECUTE` privilege results in the procedure not being allowed to be executed. -In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED PROCEDURE` or `EXECUTE ADMIN PROCEDURES` is being denied. - - -[[access-control-execute-user-defined-function]] -=== The `EXECUTE USER DEFINED FUNCTION` privilege - -//EXECUTE [USER [DEFINED]] FUNCTION[S] -The ability to execute a user-defined function (UDF) can be granted via the `EXECUTE USER DEFINED FUNCTION` privilege. -A role with this privilege is allowed to execute the UDFs matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. - -[IMPORTANT] -==== -The `EXECUTE USER DEFINED FUNCTION` privilege does not apply to built-in functions, which are always executable. -==== - -.Execute user-defined function -====== -The following query shows an example of how to grant this privilege: - -[source,cypher,role=noplay] ----- -GRANT EXECUTE USER DEFINED FUNCTION apoc.coll.* ON DBMS TO functionExecutor ----- - -Or in short form: - -[source,cypher,role=noplay] ----- -GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO functionExecutor ----- - -Users with the role `functionExecutor` can thus run any UDF in the `apoc.coll` namespace. -The function here is run using the user's own privileges. - -The resulting role has privileges that only allow executing UDFs in the `apoc.coll` namespace. -List all privileges for the role `functionExecutor` as commands by using the following query: - -[source,cypher,role=noplay] ----- -SHOW ROLE functionExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO `functionExecutor`" -a|Rows: 1 -|=== -====== - -To allow the execution of all but a few UDFs, you can grant `+EXECUTE USER DEFINED FUNCTIONS *+` and deny the unwanted functions. - -.Execute user-defined functions -====== -The following queries allow the execution of all UDFs except those starting with `apoc.any.prop`: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE USER DEFINED FUNCTIONS * ON DBMS TO deniedFunctionExecutor ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE USER DEFINED FUNCTION apoc.any.prop* ON DBMS TO deniedFunctionExecutor ----- - -Or in short form: - -[source, cypher, role=noplay] ----- -GRANT EXECUTE FUNCTIONS * ON DBMS TO deniedFunctionExecutor ----- - -[source, cypher, role=noplay] ----- -DENY EXECUTE FUNCTION apoc.any.prop* ON DBMS TO deniedFunctionExecutor ----- - -The resulting role has privileges that only allow the execution of all procedures except those starting with `apoc.any.prop`. -List all privileges for the role `deniedFunctionExecutor` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedFunctionExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY EXECUTE FUNCTION apoc.any.prop* ON DBMS TO `deniedFunctionExecutor`" -|"GRANT EXECUTE FUNCTION * ON DBMS TO `deniedFunctionExecutor`" -a|Rows: 2 -|=== - -The `apoc.any.property` and `apoc.any.properties` are blocked, as well as any other procedures starting with `apoc.any.prop`. -====== - -[[access-control-execute-boosted-user-defined-function]] -=== The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege - -//EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] -The ability to execute a user-defined function (UDF) with elevated privileges can be granted via the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege. -A user with this privilege is allowed to execute the UDFs matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing] without the execution being restricted to their other privileges. - -There is no need to grant an individual `EXECUTE USER DEFINED FUNCTION` privilege for the functions, as granting `EXECUTE BOOSTED USER DEFINED FUNCTION` includes an implicit `EXECUTE USER DEFINED FUNCTION` grant. -However, a denied `EXECUTE USER DEFINED FUNCTION` still prevents the function to be executed. - -[IMPORTANT] -==== -The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges. -==== - -Granting `EXECUTE BOOSTED USER DEFINED FUNCTION` on its own allows the UDF to be both executed (because of the implicit `EXECUTE USER DEFINED FUNCTION` grant) and gives it elevated privileges during the execution. -A denied `EXECUTE BOOSTED USER DEFINED FUNCTION` on its own behaves slightly differently: it only denies the elevation and not the execution of the UDF. -However, a role with only a granted `EXECUTE BOOSTED USER DEFINED FUNCTION` and a denied `EXECUTE BOOSTED USER DEFINED FUNCTION` prevents the execution to be performed as well. -This is the same behavior as for the xref::administration/access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[`EXECUTE BOOSTED PROCEDURE` privilege]. - -.Execute boosted user-defined function -====== -The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege: - -[source,cypher,role=noplay] ----- -GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor -GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor ----- - -Or in short form: - -[source,cypher,role=noplay] ----- -GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor -GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor ----- - -Users with the role `boostedFunctionExecutor` can thus run `apoc.any.properties` with full privileges and see every property on the node/relationship, not just the properties that the user has `READ` privilege on. - -The resulting role has privileges that only allow executing of the UDF `apoc.any.properties`, but with elevated execution. -List all privileges for the role `boostedFunctionExecutor` as commands by using the following query: - -[source,cypher,role=noplay] ----- -SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer",width="100%",cols="m"] -|=== -|command -|"GRANT EXECUTE FUNCTION * ON DBMS TO `boostedFunctionExecutor`" -|"GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO `boostedFunctionExecutor`" -a|Rows: 2 -|=== -====== - - -[[access-control-dbms-administration-setting]] -== The DBMS `SETTING` privileges - -_This feature was introduced in Neo4j 5.6._ - -The ability to show configuration settings can be granted via the `SHOW SETTING` privilege. -A role with this privilege is allowed to query the configuration settings matched by the xref::administration/access-control/dbms-administration.adoc#access-control-name-globbing[name-globbing]. - - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Setting privileges command syntax -[options="header", width="100%", cols="3a,2"] -|=== -| Command -| Description - -| [source, syntax, role=noheader] -GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...] - ON DBMS - TO role[, ...] -| Enables the specified roles to query given configuration settings. -|=== - -The following query shows an example of how to grant this privilege: - -[source, cypher, role=noplay] ----- -GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer ----- - -Users with the role `configurationViewer` can then query any setting in the `server.bolt` namespace. - -The updated role `configurationViewer` has privileges that only allow querying settings in the `server.bolt` namespace. -List all privileges for the role `configurationViewer` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT SHOW SETTING server.bolt.* ON DBMS TO `configurationViewer`" -a|Rows: 1 -|=== - -To deny a specific setting from a role, first grant `SHOW SETTINGS *`, and then deny the unwanted setting. -For example, the following queries allow the querying of all settings, except those starting with `dbms.security`: - -[source, cypher, role=noplay] ----- -GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer ----- - -[source, cypher, role=noplay] ----- -DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer ----- - -The resulting role has privileges that allow querying all settings except those starting with `dbms.security`. -List all privileges for the role `deniedConfigurationViewer` as commands by using the following query: - -[source, cypher, role=noplay] ----- -SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY SHOW SETTING dbms.security* ON DBMS TO `deniedConfigurationViewer`" -|"GRANT SHOW SETTING * ON DBMS TO `deniedConfigurationViewer`" -a|Rows: 2 -|=== - -As the query result shows, access to any setting starting with `dbms.security` are blocked, but the rest can still be queried. - - -[[access-control-dbms-administration-all]] -== Granting `ALL DBMS PRIVILEGES` - -The right to perform the following privileges can be achieved with a single command: - -* Create, drop, assign, remove, and show roles. -* Create, alter, drop, show, and impersonate users. -* Create, alter, and drop databases and aliases. -* Enable, alter, rename, reallocate, deallocate, and drop servers -* Show, assign, and remove privileges. -* Execute all procedures with elevated privileges. -* Execute all user defined functions with elevated privileges. -* Show all configuration settings. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[source, syntax, role=noheader] ----- -GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES] - ON DBMS - TO role[, ...] ----- - -For example, to grant the role `dbmsManager` the abilities above, use the following query: - -[source, cypher, role=noplay] ----- -GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager ----- - -The privileges granted can be seen using the `SHOW PRIVILEGES` command: - -[source, cypher, role=noplay] ----- -SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `dbmsManager`" -a|Rows: 1 -|=== - -[[access-control-name-globbing]] -== Name-globbing for procedures, user-defined functions, and settings - -The name-globbing for procedure, user defined function, and setting names is a simplified version of globbing for filename expansions. -It only allows two wildcard characters: `+*+` and `?`, which are used for multiple and single character matches. -In this case, `+*+` means 0 or more characters and `?` matches exactly one character. - -[NOTE] -==== -The name-globbing is subject to the xref::syntax/naming.adoc[standard Cypher restrictions on valid identifiers], -with the exception that it may include dots, stars, and question marks without the need for escaping using backticks. - -Each part of the name-globbing separated by dots may be individually escaped. -For example, `++mine.`procedureWith%`++` is allowed, but not `++mine.procedure`With%`++`. -Also, note that wildcard characters behave as wildcards even when escaped. -For example, using `++`*`++` is equivalent to using `+*+`, and thus allows executing all functions or procedures and not only the procedure or function named `+*+`. -==== - -Given the following list of procedures: - -* `mine.public.exampleProcedure` -* `mine.public.exampleProcedure1` -* `mine.public.exampleProcedure2` -* `mine.public.with#Special§Characters` -* `mine.private.exampleProcedure` -* `mine.private.exampleProcedure1` -* `mine.private.exampleProcedure2` -* `mine.private.with#Special§Characters` -* `your.exampleProcedure` - -The following examples demonstrate how name-globbing patterns can be used in controlling access to procedures. -Note that the same rules apply to user-defined functions and settings. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1 ----- - -Users with the role `globbing1` can run all the procedures. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2 ----- - -Users with the role `globbing2` can run procedures `mine.public.exampleProcedure` and `mine.private.exampleProcedure`, but no other procedures. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3 ----- - -Users with the role `globbing3` can run procedures `mine.public.exampleProcedure1`, `mine.private.exampleProcedure1`, and `mine.private.exampleProcedure2`, but no other procedures. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4 ----- - -Users with the role `globbing4` can run procedures `your.exampleProcedure`, `mine.public.exampleProcedure`, and `mine.private.exampleProcedure`, but no other procedures. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5 ----- - -Users with the role `globbing5` can run procedures `mine.public.exampleProcedure`, `mine.public.exampleProcedure1` and `mine.public.exampleProcedure42`, but no other procedures. - -[source, cypher, role=noplay] ----- -GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6 ----- - -Users with the role `globbing6` can run procedures `mine.public.with#Special§Characters`, and `mine.private.with#Special§Characters`, but no other procedures. - -[NOTE] -==== -The name-globbing may be fully or partially escaped. -Both `+*+` and `+?+` are interpreted as wildcards in both cases. -==== - diff --git a/modules/ROOT/pages/administration/access-control/index.adoc b/modules/ROOT/pages/administration/access-control/index.adoc deleted file mode 100644 index 5506d1f1c..000000000 --- a/modules/ROOT/pages/administration/access-control/index.adoc +++ /dev/null @@ -1,37 +0,0 @@ -:description: Neo4j role-based access control and fine-grained security. - -[[access-control]] -= Access control - -== Overview - -Neo4j has a complex security model stored in the system graph, which is maintained on a special database called the `system` database. -All administrative commands need to be executed against the `system` database. -When connected to the DBMS over link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/connectors[Bolt], administrative commands are automatically routed to the `system` database. -For more information on how to manage multiple databases, refer to the section on xref::administration/databases.adoc[administering databases]. - -_Role-based access control_ was introduced in Neo4j 3.1. -Since then, it has been possible to create users and assign them to roles to control whether users can read, write and administer the database. -In Neo4j 4.0 this model was enhanced significantly with the addition of _privileges_, which are the underlying access-control rules by which the users rights are defined. - -The original built-in roles still exist with almost the exact same access rights, but they are no-longer statically defined (see xref::administration/access-control/built-in-roles.adoc[Built-in roles]). -Instead, they are defined in terms of their underlying _privileges_, and they can be modified by adding or removing these access rights. - -In addition, any newly created roles can be assigned to any combination of _privileges_, so that you may set specific access controls for them. -Another new major capability is the _sub-graph_ access control, through which read access to the graph can be limited to specific combinations of labels, relationship types, and properties. - -== Categories of access control - -More details about specific categories of access control can be found in the following sections: - -* xref:administration/access-control/manage-users.adoc[] -* xref:administration/access-control/manage-roles.adoc[] -* xref:administration/access-control/manage-privileges.adoc[] -* xref:administration/access-control/built-in-roles.adoc[] -* xref:administration/access-control/privileges-reads.adoc[] -* xref:administration/access-control/privileges-writes.adoc[] -* xref:administration/access-control/database-administration.adoc[] -* xref:administration/access-control/dbms-administration.adoc[] -* xref:administration/access-control/limitations.adoc[] -* xref:administration/access-control/privileges-immutable.adoc[] - diff --git a/modules/ROOT/pages/administration/access-control/limitations.adoc b/modules/ROOT/pages/administration/access-control/limitations.adoc deleted file mode 100644 index 25d563b31..000000000 --- a/modules/ROOT/pages/administration/access-control/limitations.adoc +++ /dev/null @@ -1,337 +0,0 @@ -:description: Known limitations and implications of Neo4js role-based access control security. - -//// -[source, cypher, role=test-setup] ----- -CREATE ROLE users; -CREATE ROLE custom; -CREATE ROLE restricted; -CREATE ROLE free; ----- -//// - -[role=enterprise-edition aura-db-enterprise] -[[access-control-limitations]] -= Limitations - -[abstract] --- -This section lists the known limitations and implications of Neo4js role-based access control security. --- - -[[access-control-limitations-indexes]] -== Security and Indexes - -As described in xref::indexes-for-search-performance.adoc[Indexes for search performance], Neo4j {neo4j-version} supports the creation and use of indexes to improve the performance of Cypher queries. - -Note that the Neo4j security model impacts the results of queries, regardless if the indexes are used or not. -When using non full-text Neo4j indexes, a Cypher query will always return the same results it would have if no index existed. -This means that, if the security model causes fewer results to be returned due to restricted read access in xref::administration/access-control/manage-privileges.adoc[Graph and sub-graph access control], -the index will also return the same fewer results. - -However, this rule is not fully obeyed by xref::indexes-for-full-text-search.adoc[Indexes for full-text search]. -These specific indexes are backed by _Lucene_ internally. -It is therefore not possible to know for certain whether a security violation has affected each specific entry returned from the index. -In face of this, Neo4j will return zero results from full-text indexes in case it is determined that any result might be violating the security privileges active for that query. - -Since full-text indexes are not automatically used by Cypher, they do not lead to the case where the same Cypher query would return different results simply because such an index was created. -Users need to explicitly call procedures to use these indexes. -The problem is only that, if this behavior is not known by the user, they might expect the full-text index to return the same results that a different, but semantically similar, Cypher query does. - -=== Example with denied properties - -Consider the following example. -The database has nodes with labels `:User` and `:Person`, and they have properties `name` and `surname`. -There are indexes on both properties: - -[source, cypher] ----- -CREATE INDEX singleProp FOR (n:User) ON (n.name); -CREATE INDEX composite FOR (n:User) ON (n.name, n.surname); -CREATE FULLTEXT INDEX userNames FOR (n:User|Person) ON EACH [n.name, n.surname]; ----- - -[NOTE] -==== -Full-text indexes support multiple labels. -See xref::indexes-for-full-text-search.adoc[Indexes for full-text search] for more details on creating and using full-text indexes. -==== - -After creating these indexes, it would appear that the latter two indexes accomplish the same thing. -However, this is not completely accurate. -The composite and full-text indexes behave in different ways and are focused on different use cases. -A key difference is that full-text indexes are backed by _Lucene_, and will use the _Lucene_ syntax for querying. - -This has consequences for users restricted on the labels or properties involved in the indexes. -Ideally, if the labels and properties in the index are denied, they can correctly return zero results from both native indexes and full-text indexes. -However, there are borderline cases where this is not as simple. - -Imagine the following nodes were added to the database: - -[source, cypher] ----- -CREATE (:User {name: 'Sandy'}); -CREATE (:User {name: 'Mark', surname: 'Andy'}); -CREATE (:User {name: 'Andy', surname: 'Anderson'}); -CREATE (:User:Person {name: 'Mandy', surname: 'Smith'}); -CREATE (:User:Person {name: 'Joe', surname: 'Andy'}); ----- - -Consider denying the label `:Person`: - -[source, cypher] ----- -DENY TRAVERSE ON GRAPH * NODES Person TO users ----- - -If the user runs a query that uses the native single property index on `name`: - -[source, cypher] ----- -MATCH (n:User) WHERE n.name CONTAINS 'ndy' RETURN n.name ----- - -This query performs several checks: - -* Scans the index to create a stream of results of nodes with the `name` property, which leads to five results. -* Filters the results to include only nodes where `n.name CONTAINS 'ndy'`, filtering out `Mark` and `Joe`, which leads to three results. -* Filters the results to exclude nodes that also have the denied label `:Person`, filtering out `Mandy`, which leads to two results. - -Two results will be returned from this dataset and only one of them has the `surname` property. - -In order to use the native composite index on `name` and `surname`, the query needs to include a predicate on the `surname` property as well: - -[source, cypher] ----- -MATCH (n:User) -WHERE n.name CONTAINS 'ndy' AND n.surname IS NOT NULL -RETURN n.name ----- - -This query performs several checks, which are almost identical to the single property index query: - -* Scans the index to create a stream of results of nodes with the `name` and `surname` property, which leads to four results. -* Filters the results to include only nodes where `n.name CONTAINS 'ndy'`, filtering out `Mark` and `Joe`, which leads to two results. -* Filters the results to exclude nodes that also have the denied label `:Person`, filtering out `Mandy`, which leads to only one result. - -Only one result was returned from the above dataset. -What if this query with the full-text index was used instead: - -[source, cypher] ----- -CALL db.index.fulltext.queryNodes("userNames", "ndy") YIELD node, score -RETURN node.name ----- - -The problem now is that it is not certain whether the results provided by the index were achieved due to a match to the `name` or the `surname` property. -The steps taken by the query engine would be: - -* Run a _Lucene_ query on the full-text index to produce results containing `ndy` in either property, leading to five results. -* Filter the results to exclude nodes that also have the label `:Person`, filtering out `Mandy` and `Joe`, leading to three results. - -This difference in results is caused by the `OR` relationship between the two properties in the index creation. - -=== Denying properties - -Now consider denying access on properties, like the `surname` property: - -[source, cypher] ----- -DENY READ {surname} ON GRAPH * TO users ----- - -For that, run the same queries again: - -[source, cypher] ----- -MATCH (n:User) -WHERE n.name CONTAINS 'ndy' -RETURN n.name ----- - -This query operates exactly as before, returning the same two results, because nothing in it relates to the denied property. - -However, this is not the same for the query targeting the composite index: - -[source, cypher] ----- -MATCH (n:User) -WHERE n.name CONTAINS 'ndy' AND n.surname IS NOT NULL -RETURN n.name ----- - -Since the `surname` property is denied, it will appear to always be `null` and the composite index empty. Therefore, the query returns no result. - -Now consider the full-text index query: - -[source, cypher] ----- -CALL db.index.fulltext.queryNodes("userNames", "ndy") YIELD node, score -RETURN node.name ----- - -The problem remains, since it is not certain whether the results provided by the index were returned due to a match on the `name` or the `surname` property. -Results from the `surname` property now need to be excluded by the security rules, because they require that the user is unable to see any `surname` properties. -However, the security model is not able to introspect the _Lucene_ query in order to know what it will actually do, whether it works only on the allowed `name` property, or also on the disallowed `surname` property. -What is known is that the earlier query returned a match for `Joe Andy` which should now be filtered out. -Therefore, in order to never return results the user should not be able to see, all results need to be blocked. -The steps taken by the query engine would be: - -* Determine if the full-text index includes denied properties. -* If yes, return an empty results stream. -Otherwise, it will process as described before. - -In this case, the query will return zero results rather than simply returning the results `Andy` and `Sandy`, which might have been expected. - - -[[access-control-limitations-labels]] -== Security and labels - -=== Traversing the graph with multi-labeled nodes - -The general influence of access control privileges on graph traversal is described in detail in xref::administration/access-control/manage-privileges.adoc[Graph and sub-graph access control]. -The following section will only focus on nodes due to their ability to have multiple labels. -Relationships can only have one type of label and thus they do not exhibit the behavior this section aims to clarify. -While this section will not mention relationships further, the general function of the traverse privilege also applies to them. - -For any node that is traversable, due to `GRANT TRAVERSE` or `GRANT MATCH`, -the user can get information about the attached labels by calling the built-in `labels()` function. -In the case of nodes with multiple labels, they can be returned to users that weren't directly granted access to. - -To give an illustrative example, imagine a graph with three nodes: one labeled `:A`, another labeled `:B` and one with the labels `:A` and `:B`. -In this case, there is a user with the role `custom` defined by: - -[source, cypher] ----- -GRANT TRAVERSE ON GRAPH * NODES A TO custom ----- - -If that user were to execute - -[source, cypher] ----- -MATCH (n:A) -RETURN n, labels(n) ----- - -They would get a result with two nodes: the node that was labeled with `:A` and the node with labels `:A :B`. - -In contrast, executing - -[source, cypher] ----- -MATCH (n:B) -RETURN n, labels(n) ----- - -This will return only the one node that has both labels: `:A` and `:B`. -Even though `:B` did not have access to traversals, there is one node with that label accessible in the dataset due to the allow-listed label `:A` that is attached to the same node. - -If a user is denied to traverse on a label they will never get results from any node that has this label attached to it. -Thus, the label name will never show up for them. -As an example, this can be done by executing: - -[source, cypher] ----- -DENY TRAVERSE ON GRAPH * NODES B TO custom ----- - -The query - -[source, cypher] ----- -MATCH (n:A) -RETURN n, labels(n) ----- - -will now return the node only labeled with `:A`, while the query - -[source, cypher] ----- -MATCH (n:B) -RETURN n, labels(n) ----- - -will now return no nodes. - -=== The db.labels() procedure - -In contrast to the normal graph traversal described in the previous section, the built-in `db.labels()` procedure is not processing the data graph itself, but the security rules defined on the system graph. -That means: - -* If a label is explicitly whitelisted (granted), it will be returned by this procedure. -* If a label is denied or isn't explicitly allowed, it will not be returned by this procedure. - -Reusing the previous example, imagine a graph with three nodes: one labeled `:A`, another labeled `:B` and one with the labels `:A` and `:B`. -In this case, there is a user with the role `custom` defined by: - -[source, cypher] ----- -GRANT TRAVERSE ON GRAPH * NODES A TO custom ----- - -This means that only label `:A` is explicitly allow-listed. -Thus, executing - -[source, cypher] ----- -CALL db.labels() ----- - -will only return label `:A`, because that is the only label for which traversal was granted. - - -[[access-control-limitations-db-operations]] -== Security and count store operations - -The rules of a security model may impact some of the database operations. -This means extra security checks are necessary to incur additional data accesses, especially in the case of count store operations. -These are, however, usually very fast lookups and the difference might be noticeable. - -See the following security rules that use a `restricted` and a `free` role as an example: - -[source, cypher] ----- -GRANT TRAVERSE ON GRAPH * NODES Person TO restricted; -DENY TRAVERSE ON GRAPH * NODES Customer TO restricted; -GRANT TRAVERSE ON GRAPH * ELEMENTS * TO free; ----- - -Now, let's look at what the database needs to do in order to execute the following query: - -[source, cypher] ----- -MATCH (n:Person) -RETURN count(n) ----- - -For both roles the execution plan will look like this: - ----- -+--------------------------+ -| Operator | -+--------------------------+ -| +ProduceResults | -| | + -| +NodeCountFromCountStore | -+--------------------------+ ----- - -Internally, however, very different operations need to be executed. -The following table illustrates the difference: - -[%header,cols=2*] -|=== -|User with `free` role -|User with `restricted` role - -|The database can access the count store and retrieve the total number of nodes with the label `:Person`. - -This is a very quick operation. - -|The database cannot access the count store because it must make sure that only traversable nodes with the desired label `:Person` are counted. -Due to this, each node with the `:Person` label needs to be accessed and examined to make sure that they do not have a deny-listed label, such as `:Customer`. - -Due to the additional data accesses that the security checks need to do, this operation will be slower compared to executing the query as an unrestricted user. - -|=== diff --git a/modules/ROOT/pages/administration/access-control/manage-privileges.adoc b/modules/ROOT/pages/administration/access-control/manage-privileges.adoc deleted file mode 100644 index 238954cc4..000000000 --- a/modules/ROOT/pages/administration/access-control/manage-privileges.adoc +++ /dev/null @@ -1,1436 +0,0 @@ -:description: This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. -[role=enterprise-edition aura-db-enterprise] -[[access-control-manage-privileges]] - -= Managing privileges - -[abstract] --- -This section explains how to use Cypher to manage privileges for Neo4j role-based access control and fine-grained security. --- - -Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. -It is possible to grant or deny access, or use a combination of the two. -The user will be able to access the resource if they have a `GRANT` (allowlist) and do not have a `DENY` (denylist) relevant to that resource. -All other combinations of `GRANT` and `DENY` will result in the matching path being inaccessible. -What this means in practice depends on whether we are talking about a xref::administration/access-control/privileges-reads.adoc[read privilege] or a xref::administration/access-control/privileges-writes.adoc[write privilege]: - -* If an entity is not accessible due to xref::administration/access-control/privileges-reads.adoc[read privileges], the data will become invisible. -It will appear to the user as if they had a smaller database (smaller graph). -* If an entity is not accessible due to xref::administration/access-control/privileges-writes.adoc[write privileges], an error will occur on any attempt to write that data. - -[NOTE] -==== -In this document we will often use the terms _'allows'_ and _'enables'_ in seemingly identical ways. However, there is a subtle difference. -We will use _'enables'_ to refer to the consequences of xref::administration/access-control/privileges-reads.adoc[read privileges] where a restriction will not cause an error, only a reduction in the apparent graph size. -We will use _'allows'_ to refer to the consequence of xref::administration/access-control/privileges-writes.adoc[write privileges] where a restriction can result in an error. -==== - -[NOTE] -==== -If a user was not also provided with the database `ACCESS` privilege, then access to the entire database will be denied. -Information about the database access privilege can be found in xref::administration/access-control/database-administration.adoc#access-control-database-administration-access[The ACCESS privilege]. -==== - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[[access-control-graph-privileges]] -== Graph privilege commands (`GRANT`, `DENY` and `REVOKE`) - -Administrators can use Cypher commands to manage Neo4j graph administrative rights. -The components of the graph privilege commands are: - -* _the command_: -** `GRANT` – gives privileges to roles. -** `DENY` – denies privileges to roles. -** `REVOKE` – removes granted or denied privileges from roles. - -* _mutability_: -** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. See also xref:administration/access-control/index.adoc#access-control-privileges-immutable[immutable privileges]. - -* _graph-privilege_: -** Can be either a xref::administration/access-control/privileges-reads.adoc[read privilege] or xref::administration/access-control/privileges-writes.adoc[write privilege]. - -* _name_: -** The graph or graphs to associate the privilege with. -Because in Neo4j {neo4j-version} you can have only one graph per database, this command uses the database name or alias to refer to that graph. -When using an alias, the command will be executed on the resolved graph. -+ -[NOTE] -==== -If you delete a database and create a new one with the same name, the new one will _NOT_ have the privileges previously assigned to the deleted graph. -==== -** It can be `+*+`, which means all graphs. -Graphs created after this command execution will also be associated with these privileges. - -** `HOME GRAPH` refers to the graph associated with the home database for that user. -The default database will be used as home database if a user does not have one configured. -If the user's home database changes for any reason after privileges have been created, then these privileges will be associated with the graph attached to the new database. -This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user's home database. - -* _entity_ -** The graph elements this privilege applies to: -*** `NODES` label (nodes with the specified label(s)). -*** `RELATIONSHIPS` type (relationships of the specific type(s)). -*** `ELEMENTS` label (both nodes and relationships). -** The label or type can be referred with `+*+`, which means all labels or types. -** Multiple labels or types can be specified, comma-separated. -** Defaults to `ELEMENTS` `+*+` if omitted. -** Some of the commands for write privileges do not allow an _entity_ part. -See xref::administration/access-control/privileges-writes.adoc[Write privileges] for details. -* _role[, ...]_ -** The role or roles to associate the privilege with, comma-separated. - -.General grant +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +GRANT ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -GRANT [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] ----- - -| Description -a| Grants a privilege to one or multiple roles. - -|=== - -.General deny +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +DENY ... ON ... TO ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -DENY [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] TO role[, ...] ----- - -| Description -a| Denies a privilege to one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE GRANT ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] GRANT graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] ----- -| Description -a| Revokes a granted privilege from one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE DENY ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] DENY graph-privilege ON { HOME GRAPH \| GRAPH[S] {* \| name[, ...] } } [entity] FROM role[, ...] ----- - -| Description -a| Revokes a denied privilege from one or multiple roles. - -|=== - -.General revoke +ON GRAPH+ privilege syntax -[cols="<15s,<85"] -|=== - -| Command -m| +REVOKE ... ON ... FROM ...+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -REVOKE [IMMUTABLE] graph-privilege ON { HOME GRAPH \| GRAPH[S] { * \| name[, ...] } } [entity] FROM role[, ...] ----- - -| Description -| Revokes a granted or denied privilege from one or multiple roles. -|=== - -[NOTE] -==== -`DENY` does NOT erase a granted privilege; they both exist. -Use `REVOKE` if you want to remove a privilege. -==== - -The general `GRANT` and `DENY` syntaxes are illustrated in the following image: - -image::privileges_grant_and_deny_syntax.svg[title="GRANT and DENY Syntax"] - -A more detailed syntax illustration for graph privileges would be the following: - -image::privileges_on_graph_syntax.svg[title="Syntax of GRANT and DENY Graph Privileges. The `{` and `}` are part of the syntax and not used for grouping."] - -The following image shows the hierarchy between different graph privileges: - -image::privileges_hierarchy.svg[title="Graph privileges hierarchy"] - -[[access-control-list-privileges]] -== Listing privileges - -Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. - -.Show privileges command syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- -| Description -| List all privileges. - -|=== - -.Show role privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW ROLE ... PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -| Lists privileges for a specific role. - -|=== - -.Show user privileges syntax -[cols="<15s,<85"] -|=== - -| Command -m| +SHOW USER ... PRIVILEGE+ - -| Syntax -a| -[source, syntax, role="noheader", indent=0] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -| Lists privileges for a specific user, or the current user. - -[NOTE] -==== -Please note that it is only possible for a user to show their own privileges. -Therefore, if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work in a limited capacity. - -Other users' privileges cannot be listed when using a non-native auth provider. -==== -|=== - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For an easy overview of the existing privileges, it is recommended to use the `AS COMMANDS` version of the `SHOW` command. -This returns the column `command` of type `STRING` containing the privileges as the commands that are granted or denied. - -When omitting the `AS COMMANDS` clause, results will include multiple columns describing privileges: - -[options="header", width="100%", cols="4m,6a,2m"] -|=== -| Column | Description | Type - -| access -| Whether the privilege is granted or denied. -| STRING - -| action -| The type of the privilege. -E.g., traverse, read, index management, or role management. -| STRING - -| resource -| The scope of the privilege. -E.g., the entire DBMS, a specific database, a graph, or sub-graph access. -| STRING - -| graph -| The specific database or graph the privilege applies to. -| STRING - -| segment -| The labels, relationship types, procedures, functions, transactions or settings the privilege applies to (if applicable). -| STRING - -| role -| The role the privilege is granted to. -| STRING - -| immutable -| Whether or not the privilege is immutable. - -This column is also available for the `AS COMMAND` variant using `YIELD`. -| BOOLEAN - -| user -| The user the privilege belongs to. - -Note that this is only returned for `SHOW USER [username] PRIVILEGES`. -| STRING - -|=== - -[[access-control-list-all-privileges]] -=== Examples for listing all privileges - -Available privileges can be displayed using the different `SHOW PRIVILEGE[S]` commands. - -[source, syntax] ----- -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES ----- - -Lists all privileges for all roles: - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|segment -|role -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"admin" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"admin" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"admin" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"admin" -|false - -|"GRANTED" -|"transaction_management" -|"database" -|"*" -|"USER(*)" -|"admin" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"constraint" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"dbms_actions" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"index" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"start_database" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"stop_database" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"admin" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"architect" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"architect" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"architect" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"architect" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"constraint" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"index" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"architect" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"editor" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"editor" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"editor" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"editor" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"editor" -|false - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"publisher" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"NODE(*)" -|"publisher" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"publisher" -|false - -|"GRANTED" -|"write" -|"graph" -|"*" -|"RELATIONSHIP(*)" -|"publisher" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"publisher" -|false - -|"GRANTED" -|"token" -|"database" -|"*" -|"database" -|"publisher" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"NODE(*)" -|"reader" -|false - -|"GRANTED" -|"match" -|"all_properties" -|"*" -|"RELATIONSHIP(*)" -|"reader" -|false - -|"GRANTED" -|"access" -|"database" -|"*" -|"database" -|"reader" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 39 -|=== - -It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD role, access, action, segment -ORDER BY action -WHERE role = 'admin' ----- - -In this example: - -* The number of columns returned has been reduced with the `YIELD` clause. -* The order of the returned columns has been changed. -* The results have been filtered to only return the `admin` role using a `WHERE` clause. -* The results are ordered by the `action` column using `ORDER BY`. - -`SKIP` and `LIMIT` can also be used to paginate the results. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m"] -|=== -|role -|access -|action -|segment - -|"admin" -|"GRANTED" -|"access" -|"database" - -|"admin" -|"GRANTED" -|"constraint" -|"database" - -|"admin" -|"GRANTED" -|"dbms_actions" -|"database" - -|"admin" -|"GRANTED" -|"index" -|"database" - -|"admin" -|"GRANTED" -|"match" -|"NODE(*)" - -|"admin" -|"GRANTED" -|"match" -|"RELATIONSHIP(*)" - -|"admin" -|"GRANTED" -|"start_database" -|"database" - -|"admin" -|"GRANTED" -|"stop_database" -|"database" - -|"admin" -|"GRANTED" -|"token" -|"database" - -|"admin" -|"GRANTED" -|"transaction_management" -|"USER(*)" - -|"admin" -|"GRANTED" -|"write" -|"NODE(*)" - -|"admin" -|"GRANTED" -|"write" -|"RELATIONSHIP(*)" - -4+a|Rows: 12 -|=== - -`WHERE` can also be used without `YIELD`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES -WHERE graph <> '*' ----- - -In this example, the `WHERE` clause is used to filter privileges down to those that target specific graphs only. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment - -|"GRANTED" -|"access" -|"DEFAULT" -|"database" -|"PUBLIC" -|"database" - -|"DENIED" -|"access" -|"neo4j" -|"database" -|"noAccessUsers" -|"database" - -|"GRANTED" -|"access" -|"neo4j" -|"database" -|"regularUsers" -|"database" - -6+a|Rows: 3 -|=== - -Aggregations in the `RETURN` clause can be used to group privileges. -In this case, by user and `GRANTED` or `DENIED`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) AS privileges ----- - -.Result -[options="header,footer", width="100%", cols="1m,1m,3m"] -|=== -|role -|access -|privileges - -|"PUBLIC" -|"GRANTED" -|[["\*","database","FUNCTION(*)","execute"],["\*","database","PROCEDURE(*)","execute"],["DEFAULT","database","database","access"]] - -|"admin" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","USER(*)","transaction_management"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","dbms_actions"],["*","database","database","index"],["\*","database","database","start_database"],["*","database","database","stop_database"],["*","database","database","token"]] - -|"architect" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","constraint"],["\*","database","database","index"],["*","database","database","token"]] - -|"editor" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"]] - -|"noAccessUsers" -|"DENIED" -|[["neo4j","database","database","access"]] - -|"publisher" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","graph","NODE(*)","write"],["\*","all_properties","RELATIONSHIP(*)","match"],["\*","graph","RELATIONSHIP(*)","write"],["\*","database","database","access"],["*","database","database","token"]] - -|"reader" -|"GRANTED" -|[["\*","all_properties","NODE(*)","match"],["\*","all_properties","RELATIONSHIP(*)","match"],["*","database","database","access"]] - -|"regularUsers" -|"GRANTED" -|[["neo4j","database","database","access"]] - -3+a|Rows: 8 -|=== - -The `RETURN` clause can also be used to order and paginate the results, which is useful when combined with `YIELD` and `WHERE`. -In this example the query returns privileges for display five-per-page, and skips the first five to display the second page. - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5 ----- - -.Result -[options="header,footer", width="100%", cols="2m,2m,1m,2m,1m,2m,1m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"match" -|"*" -|"all_properties" -|"admin" -|"RELATIONSHIP(*)" -|false - -|"GRANTED" -|"write" -|"*" -|"graph" -|"admin" -|"RELATIONSHIP(*)" -|false - -|"GRANTED" -|"transaction_management" -|"*" -|"database" -|"admin" -|"USER(*)" -|false - -|"GRANTED" -|"access" -|"*" -|"database" -|"admin" -|"database" -|false - -|"GRANTED" -|"constraint" -|"*" -|"database" -|"admin" -|"database" -|false - -6+a|Rows: 5 -|=== - -Available privileges can also be displayed as Cypher commands by adding `AS COMMAND[S]`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" -|"GRANT ACCESS ON DATABASE * TO `admin`" -|"GRANT ACCESS ON DATABASE * TO `architect`" -|"GRANT ACCESS ON DATABASE * TO `editor`" -|"GRANT ACCESS ON DATABASE * TO `publisher`" -|"GRANT ACCESS ON DATABASE * TO `reader`" -|"GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" -|"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" -|"GRANT START ON DATABASE * TO `admin`" -|"GRANT STOP ON DATABASE * TO `admin`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `architect`" -|"GRANT WRITE ON GRAPH * TO `editor`" -|"GRANT WRITE ON GRAPH * TO `publisher`" -a|Rows: 35 -|=== - -Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS COMMANDS -WHERE command CONTAINS 'MANAGEMENT' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -a|Rows: 8 -|=== - -It is also possible to get the privileges listed as revoking commands instead of granting or denying: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES AS REVOKE COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE DENY ACCESS ON DATABASE `neo4j` FROM `noAccessUsers`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `admin`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `architect`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `editor`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`" -|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" -|"REVOKE GRANT ACCESS ON DATABASE `neo4j` FROM `regularUsers`" -|"REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`" -|"REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`" -|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM `PUBLIC`" -|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`" -|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`" -|"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`" -|"REVOKE GRANT START ON DATABASE * FROM `admin`" -|"REVOKE GRANT STOP ON DATABASE * FROM `admin`" -|"REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `admin`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `architect`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `editor`" -|"REVOKE GRANT WRITE ON GRAPH * FROM `publisher`" -a|Rows: 35 -|=== - -For more info about revoking privileges, please see xref::administration/access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. - -[[access-control-list-privileges-role]] -=== Examples for listing privileges for specific roles - -Available privileges for specific roles can be displayed using `SHOW ROLE name PRIVILEGE[S]`: - -[source, syntax] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW ROLE regularUsers PRIVILEGES ----- - -Lists all privileges for role `regularUsers`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 1 -|=== - -[source, cypher, role=noplay] ----- -SHOW ROLES regularUsers, noAccessUsers PRIVILEGES ----- - -Lists all privileges for roles `regularUsers` and `noAccessUsers`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|graph -|resource -|role -|segment -|immutable - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|false - -6+a|Rows: 2 -|=== - -Similar to the other `SHOW PRIVILEGES` commands, the available privileges for roles can also be listed as Cypher commands with the optional `AS COMMAND[S]`. - -[source, cypher, role=noplay] ----- -SHOW ROLES regularUsers, noAccessUsers PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE * TO `admin`" -|"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" -|"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" -|"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" -|"GRANT START ON DATABASE * TO `admin`" -|"GRANT STOP ON DATABASE * TO `admin`" -|"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" -|"GRANT WRITE ON GRAPH * TO `admin`" -a|Rows: 11 -|=== - -The output can be processed using `YIELD` / `WHERE` / `RETURN` here as well: - -[source, cypher, role=noplay] ----- -SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" -|"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" -|Rows: 2 -|=== - -Again, it is possible to get the privileges listed as revoking commands instead of granting or denying. -For more info about revoking privileges, please see xref::administration/access-control/manage-privileges.adoc#access-control-revoke-privileges[The REVOKE command]. - -[source, cypher, role=noplay] ----- -SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" -|"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" -a|Rows: 3 -|=== - -[[access-control-list-privileges-user]] -=== Examples for listing privileges for specific users - -Available privileges for specific users can be displayed using `SHOW USER name PRIVILEGES`. - -[NOTE] -==== -Note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity as it is only possible for a user to show their own privileges. -Other users' privileges cannot be listed when using a non-native auth provider. -==== - -[source, syntax] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [WHERE expression] - -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES ----- - -Lists all privileges for user `jake`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|"jake" -|false - -7+a|Rows: 4 -|=== - -[source, cypher, role=noplay] ----- -SHOW USERS jake, joe PRIVILEGES ----- - -Lists all privileges for users `jake` and `joe`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|resource -|role -|segment -|immutable - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"jake" -|false - -|"GRANTED" -|"access" -|"database" -|"neo4j" -|"database" -|"regularUsers" -|"jake" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"FUNCTION(*)" -|"PUBLIC" -|"joe" -|false - -|"GRANTED" -|"execute" -|"database" -|"*" -|"PROCEDURE(*)" -|"PUBLIC" -|"joe" -|false - -|"GRANTED" -|"access" -|"database" -|"DEFAULT" -|"database" -|"PUBLIC" -|"joe" -|false - -|"DENIED" -|"access" -|"database" -|"neo4j" -|"database" -|"noAccessUsers" -|"joe" -|false - -7+a|Rows: 8 -|=== - -The same command can be used at all times to review available privileges for the current user. -For this purpose, there is a shorter form of the command: `SHOW USER PRIVILEGES`: - -[source, cypher, role=noplay] ----- -SHOW USER PRIVILEGES ----- - -As for the other privilege commands, available privileges for users can also be listed as Cypher commands with the optional `AS COMMAND[S]`. - -[NOTE] -==== -When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. -This can be used to quickly create new roles based on the privileges of specific users. -==== - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES AS COMMANDS ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"GRANT ACCESS ON DATABASE `neo4j` TO $role" -|"GRANT ACCESS ON HOME DATABASE TO $role" -|"GRANT EXECUTE FUNCTION * ON DBMS TO $role" -|"GRANT EXECUTE PROCEDURE * ON DBMS TO $role" -a|Rows: 4 -|=== - -Like other `SHOW` commands, the output can also be processed using `YIELD` / `WHERE` / `RETURN`. -Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges. - -[source, cypher, role=noplay] ----- -SHOW USER jake PRIVILEGES AS REVOKE COMMANDS -WHERE command CONTAINS 'EXECUTE' ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|command -|"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM $role" -|"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role" -a|Rows: 2 -|=== - -[[access-control-revoke-privileges]] -== Revoking privileges - -Privileges that were granted or denied earlier can be revoked using the `REVOKE` command: - -[source, syntax] ----- -REVOKE - [ IMMUTABLE ] - [ GRANT | DENY ] graph-privilege - FROM role[, ...] ----- - -An example usage of the `REVOKE` command is given here: - -[source, cypher, role=noplay] ----- -REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers ----- - -While it can be explicitly specified that `REVOKE` should remove a `GRANT` or `DENY`, it is also possible to `REVOKE` both by not specifying them at all, as the next example demonstrates. -Because of this, if there happens to be a `GRANT` and a `DENY` for the same privilege, it would remove both. - -[source, cypher, role=noplay] ----- -REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers ----- - -Adding `IMMUTABLE` explicitly specifies that only immutable privileges should be removed. Omitting it specifies that both immutable and regular privileges should be removed. diff --git a/modules/ROOT/pages/administration/access-control/manage-roles.adoc b/modules/ROOT/pages/administration/access-control/manage-roles.adoc deleted file mode 100644 index 16b1afd87..000000000 --- a/modules/ROOT/pages/administration/access-control/manage-roles.adoc +++ /dev/null @@ -1,816 +0,0 @@ -:description: This section explains how to use Cypher to manage roles in Neo4j. - -[role=enterprise-edition aura-db-enterprise] -[[access-control-manage-roles]] -= Managing roles - -//// -[source, cypher, role=test-setup] ----- -CREATE USER bob SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user1 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user2 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE USER user3 SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; -CREATE ROLE myrole IF NOT EXISTS; -CREATE ROLE role1 IF NOT EXISTS; -CREATE ROLE role2 IF NOT EXISTS; ----- -//// - -[abstract] --- -This section explains how to use Cypher to manage roles in Neo4j. --- - -Roles can be created and managed using a set of Cypher administration commands executed against the `system` database. - -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[access-control-role-syntax]] -== Role management command syntax - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW [ALL\|POPULATED] ROLE[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists roles. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW ROLE ----- - - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]). -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLES WITH USERS - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW [ALL\|POPULATED] ROLE[S] WITH USER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists roles and users assigned to them. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-list-roles[Listing roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - - -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW ROLE PRIVILEGES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the privileges granted to the specified roles. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW PRIVILEGE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - - -| Command -m| CREATE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] ----- - -| Description -a| -Creates a new role. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| CREATE OR REPLACE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE ROLE name [AS COPY OF otherName] ----- - -| Description -a| -Creates a new role, or if a role with the same name exists, replace it. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-create-roles[Creating roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE ROLE ----- - -[source, privilege, role="noheader"] ----- -GRANT DROP ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| RENAME ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -RENAME ROLE name [IF EXISTS] TO otherName ----- - -| Description -a| -Changes the name of a role. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-rename-roles[Renaming roles]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT RENAME ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| DROP ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -DROP ROLE name [IF EXISTS] ----- - -| Description -a| -Removes a role. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-drop-roles[Deleting roles]. - -| Required privilege -[source, privilege, role="noheader"] ----- -GRANT DROP ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| GRANT ROLE TO - -| Syntax -a| -[source, syntax, role="noheader"] ----- -GRANT ROLE[S] name[, ...] TO user[, ...] ----- - -| Description -a| -Assigns roles to users. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-assign-roles[Assigning roles to users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT ASSIGN ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| REVOKE ROLE - -| Syntax -a| -[source, syntax, role="noheader"] ----- -REVOKE ROLE[S] name[, ...] FROM user[, ...] ----- - -| Description -a| -Removes roles from users. - -For more information, see xref::administration/access-control/manage-roles.adoc#access-control-revoke-roles[Revoking roles from users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT REMOVE ROLE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]) - -|=== - - -[[access-control-list-roles]] -== Listing roles - - -Available roles can be seen using `SHOW ROLES`. -This returns a single column `role` of type `STRING`, containing the role name. - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -This is the same command as `SHOW ALL ROLES`. - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"publisher" -|"reader" - -1+a|Rows: 6 -|=== - -When first starting a Neo4j DBMS, there are a number of built-in roles: - -* `PUBLIC` - a role that all users have granted. -By default it gives access to the home database and to execute privileges for procedures and functions. -* `reader` - can perform traverse and read operations in all databases except `system`. -* `editor` - can perform traverse, read, and write operations in all databases except `system`, but cannot create new labels or relationship types. -* `publisher` - can do the same as `editor`, but also create new labels and relationship types. -* `architect` - can do the same as `publisher` as well as create and manage indexes and constraints. -* `admin` - can do the same as all the above, as well as manage databases, aliases, users, roles, and privileges. - -More information about the built-in roles can be found in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/built-in-roles[Operations Manual -> Built-in roles] - -There are multiple versions of this command, the default being `SHOW ALL ROLES`. -To only show roles that are assigned to users, the command is `SHOW POPULATED ROLES`. -To see which users are assigned to which roles, `WITH USERS` can be added to the command. -This will return an additional `STRING` column, `member`, containing the username. -Since this gives a result with one row for each user, if a role is assigned to two users it will show up twice. - -[source, cypher, role=noplay] ----- -SHOW POPULATED ROLES WITH USERS ----- - -The table of results will show information about the role and what database it belongs to: - -.Result -[options="header,footer", width="100%", cols="m,m"] -|=== -|role -|member - -|"PUBLIC" -|"neo4j" - -|"PUBLIC" -|"bob" - -|"PUBLIC" -|"user1" - -|"PUBLIC" -|"user2" - -|"PUBLIC" -|"user3" - -|"admin" -|"neo4j" - -2+a|Rows: 6 -|=== - -It is also possible to filter and sort the results by using `YIELD`, `ORDER BY` and `WHERE`: - -[source, cypher, role=noplay] ----- -SHOW ROLES YIELD role -ORDER BY role -WHERE role ENDS WITH 'r' ----- - -In this example: - -* The results have been filtered to only return the roles ending in 'r'. -* The results are ordered by the `action` column using `ORDER BY`. - -It is also possible to use `SKIP` and `LIMIT` to paginate the results. - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"editor" -|"publisher" -|"reader" - -1+a|Rows: 3 -|=== - -[NOTE] -==== -The `SHOW ROLE name PRIVILEGES` command is found in xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. -==== - - -[[access-control-create-roles]] -== Creating roles - -Roles can be created using `CREATE ROLE`: - -[source, syntax] ----- -CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] ----- - -Roles can be created or replaced by using `CREATE OR REPLACE ROLE`: - -[source, syntax] ----- -CREATE OR REPLACE ROLE name [AS COPY OF otherName] ----- - -[NOTE] -==== -The following naming rules apply: - -* The first character must be an ASCII alphabetic character. -* Subsequent characters can be ASCII alphabetic, numeric characters, and underscore. -* Role names are case sensitive. -==== - -A role can be copied, keeping its privileges, using `CREATE ROLE name AS COPY OF otherName`. - -.Copy a role -====== -[source, cypher, role=noplay] ----- -CREATE ROLE mysecondrole AS COPY OF myrole ----- -====== - -Created roles will appear on the list provided by `SHOW ROLES`. - -.List roles -====== -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"mysecondrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== -====== - -The `CREATE ROLE` command is optionally idempotent, with the default behavior to throw an exception if the role already exists. -Adding `IF NOT EXISTS` to the `CREATE ROLE` command will ensure that no exception is thrown and nothing happens should the role already exist. - -.Create role if not exists -====== - -[source, cypher, role=noplay] ----- -CREATE ROLE myrole IF NOT EXISTS ----- - -====== - - -The `CREATE OR REPLACE ROLE` command will result in any existing role being deleted and a new one created. - - -.Create or replace role -====== - -[source, cypher, role=noplay] ----- -CREATE OR REPLACE ROLE myrole ----- - -This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE ROLE myrole`. - -====== - - -[NOTE] -==== -* The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. -==== - - -[[access-control-rename-roles]] -== Renaming roles - -Roles can be renamed using `RENAME ROLE` command: - -[source, cypher, role=noplay] ----- -RENAME ROLE mysecondrole TO mythirdrole ----- - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"mythirdrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== - -[NOTE] -==== -The `RENAME ROLE` command is only available when using native authentication and authorization. -==== - - -[[access-control-assign-roles]] -== Assigning roles to users - -Users can be given access rights by assigning them roles using `GRANT ROLE`: - -[source, cypher, role=noplay] ----- -GRANT ROLE myrole TO bob ----- - -The roles assigned to each user can be seen on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["myrole","PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["PUBLIC"] -|true -|false -| - -|"user2" -|["PUBLIC"] -|true -|false -| - -|"user3" -|["PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - -It is possible to assign multiple roles to multiple users in one command: - -[source, cypher, role=noplay] ----- -GRANT ROLES role1, role2 TO user1, user2, user3 ----- - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["myrole","PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user2" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user3" -|["role1","role2","PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - - -[[access-control-revoke-roles]] -== Revoking roles from users - -Users can lose access rights by revoking their role using `REVOKE ROLE`: - -[source, cypher, role=noplay] ----- -REVOKE ROLE myrole FROM bob ----- - -The roles revoked from users can no longer be seen on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"bob" -|["PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -|"user1" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user2" -|["role1","role2","PUBLIC"] -|true -|false -| - -|"user3" -|["role1","role2","PUBLIC"] -|true -|false -| - -5+a|Rows: 5 -|=== - -It is possible to revoke multiple roles from multiple users in one command: - -[source, cypher, role=noplay] ----- -REVOKE ROLES role1, role2 FROM user1, user2, user3 ----- - - -[[access-control-drop-roles]] -== Deleting roles - -Roles can be deleted using `DROP ROLE` command: - -[source, cypher, role=noplay] ----- -DROP ROLE mythirdrole ----- - -When a role has been deleted, it will no longer appear on the list provided by `SHOW ROLES`: - -[source, cypher, role=noplay] ----- -SHOW ROLES ----- - -.Result -[options="header,footer", width="100%", cols="m"] -|=== -|role - -|"PUBLIC" -|"admin" -|"architect" -|"editor" -|"myrole" -|"publisher" -|"reader" - -1+a|Rows: 8 -|=== - -This command is optionally idempotent, with the default behavior to throw an exception if the role does not exist. -Adding `IF EXISTS` to the command will ensure that no exception is thrown and nothing happens should the role not exist: - -[source, cypher, role=noplay] ----- -DROP ROLE mythirdrole IF EXISTS ----- diff --git a/modules/ROOT/pages/administration/access-control/manage-users.adoc b/modules/ROOT/pages/administration/access-control/manage-users.adoc deleted file mode 100644 index b1d25ee05..000000000 --- a/modules/ROOT/pages/administration/access-control/manage-users.adoc +++ /dev/null @@ -1,865 +0,0 @@ -:description: This section explains how to use Cypher to manage users in Neo4j. - -[[access-control-manage-users]] -= Managing users - -[abstract] --- -This section explains how to use Cypher to manage users in Neo4j. --- - -Users can be created and managed using a set of Cypher administration commands executed against the `system` database. -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[access-control-user-syntax]] -== User management command syntax - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW CURRENT USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW CURRENT USER - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the current user. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-current-users[Listing current user]. - -| Required privilege -a| None - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| SHOW USERS - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW USER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists all users. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-list-users[Listing users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== -| Command -m| SHOW USER PRIVILEGES - -| Syntax -a| -[source, syntax, role="noheader"] ----- -SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| -Lists the privileges granted to the specified users or the current user if no user is specified. - -When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. - -For more information, see xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SHOW PRIVILEGE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) - -[source, privilege, role="noheader"] ----- -GRANT SHOW USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) -|=== - - -[cols="<15s,<85"] -|=== -| Command -m| CREATE USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE USER name [IF NOT EXISTS] - SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED}] - [SET HOME DATABASE name] ----- - -| Description -a| -Creates a new user. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-create-users[Creating users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| CREATE OR REPLACE USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE USER name - SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED}] - [SET HOME DATABASE name] ----- - -| Description -a| -Creates a new user, or if a user with the same name exists, replace it. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-create-users[Creating users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT CREATE USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - - -[source, privilege, role="noheader"] ----- -GRANT DROP USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| RENAME USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -RENAME USER name [IF EXISTS] TO otherName ----- - -| Description -a| -Changes the name of a user. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-rename-users[Renaming users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT RENAME USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - -[cols="<15s,<85"] -|=== -| Command -m| ALTER USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -ALTER USER name [IF EXISTS] - [SET [PLAINTEXT \| ENCRYPTED] PASSWORD 'password'] - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE \| SUSPENDED} ] - [SET HOME DATABASE name] - [REMOVE HOME DATABASE] ----- - -| Description -a| -Modifies the settings for an existing user. -At least one `SET` or `REMOVE` clause is required. -`SET` and `REMOVE` clauses cannot be combined in the same command. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-alter-users[Modifying users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT SET PASSWORD ----- - -[source, privilege, role="noheader" ----- -GRANT SET USER STATUS ----- - -[source, privilege, role="noheader"] ----- -GRANT SET USER HOME DATABASE ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| ALTER CURRENT USER SET PASSWORD - -| Syntax -a| -[source, syntax, role="noheader"] ----- -ALTER CURRENT USER SET PASSWORD FROM 'oldPassword' TO 'newPassword' ----- - -| Description -a| -Changes the current user's password. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-alter-password[Changing the current user's password]. - -| Required privilege -a| None - -|=== - - -[cols="<15s,<85"] -|=== - -| Command -m| DROP USER - -| Syntax -a| -[source, syntax, role="noheader"] ----- -DROP USER name [IF EXISTS] ----- - -| Description -a| -Removes an existing user. - -For more information, see xref::administration/access-control/manage-users.adoc#access-control-drop-users[Delete users]. - -| Required privilege -a| -[source, privilege, role="noheader"] ----- -GRANT DROP USER ----- - -(see xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-user-management[DBMS USER MANAGEMENT privileges]) - -|=== - - -[NOTE] -==== -The `SHOW USER[S] PRIVILEGES` command is only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - - -[[access-control-current-users]] -== Listing current user - -The currently logged-in user can be seen using `SHOW CURRENT USER`, which will produce a table with the following columns: - -[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] -|=== -| Column -| Description -| Type -| Community Edition -| Enterprise Edition - -| user -| User name -| STRING -| {check-mark} -| {check-mark} - -| roles -| Roles granted to the user. - -Will return `null` in community edition. -| LIST OF STRING -| {cross-mark} -| {check-mark} - -| passwordChangeRequired -| If `true`, the user must change their password at the next login. -| BOOLEAN -| {check-mark} -| {check-mark} - -| suspended -| If `true`, the user is currently suspended (cannot log in). - -Will return `null` in community edition. -| BOOLEAN -| {cross-mark} -| {check-mark} - -| home -| The home database configured by the user, or `null` if no home database has been configured. -If this database is unavailable and the user does not specify a database to use, they will not be able to log in. - -Will return `null` in community edition. -| STRING -| {cross-mark} -| {check-mark} -|=== - -[source, cypher, role=noplay] ----- -SHOW CURRENT USER ----- - -.Result -[options="header,footer", width="100%", cols="2m,2m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"jake" -|["PUBLIC"] -|false -|false -| - -5+a|Rows: 1 -|=== - -[NOTE] -==== -This command is only supported for a logged-in user and will return an empty result if authorization has been disabled. -==== - - -[[access-control-list-users]] -== Listing users - -Available users can be seen using `SHOW USERS`, which will produce a table of users with the following columns: - -[options="header", width="100%", cols="2a,4,2m,^.^,^.^"] -|=== -| Column -| Description -| Type -| Community Edition -| Enterprise Edition - -| user -| User name -| STRING -| {check-mark} -| {check-mark} - -| roles -| Roles granted to the user. - -Will return `null` in community edition. -| LIST OF STRING -| {cross-mark} -| {check-mark} - -| passwordChangeRequired -| If `true`, the user must change their password at the next login. -| BOOLEAN -| {check-mark} -| {check-mark} - -| suspended -| If `true`, the user is currently suspended (cannot log in). - -Will return `null` in community edition. -| BOOLEAN -| {cross-mark} -| {check-mark} - -| home -| The home database configured by the user, or `null` if no home database has been configured. -A home database will be resolved if it is either pointing to a database or a database alias. -If this database is unavailable and the user does not specify a database to use, they will not be able to log in. - -Will return `null` in community edition. -| STRING -| {cross-mark} -| {check-mark} -|=== - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[role="queryresult" options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user -|roles -|passwordChangeRequired -|suspended -|home - -|"neo4j" -|["admin","PUBLIC"] -|false -|false -| - -5+a|Rows: 1 -|=== - -When first starting a Neo4j DBMS, there is always a single default user `neo4j` with administrative privileges. -It is possible to set the initial password using link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/set-initial-password[`neo4j-admin dbms set-initial-password `], otherwise it is necessary to change the password after the first login. - -.Show user -====== -This example shows how to: - -* Reorder the columns using a `YIELD` clause. -* Filter the results using a `WHERE` clause. - -[source, cypher, role=noplay] ----- -SHOW USER YIELD user, suspended, passwordChangeRequired, roles, home -WHERE user = 'jake' ----- -====== - -.Show user -====== -It is possible to add a `RETURN` clause to further manipulate the results after filtering. -In this example, the `RETURN` clause is used to filter out the `roles` column and rename the `user` column to `adminUser`. - -[source,cypher,role=noplay] ----- -SHOW USERS YIELD roles, user -WHERE 'admin' IN roles -RETURN user AS adminUser ----- -====== - -[NOTE] -==== -The `SHOW USER name PRIVILEGES` command is described in xref::administration/access-control/manage-privileges.adoc#access-control-list-privileges[Listing privileges]. -==== - - -[[access-control-create-users]] -== Creating users - -Users can be created using `CREATE USER`. - -[source, syntax, role="noheader"] ----- -CREATE USER name [IF NOT EXISTS] - SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] ----- - -Users can be created or replaced using `CREATE OR REPLACE USER`. - -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE USER name - SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password' - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] ----- - -* For `SET PASSWORD`: -** The `password` can either be a string value or a string parameter. -** The default Neo4j password length is at least 8 characters. -** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. -`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. -Consequently, it is never possible to get the plaintext of a password back out of the database. -A password can be set in either fashion at any time. -** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. -** The optional `ENCRYPTED` is used to recreate an existing user when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + -With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: -*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. -*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. -* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. -The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. -* The default for `SET STATUS` is `ACTIVE`. -* `SET HOME DATABASE` can be used to configure a home database for a user. -A home database will be resolved if it is either pointing to a database or a database alias. -If no home database is set, the DBMS default database is used as the home database for the user. -* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. - -[NOTE] -==== -User names are case sensitive. -The created user will appear on the list provided by `SHOW USERS`. - -* In Neo4j Community Edition there are no roles, but all users have implied administrator privileges. -* In Neo4j Enterprise Edition all users are automatically assigned the xref::administration/access-control/built-in-roles.adoc#access-control-built-in-roles-public[`PUBLIC` role], giving them a base set of privileges. -==== - - -.Create user -====== -For example, you can create the user `jake` in a suspended state, with the home database `anotherDb`, and the requirement to change the password by using the command: - -[source,cypher,role=noplay] ----- -CREATE USER jake -SET PASSWORD 'abcd1234' CHANGE REQUIRED -SET STATUS SUSPENDED -SET HOME DATABASE anotherDb ----- - -====== - - -.Create user -====== -Or you can create the user `Jake` in an active state, with an encrypted password (taken from the _data/scripts/databasename/restore_metadata.cypher_ of a database backup), and the requirement to not change the password by running: - -[source,cypher,role=noplay] ----- -CREATE USER Jake -SET ENCRYPTED PASSWORD '1,6d57a5e0b3317055454e455f96c98c750c77fb371f3f0634a1b8ff2a55c5b825,190ae47c661e0668a0c8be8a21ff78a4a34cdf918cae3c407e907b73932bd16c' CHANGE NOT REQUIRED -SET STATUS ACTIVE ----- - -====== - -[NOTE] -==== -The `SET STATUS {ACTIVE | SUSPENDED}` and `SET HOME DATABASE` parts of the commands are only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - -The `CREATE USER` command is optionally idempotent, with the default behavior to throw an exception if the user already exists. -Appending `IF NOT EXISTS` to the `CREATE USER` command will ensure that no exception is thrown and nothing happens should the user already exist. - - -.Create user if not exists -====== -[source,cypher,role=noplay] ----- -CREATE USER jake IF NOT EXISTS -SET PLAINTEXT PASSWORD 'abcd1234' ----- - -====== - -The `CREATE OR REPLACE USER` command will result in any existing user being deleted and a new one created. - - -.Create or replace user -====== -[source,cypher,role=noplay] ----- -CREATE OR REPLACE USER jake -SET PLAINTEXT PASSWORD 'abcd1234' ----- - -This is equivalent to running `DROP USER jake IF EXISTS` followed by `CREATE USER jake SET PASSWORD 'abcd1234'`. - -====== - -[NOTE] -==== -The `CREATE OR REPLACE USER` command does not allow the use of `IF NOT EXISTS`. -==== - - -[[access-control-rename-users]] -== Renaming users - -Users can be renamed with the `RENAME USER` command. - -[source, cypher, role=noplay] ----- -RENAME USER jake TO bob ----- - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"bob" -|["PUBLIC"] -|true -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 2 - -|=== - -[NOTE] -==== -The `RENAME USER` command is only available when using native authentication and authorization. -==== - - -[[access-control-alter-users]] -== Modifying users - -Users can be modified with `ALTER USER`. - -[source, syntax, role="noheader"] ----- -ALTER USER name [IF EXISTS] - [SET [PLAINTEXT | ENCRYPTED] PASSWORD 'password'] - [[SET PASSWORD] CHANGE [NOT] REQUIRED] - [SET STATUS {ACTIVE | SUSPENDED}] - [SET HOME DATABASE name] - [REMOVE HOME DATABASE name] ----- - -* At least one `SET` or `REMOVE` clause is required for the command. -* `SET` and `REMOVE` clauses cannot be combined in the same command. -* The `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET STATUS`, and `SET HOME DATABASE` clauses can be applied in any order. -The `SET PASSWORD` clause must come first, if used. -* For `SET PASSWORD`: -** The `password` can either be a string value or a string parameter. -** All passwords are encrypted (hashed) when stored in the Neo4j `system` database. -`PLAINTEXT` and `ENCRYPTED` just refer to the format of the password in the Cypher command, i.e. whether Neo4j needs to hash it or it has already been hashed. -Consequently, it is never possible to get the plaintext of a password back out of the database. -A password can be set in either fashion at any time. -** The optional `PLAINTEXT` in `SET PLAINTEXT PASSWORD` has the same behavior as `SET PASSWORD`. -** The optional `ENCRYPTED` is used to update an existing user's password when the plaintext password is unknown, but the encrypted password is available in the _data/scripts/databasename/restore_metadata.cypher_ file of a database backup. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/backup-restore/restore-backup#restore-backup-example[Operations Manual -> Restore a database backup -> Example]. + -With `ENCRYPTED`, the password string is expected to be in the format of `,,`, where, for example: -*** `0` is the first version and refers to the `SHA-256` cryptographic hash function with iterations `1`. -*** `1` is the second version and refers to the `SHA-256` cryptographic hash function with iterations `1024`. -* If the optional `SET PASSWORD CHANGE [NOT] REQUIRED` is omitted, the default is `CHANGE REQUIRED`. -The `SET PASSWORD` part is only optional if it directly follows the `SET PASSWORD` clause. -* For `SET PASSWORD CHANGE [NOT] REQUIRED`, the `SET PASSWORD` is only optional if it directly follows the `SET PASSWORD` clause. -* `SET HOME DATABASE` can be used to configure a home database for a user. -A home database will be resolved if it is either pointing to a database or a database alias. -If no home database is set, the DBMS default database is used as the home database for the user. -* `REMOVE HOME DATABASE` is used to unset the home database for a user. -This results in the DBMS default database being used as the home database for the user. - -For example, you can modify the user `bob` with a new password and active status, and remove the requirement to change his password: - -[source, cypher, role=noplay] ----- -ALTER USER bob -SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED -SET STATUS ACTIVE ----- - -Or you may decide to assign the user `bob` a different home database: - -[source, cypher, role=noplay] ----- -ALTER USER bob -SET HOME DATABASE anotherDbOrAlias ----- - -Or remove the home database from the user `bob`: - -[source, cypher, role=noplay] ----- -ALTER USER bob -REMOVE HOME DATABASE ----- - -[NOTE] -==== -When altering a user, it is only necessary to specify the changes required. -For example, leaving out the `CHANGE [NOT] REQUIRED` part of the query will leave that unchanged. -==== - -[NOTE] -==== -The `SET STATUS {ACTIVE | SUSPENDED}`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts of the command are only available in Neo4j Enterprise Edition. label:enterprise-edition[] -==== - -The changes to the user will appear on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"bob" -|["PUBLIC"] -|false -|false -| - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 2 - -|=== - -The default behavior of this command is to throw an exception if the user does not exist. -Adding an optional parameter `IF EXISTS` to the command makes it idempotent and ensures that no exception is thrown. -Nothing happens should the user not exist. - -[source, cypher, role=noplay] ----- -ALTER USER nonExistingUser IF EXISTS SET PASSWORD 'abcd1234' ----- - - -[[access-control-alter-password]] -== Changing the current user's password - -Users can change their password using `ALTER CURRENT USER SET PASSWORD`. -The old password is required in addition to the new one, and either or both can be a string value or a string parameter. -When a user executes this command it will change their password as well as set the `CHANGE NOT REQUIRED` flag. - -// can't test, don't want to hardcode test user password -[source, cypher, role=test-skip] ----- -ALTER CURRENT USER -SET PASSWORD FROM 'password1' TO 'password2' ----- - -[NOTE] -==== -This command works only for a logged-in user and cannot be run with auth disabled. -==== - - -[[access-control-drop-users]] -== Delete users - -Users can be deleted with `DROP USER`. - -[source, cypher, role=noplay] ----- -DROP USER bob ----- - -Deleting a user will not automatically terminate associated connections, sessions, transactions, or queries. - -However, when a user has been deleted, it will no longer appear on the list provided by `SHOW USERS`: - -[source, cypher, role=noplay] ----- -SHOW USERS ----- - -.Result -[options="header,footer", width="100%", cols="2m,3m,3m,2m,2m"] -|=== -|user |roles |passwordChangeRequired |suspended |home - -|"neo4j" -|["admin","PUBLIC"] -|true -|false -| - -5+a|Rows: 1 - -|=== diff --git a/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc b/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc deleted file mode 100644 index 6ab3965af..000000000 --- a/modules/ROOT/pages/administration/access-control/privileges-immutable.adoc +++ /dev/null @@ -1,46 +0,0 @@ -[role=enterprise-edition not-on-aura] -[[access-control-privileges-immutable]] -= Immutable privileges -:description: This section explains how to use Cypher to manage immutable privileges. - -Unlike regular privileges, having xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privilege management] privileges is not sufficient to enable immutable privileges to be added or removed. They can only be administered when auth is disabled -- that is, when the configuration setting <> is set to `false`. - -[[access-control-privileges-immutable-usecase]] -== When to use immutable privileges - -Immutable privileges are useful for restricting the actions of users who themselves are able to xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-privilege-management[administer privileges]. - -For example, you may want to prevent all users from performing Database Management, even the `admin` user (who are themselves able to add or remove privileges). -To do so, you could run: - -[source, cypher] ----- -DENY DATABASE MANAGEMENT ON DBMS TO PUBLIC ----- - -However, this would not be adequate. -In case the `admin` user subsequently runs this: - -[source, cypher] ----- -REVOKE DENY DATABASE MANAGEMENT ON DBMS FROM PUBLIC ----- - -They would effectively regain Database Management privileges. -Instead, run the following query to prevent this scenario: - -[source, cypher, role=test-skip] ----- -DENY IMMUTABLE DATABASE MANAGEMENT ON DBMS TO PUBLIC ----- - - -[[access-control-privileges-immutable-admin]] -== How to administer immutable privileges - -Immutable privileges can only be administered when auth is disabled -- that is, when the configuration setting <> is set to `false`, for example. -Under these conditions, immutable privileges can be added and removed in a similar manner to regular privileges, using the `IMMUTABLE` keyword. - -See the link:{neo4j-docs-base-uri}/operations-manual/{page-version}/tutorial/tutorial-immutable-privileges[Immutable privileges tutorial] for examples of how to administer immutable privileges. - -See xref:administration/access-control/manage-privileges.adoc[Managing Privileges] for more detail on syntax. diff --git a/modules/ROOT/pages/administration/access-control/privileges-reads.adoc b/modules/ROOT/pages/administration/access-control/privileges-reads.adoc deleted file mode 100644 index dc76d6960..000000000 --- a/modules/ROOT/pages/administration/access-control/privileges-reads.adoc +++ /dev/null @@ -1,189 +0,0 @@ -:description: How to use Cypher to manage read privileges on graphs. - -//// -[source, cypher, role=test-setup] ----- -CREATE ROLE regularUsers; ----- -//// - -[role=enterprise-edition aura-db-enterprise] -[[access-control-privileges-reads]] -= Read privileges - -[abstract] --- -This section explains how to use Cypher to manage read privileges on graphs. --- - -There are three separate read privileges: - -* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-traverse[`TRAVERSE`] - enables the specified entities to be found. -* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-read[`READ`] - enables the specified properties of the found entities to be read. -* xref::administration/access-control/privileges-reads.adoc#access-control-privileges-reads-match[`MATCH`] - combines both `TRAVERSE` and `READ`, enabling an entity to be found and its properties read. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[[access-control-privileges-reads-traverse]] -== The `TRAVERSE` privilege - -Users can be granted the right to find nodes and relationships using the `GRANT TRAVERSE` privilege. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] TRAVERSE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, we can enable users with the role `regularUsers` to find all nodes with the label `Post` in the database `neo4j`: - -[source, cypher, role=noplay] ----- -GRANT TRAVERSE ON GRAPH neo4j NODES Post TO regularUsers ----- - -The `TRAVERSE` privilege can also be denied. - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] TRAVERSE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, we can disable users with the role `regularUsers` from finding all nodes with the label `Payments`: - -[source, cypher, role=noplay] ----- -DENY TRAVERSE ON HOME GRAPH NODES Payments TO regularUsers ----- - - -[[access-control-privileges-reads-read]] -== The `READ` privilege - -Users can be granted the right to do property reads on nodes and relationships using the `GRANT READ` privilege. -It is very important to note that users can only read properties on entities that they are enabled to find in the first place. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] READ "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, we can enable user with the role `regularUsers` to read all properties on nodes with the label `Post` in the database `neo4j`. -The `+*+` implies that the ability to read all properties also extends to properties that might be added in the future. - -[source, cypher, role=noplay] ----- -GRANT READ { * } ON GRAPH neo4j NODES Post TO regularUsers ----- - -[NOTE] -==== -Granting property `READ` access does not imply that the entities with that property can be found. -For example, if there is also a `DENY TRAVERSE` present on the same entity as a `GRANT READ`, the entity will not be found by a Cypher `MATCH` statement. -==== - -The `READ` privilege can also be denied. - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] READ "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -Although we just granted the role `regularUsers` the right to read all properties, we may want to hide the `secret` property. -The following example shows how to do that: - -[source, cypher, role=noplay] ----- -DENY READ { secret } ON GRAPH neo4j NODES Post TO regularUsers ----- - - -[[access-control-privileges-reads-match]] -== The `MATCH` privilege - -Users can be granted the right to find and do property reads on nodes and relationships using the `GRANT MATCH` privilege. -This is semantically the same as having both `TRAVERSE` and `READ` privileges. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] MATCH "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example if you want to grant the ability to read the properties `language` and `length` for nodes with the label `Message`, as well as the ability to find these nodes to the role `regularUsers`, you can use the following `GRANT MATCH` query: - -[source, cypher, role=noplay] ----- -GRANT MATCH { language, length } ON GRAPH neo4j NODES Message TO regularUsers ----- - -Like all other privileges, the `MATCH` privilege can also be denied. - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] MATCH "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -Please note that the effect of denying a `MATCH` privilege depends on whether concrete property keys are specified or are `+*+`. -If you specify concrete property keys, then `DENY MATCH` will only deny reading those properties. -Finding the elements to traverse would still be enabled. -If you specify `+*+` instead, then both traversal of the element and all property reads will be disabled. -The following queries will show examples for this. - -Denying to read the property `content` on nodes with the label `Message` for the role `regularUsers` would look like the following query. -Although not being able to read this specific property, nodes with that label can still be traversed (and, depending on other grants, other properties on it could still be read). - -[source, cypher, role=noplay] ----- -DENY MATCH { content } ON GRAPH neo4j NODES Message TO regularUsers ----- - -The following query exemplifies how it would look if you wanted to deny both reading all properties and traversing nodes labeled with `Account` in the database `neo4j`: - -[source, cypher, role=noplay] ----- -DENY MATCH { * } ON GRAPH neo4j NODES Account TO regularUsers ----- diff --git a/modules/ROOT/pages/administration/access-control/privileges-writes.adoc b/modules/ROOT/pages/administration/access-control/privileges-writes.adoc deleted file mode 100644 index 71f6e2069..000000000 --- a/modules/ROOT/pages/administration/access-control/privileges-writes.adoc +++ /dev/null @@ -1,407 +0,0 @@ -:description: How to use Cypher to manage write privileges on graphs. - -//// -[source, cypher, role=test-setup] ----- -CREATE ROLE regularUsers; ----- -//// - -[role=enterprise-edition aura-db-enterprise] -[[access-control-privileges-writes]] -= Write privileges - -[abstract] --- -This section explains how to use Cypher to manage write privileges on graphs. --- - -Write privileges are defined for different parts of the graph: - -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-create[`CREATE`] - allows creating nodes and relationships. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-delete[`DELETE`] - allows deleting nodes and relationships. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-label[`SET LABEL`] - allows setting the specified node labels using the `SET` clause. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-remove-label[`REMOVE LABEL`] - allows removing the specified node labels using the `REMOVE` clause. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-property[`SET PROPERTY`] - allows setting properties on nodes and relationships. - -There are also compound privileges which combine the above specific privileges: - -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-merge[`MERGE`] - allows `MATCH`, `CREATE` and `SET PROPERTY` to apply the `MERGE` command. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-write[`WRITE`] - allows all `WRITE` operations on an entire graph. -* xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-all[`ALL GRAPH PRIVILEGES`] - allows all `READ` and `WRITE` operations on an entire graph. - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[[access-control-privileges-writes-create]] -== The `CREATE` privilege - -The `CREATE` privilege allows a user to create new node and relationship elements on a graph. -See the Cypher xref::clauses/create.adoc[CREATE] clause. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] CREATE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `CREATE` elements on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT CREATE ON GRAPH neo4j ELEMENTS * TO regularUsers ----- - -The `CREATE` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] CREATE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to `CREATE` nodes with the label `foo` on all graphs, use: - -[source, cypher, role=noplay] ----- -DENY CREATE ON GRAPH * NODES foo TO regularUsers ----- - -[NOTE] -==== -If the user attempts to create nodes with a label that does not already exist on the database, then the user must also possess the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege. -The same applies to new relationships: the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW RELATIONSHIP TYPE] privilege is required. -==== - - -[[access-control-privileges-writes-delete]] -== The `DELETE` privilege - -The `DELETE` privilege allows a user to delete node and relationship elements on a graph. -See the Cypher xref::clauses/delete.adoc[DELETE] clause. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] DELETE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `DELETE` elements on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT DELETE ON GRAPH neo4j ELEMENTS * TO regularUsers ----- - -The `DELETE` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] DELETE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to `DELETE` relationships with the relationship type `bar` on all graphs, use: - -[source, cypher, role=noplay] ----- -DENY DELETE ON GRAPH * RELATIONSHIPS bar TO regularUsers ----- - -[NOTE] -==== -Users with `DELETE` privilege, but restricted `TRAVERSE` privileges, will not be able to do `DETACH DELETE` in all cases. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/access-control#detach-delete-restricted-user[Operations Manual -> Fine-grained access control] for more info. -==== - - -[[access-control-privileges-writes-set-label]] -== The `SET LABEL` privilege - -The `SET LABEL` privilege allows you to set labels on a node using the xref::clauses/set.adoc#set-set-a-label-on-a-node[SET clause]: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] SET LABEL { * | label[, ...] } - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `SET` any label on nodes of the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT SET LABEL * ON GRAPH neo4j TO regularUsers ----- - -[NOTE] -==== -Unlike many of the other `READ` and `WRITE` privileges, it is not possible to restrict the `SET LABEL` privilege to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. -==== - -The `SET LABEL` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] SET LABEL { * | label[, ...] } - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to `SET` the label `foo` on nodes of all graphs, use: - -[source, cypher, role=noplay] ----- -DENY SET LABEL foo ON GRAPH * TO regularUsers ----- - -[NOTE] -==== -If no instances of this label exist on the database, then the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege is also required. -==== - - -[[access-control-privileges-writes-remove-label]] -== The `REMOVE LABEL` privilege - -The `REMOVE LABEL` privilege allows you to remove labels from a node by using the xref::clauses/remove.adoc#remove-remove-a-label-from-a-node[REMOVE clause]: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] REMOVE LABEL { * | label[, ...] } - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `REMOVE` any label from nodes of the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT REMOVE LABEL * ON GRAPH neo4j TO regularUsers ----- - -[NOTE] -==== -Unlike many of the other `READ` and `WRITE` privileges, it is not possible to restrict the `REMOVE LABEL` privilege to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. -==== - -The `REMOVE LABEL` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] REMOVE LABEL { * | label[, ...] } - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, denying the role `regularUsers` the ability to remove the label `foo` from nodes of all graphs, use: - -[source, cypher, role=noplay] ----- -DENY REMOVE LABEL foo ON GRAPH * TO regularUsers ----- - - -[[access-control-privileges-writes-set-property]] -== The `SET PROPERTY` privilege - -The `SET PROPERTY` privilege allows a user to set a property on a node or relationship element in a graph by using the xref::clauses/set.adoc#set-set-a-property[SET clause]: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] SET PROPERTY "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `SET` any property on all elements of the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT SET PROPERTY {*} ON HOME GRAPH ELEMENTS * TO regularUsers ----- - -The `SET PROPERTY` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] SET PROPERTY "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to `SET` the property `foo` on nodes with the label `bar` on all graphs, use: - -[source, cypher, role=noplay] ----- -DENY SET PROPERTY { foo } ON GRAPH * NODES bar TO regularUsers ----- - -[NOTE] -==== -If the user attempts to set a property with a property name that does not already exist on the database, the user must also possess the xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW PROPERTY NAME] privilege. -==== - - -[[access-control-privileges-writes-merge]] -== The `MERGE` privilege - -The `MERGE` privilege is a compound privilege that combines `TRAVERSE` and `READ` (i.e. `MATCH`) with `CREATE` and `SET PROPERTY`. -This is intended to enable the use of xref::clauses/merge.adoc[the MERGE command], but it is also applicable to all reads and writes that require these privileges. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] MERGE "{" { * | property[, ...] } "}" - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - [ - ELEMENT[S] { * | label-or-rel-type[, ...] } - | NODE[S] { * | label[, ...] } - | RELATIONSHIP[S] { * | rel-type[, ...] } - ] - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `MERGE` on all elements of the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT MERGE {*} ON GRAPH neo4j ELEMENTS * TO regularUsers ----- - -It is not possible to deny the `MERGE` privilege. -If you wish to prevent a user from creating elements and setting properties: use xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-create[DENY CREATE] or xref::administration/access-control/privileges-writes.adoc#access-control-privileges-writes-set-property[DENY SET PROPERTY]. - -[NOTE] -==== -If the user attempts to create nodes with a label that does not already exist on the database, the user must also possess the -xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW LABEL] privilege. -The same applies to new relationships and properties - the -xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW RELATIONSHIP TYPE] or -xref::administration/access-control/database-administration.adoc#access-control-database-administration-tokens[CREATE NEW PROPERTY NAME] privileges are required. -==== - - -[[access-control-privileges-writes-write]] -== The `WRITE` privilege - -The `WRITE` privilege allows the user to execute any `WRITE` command on a graph. - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] WRITE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` the ability to `WRITE` on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT WRITE ON GRAPH neo4j TO regularUsers ----- - -[NOTE] -==== -Unlike the more specific `WRITE` commands, it is not possible to restrict `WRITE` privileges to specific +ELEMENTS+, +NODES+ or +RELATIONSHIPS+. -If you wish to prevent a user from writing to a subset of database objects, a `GRANT WRITE` can be combined with more specific `DENY` commands to target these elements. -==== - -The `WRITE` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] WRITE - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` the ability to `WRITE` on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -DENY WRITE ON GRAPH neo4j TO regularUsers ----- - -[NOTE] -==== -Users with `WRITE` privilege but restricted `TRAVERSE` privileges will not be able to do `DETACH DELETE` in all cases. -See link:{neo4j-docs-base-uri}/operations-manual/{page-version}/authentication-authorization/access-control#detach-delete-restricted-user[Operations Manual -> Fine-grained access control] for more info. -==== - - -[[access-control-privileges-writes-all]] -== The `ALL GRAPH PRIVILEGES` privilege - -The `ALL GRAPH PRIVILEGES` privilege allows the user to execute any command on a graph: - -[source, syntax, role="noheader"] ----- -GRANT [IMMUTABLE] ALL [ [ GRAPH ] PRIVILEGES ] - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to grant the role `regularUsers` `ALL GRAPH PRIVILEGES` on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -GRANT ALL GRAPH PRIVILEGES ON GRAPH neo4j TO regularUsers ----- - -[NOTE] -==== -Unlike the more specific `READ` and `WRITE` commands, it is not possible to restrict `ALL GRAPH PRIVILEGES` to specific +ELEMENTS, +NODES+ or +RELATIONSHIPS+. -If you wish to prevent a user from reading or writing to a subset of database objects, a `GRANT ALL GRAPH PRIVILEGES` can be combined with more specific `DENY` commands to target these elements. -==== - -The `ALL GRAPH PRIVILEGES` privilege can also be denied: - -[source, syntax, role="noheader"] ----- -DENY [IMMUTABLE] ALL [ [ GRAPH ] PRIVILEGES ] - ON { HOME GRAPH | GRAPH[S] { * | name[, ...] } } - TO role[, ...] ----- - -For example, to deny the role `regularUsers` all graph privileges on the graph `neo4j`, use: - -[source, cypher, role=noplay] ----- -DENY ALL GRAPH PRIVILEGES ON GRAPH neo4j TO regularUsers ----- diff --git a/modules/ROOT/pages/administration/aliases.adoc b/modules/ROOT/pages/administration/aliases.adoc deleted file mode 100644 index 708d3d79b..000000000 --- a/modules/ROOT/pages/administration/aliases.adoc +++ /dev/null @@ -1,1529 +0,0 @@ -:description: How to use Cypher to manage database aliases in Neo4j. -[role=enterprise-edition aura-db-enterprise] -[[alias-management]] -= Database alias management - -[abstract] --- -This section explains how to use Cypher to manage database aliases in Neo4j. --- - -There are two kinds of database aliases: local and remote. -A local database alias can only target a database within the same DBMS. -A remote database alias may target a database from another Neo4j DBMS. -When a query is run against a database alias, it will be redirected to the target database. -The home database for users can be set to an alias, which will be resolved to the target database on use. -Both local and remote database aliases can be created as part of a xref::administration/databases.adoc#administration-databases-create-composite-database[composite database]. - -A local database alias can be used in all other Cypher commands in place of the target database. -Please note that the local database alias will be resolved while executing the command. -Privileges are defined on the database, and not the local database alias. - -A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, use clauses, setting a user's home database and defining the access privileges to the remote database. -Remote database aliases require configuration to safely connect to the remote target, which is described in link:{neo4j-docs-base-uri}/operations-manual/{page-version}/manage-databases/remote-alias[Connecting remote databases]. -It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias. - -Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database. -The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. -When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database. - -The syntax of the database alias management commands is as follows: - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Alias management command syntax -[options="header", width="100%", cols="1,5a"] -|=== -| Command | Syntax -| Show Database Alias -| -[source, syntax, role=noheader] ------ -SHOW ALIAS[ES] [name] FOR DATABASE[S] -[WHERE expression] ------ -[source, syntax, role=noheader] ------ -SHOW ALIAS[ES] [name] FOR DATABASE[S] -YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] -[WHERE expression] -[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ------ -Lists both local and remote database aliases, optionally filtered on the alias name. - -| Create Local Alias -| -[source, syntax, role=noheader] ------ -CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName -[PROPERTIES "{" key: value[, ...] "}"] ------ -[source, syntax, role=noheader] ------ -CREATE OR REPLACE ALIAS name FOR DATABASE targetName -[PROPERTIES "{" key: value[, ...] "}"] ------ - -| Create Remote Alias -| -[source, syntax, role=noheader] ------ -CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName -AT 'url' USER username PASSWORD 'password' -[DRIVER "{" setting: value[, ...] "}"] -[PROPERTIES "{" key: value[, ...] "}"] ------ -[source, syntax, role=noheader] ------ -CREATE OR REPLACE ALIAS name FOR DATABASE targetName -AT 'url' USER username PASSWORD 'password' -[DRIVER "{" setting: value[, ...] "}"] -[PROPERTIES "{" key: value[, ...] "}"] ------ - -| Alter Local Alias -| -[source, syntax, role=noheader] ------ -ALTER ALIAS name [IF EXISTS] SET DATABASE -[TARGET targetName] -[PROPERTIES "{" key: value[, ...] "}"] ------ - -| Alter Remote Alias -| -[source, syntax, role=noheader] ------ -ALTER ALIAS name [IF EXISTS] SET DATABASE -[TARGET targetName AT 'url'] -[USER username] -[PASSWORD 'password'] -[DRIVER "{" setting: value[, ...] "}"] -[PROPERTIES "{" key: value[, ...] "}"] ------ - -| Drop Alias -| -[source, syntax, role=noheader] ------ -DROP ALIAS name [IF EXISTS] FOR DATABASE ------ -Drop either a local or remote database alias. - -|=== - -This is the list of the allowed driver settings for remote database aliases. - -[[remote-alias-driver-settings]] -.ssl_enforced -[width="100%", cols="1s, 4a"] -|=== -| Description -| -SSL for remote database alias drivers is configured through the target url scheme. -If `ssl_enforced` is set to true, a secure url scheme is enforced. -This will be validated when the command is executed. - -| Valid values -| Boolean - -| Default value -| true - -|=== - -.connection_timeout -[width="100%", cols="1s, 4a"] -|=== - -| Description -| -Socket connection timeout. -A timeout of zero is treated as an infinite timeout and will be bound by the timeout configured on the operating system level. - -| Valid values -| Duration - -| Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout] - -|=== - -.connection_max_lifetime -[width="100%", cols="1s, 4a"] -|=== - -| Description -| -Pooled connections older than this threshold will be closed and removed from the pool. -Setting this option to a low value will cause a high connection churn and might result in a performance hit. -It is recommended to set maximum lifetime to a slightly smaller value than the one configured in network equipment (load balancer, proxy, firewall, etc. can also limit maximum connection lifetime). - -| Valid values -| Duration. - -Zero and negative values result in lifetime not being checked. - -| Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime] - -|=== - -.connection_pool_acquisition_timeout -[width="100%", cols="1s, 4a"] -|=== -| Description -| -Maximum amount of time spent attempting to acquire a connection from the connection pool. -This timeout only kicks in when all existing connections are being used and no new connections can be created because maximum connection pool size has been reached. -Error is raised when connection can’t be acquired within configured time. - -| Valid values -| Duration. - -Negative values are allowed and result in unlimited acquisition timeout. -Value of `0` is allowed and results in no timeout and immediate failure when connection is unavailable. - -| Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout] - -|=== - -.connection_pool_max_size -[width="100%", cols="1s, 4a"] -|=== - -| Description -| -Maximum total number of connections to be managed by a connection pool. -The limit is enforced for a combination of a host and user. - -| Valid values -| Integer. - -Negative values are allowed and result in unlimited pool. -Value of `0` is not allowed. - -| Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size] - -|=== - -.logging_level -[width="100%", cols="1s, 4a"] -|=== - -| Description -| Sets level for driver internal logging. - -| Valid values -| org.neo4j.logging.Level. - -One of `DEBUG`, `INFO`, `WARN`, `ERROR`, or `NONE`. - -| Default value -| link:{neo4j-docs-base-uri}/operations-manual/{page-version}/configuration/configuration-settings#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level] - -|=== - - -[NOTE] -==== -If transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety. -This prevents issues such as a transaction executing against multiple target databases for the same alias. -==== - - -[[alias-management-show-alias]] -== Listing database aliases - -//// -[source, cypher, role=test-setup] ----- -CREATE DATABASE `movies`; -CREATE ALIAS `films` FOR DATABASE `movies`; -CREATE ALIAS `motion pictures` FOR DATABASE `movies` PROPERTIES { nameContainsSpace: true }; -CREATE DATABASE `northwind-graph-2020`; -CREATE DATABASE `northwind-graph-2021`; -CREATE DATABASE `northwind-graph-2022`; -CREATE DATABASE `sci-fi-books`; -CREATE COMPOSITE DATABASE `library`; -CREATE ALIAS `library`.`sci-fi` FOR DATABASE `sci-fi-books`; -CREATE COMPOSITE DATABASE garden; -CREATE DATABASE `perennial-flowers`; -CREATE ALIAS `library`.`romance` FOR DATABASE `romance-books` AT 'neo4j+s://location:7687' USER alice PASSWORD 'password'; -CREATE ALIAS `movie scripts` FOR DATABASE `scripts` AT "neo4j+s://location:7687" USER alice PASSWORD "password" -DRIVER { - ssl_enforced: true, - connection_timeout: duration({seconds: 5}), - connection_max_lifetime: duration({hours: 1}), - connection_pool_acquisition_timeout: duration({minutes: 1}), - connection_pool_idle_test: duration({minutes: 2}), - connection_pool_max_size: 10, - logging_level: 'info' -}; ----- -//// - -Available database aliases can be seen using `SHOW ALIASES FOR DATABASE`. -The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. - -`SHOW ALIASES FOR DATABASE` will produce a table of database aliases with the following columns: - -[options="header" cols="2m,4a,2m"] -|=== -| Column | Description | Type - -| name -| The fully qualified name of the database alias. label:default-output[] -| STRING - -| database -| The name of the target database. label:default-output[] -| STRING - -| location -| The location of the database, either `local` or `remote`. label:default-output[] -| STRING - -| url -| Target location or `null` if the target is local. label:default-output[] -| STRING - -| user -| User connecting to the remote database or `null` if the target database is local. label:default-output[] -| STRING - -| driver -| -The driver options for connection to the remote database or `null` if the target database is local or if no driver settings are added. -List of xref::administration/aliases.adoc#remote-alias-driver-settings[driver settings] allowed for remote database aliases. -| MAP - -| properties -| Any properties set on the database alias. -| MAP - -|=== - -The detailed information for a particular database alias can be displayed using the command `SHOW ALIASES FOR DATABASE YIELD *`. -When a `YIELD *` clause is provided, the full set of columns is returned. - -.+Show all aliases for a database+ -====== - -A summary of all available database aliases can be displayed using the command `SHOW ALIASES FOR DATABASE`. - -.Query -[source, cypher] ----- -SHOW ALIASES FOR DATABASE ----- - -.Result -[role="queryresult",options="header,footer",cols="5*+ | ++ -| +"library.romance"+ | +romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -| +"library.sci-fi"+ | +sci-fi-books"+ | +"local"+ | ++ | ++ -| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ -| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -5+d|Rows: 5 - -|=== - -====== - -.+Show specific aliases for databases+ -====== - -To list just one database alias, the `SHOW ALIASES` command takes an alias name; - -.Query -[source, cypher] ----- -SHOW ALIAS films FOR DATABASES ----- - -.Result -[role="queryresult",options="header,footer",cols="5*+ | ++ - -5+d|Rows: 1 - -|=== - -.Query -[source, cypher] ----- -SHOW ALIAS library.romance FOR DATABASES ----- - -.Result -[role="queryresult",options="header,footer",cols="5*+ | ++ | ++ | +{}+ -| +"library.romance"+ | +"romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{}+ | +{}+ -| +"library.sci-fi"+ | +"sci-fi-books"+ | +"local"+ | ++ | ++ | ++ | +{}+ -| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ | ++ | +{"namecontainsspace":true}+ -| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{"connection_pool_idle_test":PT2M,"connection_pool_max_size":10,"loggi"connection_pool_idle_test":PT2M,"connection_pool_max_size":10,"logging_level":"INFO","ssl_enforced":true,"connection_pool_acquisition_timeout":PT1M,"connection_timeout":PT5S,"connection_max_lifetime":PT1H} | +{}+ - -7+d|Rows: 5 - -|=== - -====== - - -.+Show count of aliases for a database+ -====== - -The number of database aliases can be seen using a `count()` aggregation with `YIELD` and `RETURN`. - - -.Query -[source, cypher] ----- -SHOW ALIASES FOR DATABASE YIELD * -RETURN count(*) as count ----- - -.Result -[role="queryresult",options="header,footer",cols="1*+ | +"movies"+ -| +"library.romance"+ | +"neo4j+s://location:7687"+ | +"romance-books"+ -| +"movie scripts"+ | +"neo4j+s://location:7687"+ | +"scripts"+ -3+d|Rows: 3 -|=== - -====== - -[[alias-management-create-database-alias]] -== Creating database aliases - -Database aliases can be created using `CREATE ALIAS`. - -The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. - -.Create alias command syntax -[options="header", width="100%", cols="5a,2"] -|=== -| Syntax | Comment -| -[source, syntax, role=noheader] ------ -CREATE [OR REPLACE] ALIAS [compositeDatabaseName.]aliasName [IF NOT EXISTS] FOR DATABASE targetName -[PROPERTIES "{" key: value[, ...] "}"] ------ -| Create a local alias. - -| -[source, syntax, role=noheader] ------ -CREATE [OR REPLACE] ALIAS [compositeDatabaseName.]aliasName [IF NOT EXISTS] FOR DATABASE targetName -AT 'url' USER username PASSWORD 'password' -[DRIVER "{" setting: value[, ...] "}"] -[PROPERTIES "{" key: value[, ...] "}"] ------ -| Create a remote database alias. - -|=== - - -This command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists. -Inserting `IF NOT EXISTS` after the alias name ensures that no error is returned and nothing happens should a database alias with that name already exist. -Adding `OR REPLACE` to the command will result in any existing database alias being deleted and a new one created. -`CREATE OR REPLACE ALIAS` will fail if there is an existing database with the same name. - -[NOTE] -==== -The `IF NOT EXISTS` and `OR REPLACE` parts of this command cannot be used together. -==== - -[NOTE] -==== -Database alias names are subject to the rules specified in the xref:administration/alias-management-escaping[Alias names and escaping] section. -==== - -[[database-management-create-local-database-alias]] -=== Creating local database aliases - -Local aliases are created with a target database. - -.+Creating aliases for local databases+ -====== - -.Query -[source, cypher] ----- -CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2021` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -When a local database alias has been created, it will show up in the `aliases` column provided by the command `SHOW DATABASES` and in the `SHOW ALIASES FOR DATABASE` command. - - -.Query -[source, cypher] ----- -SHOW DATABASE `northwind` ----- - -.Result -[role="queryresult",options="header,footer",cols="13*+ | ++ -5+d|Rows: 1 - -|=== - -====== - -.+Setting properties for local database aliases+ -====== - -Local database aliases can also be given properties. -These properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. - -.Query -[source, cypher] ----- -CREATE ALIAS `northwind-2022` -FOR DATABASE `northwind-graph-2022` -PROPERTIES { newestNorthwind: true, index: 3 } ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command. - -.Query -[source, cypher] ----- -SHOW ALIAS `northwind-2022` FOR DATABASE YIELD name, properties ----- - -.Result -[role="queryresult",options="header,footer",cols="2* 10, connection_timeout -> PT1M}+ | +{}+ -7+d|Rows: 1 - -|=== - -====== - -.+Setting properties for remote database aliases+ -====== -Just as the local database aliases, the remote database aliases can be given properties. -These properties can then be used in queries with the xref::functions/graph.adoc#functions-graph-propertiesByName[`graph.propertiesByName()` function]. - -.Query -[source, cypher] ----- -CREATE ALIAS `remote-northwind-2021` FOR DATABASE `northwind-graph-2021` AT 'neo4j+s://location:7687' -USER alice PASSWORD 'password' -PROPERTIES { newestNorthwind: false, index: 6 } ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command. - -.Query -[source, cypher] ----- -SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties ----- - -.Result -[role="queryresult",options="header,footer",cols="2*+ | ++ -| +"garden.trees"+ | +"trees"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -5+d|Rows: 1 - -|=== -====== - - -.+Aliases pointing to composite databases+ -====== -Database aliases cannot point to a composite database. - -.Query -[source, cypher, role=test-fail] ----- -CREATE ALIAS yard FOR DATABASE garden ----- - -.Error message -[source, output, role="noheader"] ----- -Failed to create the specified database alias 'yard': Database 'garden' is composite. ----- - -====== - -[[alias-management-alter-database-alias]] -== Altering database aliases - -//// -CREATE ALIAS garden.flowers FOR DATABASE `perennial-flowers`; -CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2020`; // created in the replace alias example -CREATE ALIAS `remote-northwind` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER alice PASSWORD 'password'; -CREATE ALIAS `remote-with-driver-settings` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER alice PASSWORD 'password' -DRIVER { - connection_timeout: duration({ minutes: 1 }), - connection_pool_max_size: 10 - }; -CREATE ALIAS garden.trees FOR DATABASE trees AT 'neo4j+s://location:7687' USER alice PASSWORD 'password' -//// - -Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, url, user credentials, or driver settings. -The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. -Only the clauses used will be altered. - -[NOTE] -==== -Local database aliases cannot be altered to remote aliases, or vice versa. -==== - -.Alter alias command syntax -[options="header", width="100%", cols="5a,2"] -|=== -| Syntax | Comment -| -[source, source, role=noheader] ------ -ALTER ALIAS [compositeDatabaseName.]aliasName [IF EXISTS] SET DATABASE -[TARGET targetName] -[PROPERTIES "{" key: value[, ...] "}"] ------ -| Modify database target of a local alias. - -The clauses can be applied in any order, while at least one clause needs to be set. - -| -[source, source, role=noheader] ------ -ALTER ALIAS [compositeDatabaseName.]aliasName [IF EXISTS] SET DATABASE -[TARGET targetName AT 'url'] -[USER username] -[PASSWORD 'password'] -[DRIVER "{" setting: value[, ...] "}"] -[PROPERTIES "{" key: value[, ...] "}"] ------ -| Modify a remote alias. - -The clauses can be applied in any order, while at least one clause needs to be set. - -|=== - -.+Altering local database aliases+ -====== - -Example of altering a local database alias target. - - -.Query -[source, cypher] ----- -ALTER ALIAS `northwind` -SET DATABASE TARGET `northwind-graph-2021` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -When a local database alias has been altered, it will show up in the `aliases` column for the target database provided by the command `SHOW DATABASES`. - -.Query -[source, cypher] ----- -SHOW DATABASE `northwind-graph-2021` ----- - -.Result -[role="queryresult",options="header,footer",cols="13*+ | ++ | ++ | +{"perennial":true}+ -| +"garden.trees"+ | +"updatedtrees"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{}+ | +{"treeversion":2}+ -| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ | ++ | +{"namecontainsspace":true,"moreinfo":"no, not really"}+ -| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ | +{connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H}+ | +{"namecontainsspace":true}+ -| +"northwind"+ | +"northwind-graph-2021"+ | +"local"+ | ++ | ++ | ++ |+[]+ -| +"remote-northwind"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://other-location:7687"+ | +"alice"+ | +{}+ | +{}+ -| +"remote-with-driver-settings"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"bob"+ | +{logging_level -> "DEBUG", connection_timeout -> PT1M}+ |+[]+ -7+d|Rows: 7 - -|=== - - -.+Using IF EXISTS when altering database aliases+ -====== - -The `ALTER ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist. -Appending `IF EXISTS` to the command ensures that no error is returned and nothing happens should the alias not exist. - - - -.Query -[source, cypher] ----- -ALTER ALIAS `no-alias` IF EXISTS SET DATABASE TARGET `northwind-graph-2021` ----- - -[source, result, role="noheader"] ----- -(no changes, no records) ----- - -====== - -[[alias-management-drop-database-alias]] -== Deleting database aliases - -//// -CREATE ALIAS garden.flowers FOR DATABASE `perennial-flowers` PROPERTIES { perennial: true }; -CREATE ALIAS `northwind-2022` FOR DATABASE `northwind-graph-2022` PROPERTIES { newestNorthwind: true, index: 3 }; -CREATE ALIAS `northwind` FOR DATABASE `northwind-graph-2021`; -CREATE ALIAS `remote-northwind-2021` -FOR DATABASE `northwind-graph-2021` AT 'neo4j+s://location:7687' USER alice PASSWORD 'password' -PROPERTIES { newestNorthwind: false, index: 6 }; -CREATE ALIAS `remote-northwind` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://other-location:7687" USER alice PASSWORD 'password'; -CREATE ALIAS `remote-with-driver-settings` FOR DATABASE `northwind-graph-2020` AT "neo4j+s://location:7687" USER bob PASSWORD 'newPassword' -DRIVER { - connection_timeout: duration({ minutes: 1 }), - logging_level: "debug" - }; -CREATE ALIAS garden.trees FOR DATABASE updatedTrees AT 'neo4j+s://location:7687' -USER alice PASSWORD 'password' -PROPERTIES { treeVersion: 2 } -//// - - -Both local and remote database aliases can be deleted using the `DROP ALIAS` command. -The required privileges are described xref::administration/access-control/dbms-administration.adoc#access-control-dbms-administration-alias-management[here]. - - -.+Deleting local database aliases+ -====== - -Delete a local database alias. - - -.Query -[source, cypher] ----- -DROP ALIAS `northwind` FOR DATABASE ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -When a database alias has been deleted, it will no longer show up in the `aliases` column provided by the command `SHOW DATABASES`. - -.Query -[source, cypher] ----- -SHOW DATABASE `northwind-graph-2021` ----- - -.Result -[role="queryresult",options="header,footer",cols="13*+ | ++ -| +"garden.trees"+ | +"updatedtrees"+ | +"local"+ | +"neo4j+s://location:7687"+ | +"alice"+ -| +"library.romance"+ | +"romance-books"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -| +"library.sci-fi"+ | +"sci-fi-books"+ | +"local"+ | ++ | ++ -| +"motion pictures"+ | +"movies"+ | +"local"+ | ++ | ++ -| +"movie scripts"+ | +"scripts"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -| +"northwind-2022"+ | +"northwind-graph-2022"+ | +"local"+ | ++ | ++ -| +"remote-northwind"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://other-location:7687"+ | +"alice"+ -| +"remote-northwind-2021"+ | +"northwind-graph-2021"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"alice"+ -| +"remote-with-driver-settings"+ | +"northwind-graph-2020"+ | +"remote"+ | +"neo4j+s://location:7687"+ | +"bob"+ -5+d|Rows: 9 - -|=== - -.+Using IF EXISTS when deleting database aliases+ -====== - -The `DROP ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist. -Inserting `IF EXISTS` after the alias name ensures that no error is returned and nothing happens should the alias not exist. - -.Query -[source, cypher] ----- -DROP ALIAS `northwind` IF EXISTS FOR DATABASE ----- - -[source, result, role="noheader"] ----- -(no changes, no records) ----- - -====== - -[[alias-management-escaping]] -== Alias names and escaping -//// -[source, cypher, role=test-setup] ----- -CREATE DATABASE `northwind-graph`; -CREATE COMPOSITE DATABASE `my-composite-database-with-dashes`; -CREATE COMPOSITE DATABASE `my.composite.database.with.dots`; -CREATE COMPOSITE DATABASE mySimpleCompositeDatabase; -CREATE COMPOSITE DATABASE `myCompositeDatabase.withDot`; ----- -//// - -Database alias names are subject to the xref::syntax/naming.adoc[standard Cypher restrictions on valid identifiers]. - -The following naming rules apply: - -* A name is a valid identifier. -* Name length can be up to 65534 characters. -* Names cannot end with dots. -* Unescaped dots signify that the database alias belongs to a composite database, separating the composite database name and the alias name. -* Names that begin with an underscore or with the prefix `system` are reserved for internal use. -* Non-alphabetic characters, including numbers, symbols, dots, and whitespace characters, can be used in names, but must be escaped using backticks. - -The name restrictions and escaping rules apply to all the different database alias commands. - -[NOTE] -==== -Having dots (`.`) in the database alias names is not recommended. -This is due to the difficulty of determining if a dot is part of the database alias name or a delimiter for a database alias in a composite database. -==== - -When it comes to escaping names using backticks, there are some additional things to consider around database aliases in composite databases: - -.+Escaping database alias and composite database names+ -====== - -The composite database name and the database alias name need to be escaped individually. -The following example creates a database alias named `my alias with spaces` as a constituent in the composite database named `my-composite-database-with-dashes`: - -.Query -[source, cypher] ----- -CREATE ALIAS `my-composite-database-with-dashes`.`my alias with spaces` FOR DATABASE `northwind-graph` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -When not escaped individually, a database alias with the full name `my alias with.dots and spaces` gets created instead: - -.Query -[source, cypher] ----- -CREATE ALIAS `my alias with.dots and spaces` FOR DATABASE `northwind-graph` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -====== - -.+Handling multiple dots+ -====== - -//Examples where dots are not separators between composite name and alias name are impossible to test, because the right escaping cannot be inferred automatically. - -Database alias names may also include dots. -Though these always need to be escaped in order to avoid ambiguity with the composite database and database alias split character. - -.Query -[source, cypher, role=test-skip] ----- -CREATE ALIAS `my.alias.with.dots` FOR DATABASE `northwind-graph` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -.Query -[source, cypher, role=test-skip] ----- -CREATE ALIAS `my.composite.database.with.dots`.`my.other.alias.with.dots` FOR DATABASE `northwind-graph` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -====== - -.+Single dots and local database aliases+ label:deprecated[] -====== -There is a special case for local database aliases with a single dot without any existing composite database. -If a composite database `some` exists, the query below will create a database alias named `alias` within the composite database `some`. -If no such database exists, however, the same query will instead create a database alias named `some.alias`: - -.Query -[source, cypher] ----- -CREATE ALIAS some.alias FOR DATABASE `northwind-graph` ----- - -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -====== - -.+Handling parameters+ -====== - -When using parameters, names cannot be escaped. -When the given parameter includes dots, the first dot will be considered the divider for the composite database. - -Consider the query with parameter: - -.Parameters -[source, javascript] ----- -{ - "aliasname": "mySimpleCompositeDatabase.myAlias" -} ----- - -.Query -[source, cypher] ----- -CREATE ALIAS $aliasname FOR DATABASE `northwind-graph` ----- - -If the composite database `mysimplecompositedatabase` exists, then a database alias `myalias` will be created in that composite database. -If no such composite database exists, then a database alias `mysimplecompositedatabase.myalias` will be created. - -On the contrary, a database alias `myalias` cannot be created in composite `mycompositedatabase.withdot` using parameters. -Consider the same query but with the following parameter: - -.Parameters -[source, javascript] ----- -{ - "aliasname": "myCompositeDatabase.withDot.myAlias" -} ----- - -Since the first dot will be used as a divider, the command will attempt to create the database alias `withdot.myalias` in the composite database `mycompositedatabase`. -If `mycompositedatabase` doesn't exist, the command will create a database alias with the name `mycompositedatabase.withdot.myalias`, which is not part of any composite database. - -In these cases, it is recommended to avoid parameters and explicitly escape the composite database name and alias name separately to avoid ambiguity. - -====== - -.+Handling parameters+ -====== - -Further special handling with parameters is needed for database aliases and similarly named composite databases. - -Consider the set-up: - -.Query -[source, cypher, role="noheader test-skip"] ----- -CREATE COMPOSITE DATABASE foo -CREATE ALIAS `foo.bar` FOR DATABASE `northwind-graph` ----- - -The alias `foo.bar` does not belong to the composite database `foo`. - -Dropping this alias using parameters fails with an error about a missing alias: - -.Parameters -[source, javascript] ----- -{ - "aliasname": "foo.bar" -} ----- - -.Query -[source, cypher, role=test-fail] ----- -DROP ALIAS $aliasname FOR DATABASE ----- - -.Error message -[source, output, role="noheader"] ----- -Failed to delete the specified database alias 'foo.bar': Database alias does not exist. ----- - -Had the composite database `foo` not existed, the database alias `foo.bar` would have been dropped. - -In these cases, it is recommended to avoid parameters and explicitly escape the composite database name and alias name separately to avoid ambiguity. - -====== diff --git a/modules/ROOT/pages/administration/databases.adoc b/modules/ROOT/pages/administration/databases.adoc deleted file mode 100644 index 708e31405..000000000 --- a/modules/ROOT/pages/administration/databases.adoc +++ /dev/null @@ -1,1166 +0,0 @@ -:description: How to use Cypher to manage databases in Neo4j DBMS: creating, modifying, deleting, starting, and stopping individual databases within a single server. - -//// -[source, cypher, role=test-setup] ----- -CREATE DATABASE `movies`; -CREATE ALIAS `films` FOR DATABASE `movies`; -CREATE ALIAS `motion pictures` FOR DATABASE `movies`; ----- -//// - -[[administration-databases]] -= Database management - -[abstract] --- -This section explains how to use Cypher to manage databases in Neo4j DBMS: creating, modifying, deleting, starting, and stopping individual databases within a single server. --- - -Neo4j supports the management of multiple databases within the same DBMS. -The metadata for these databases, including the associated security model, is maintained in a special database called the `system` database. -All multi-database administrative commands must be run against the `system` database. -These administrative commands are automatically routed to the `system` database when connected to the DBMS over Bolt. - -The syntax of the database management commands is as follows: - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -.Database management command syntax -[options="header", width="100%", cols="1m,5a"] -|=== -| Command | Syntax - -| SHOW DATABASE -| -[source, syntax, role="noheader"] ----- -SHOW { DATABASE[S] name \| DATABASE[S] \| DEFAULT DATABASE \| HOME DATABASE } -[WHERE expression] ----- - -[source, syntax, role="noheader"] ----- -SHOW { DATABASE[S] name \| DATABASE[S] \| DEFAULT DATABASE \| HOME DATABASE } -YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n] -[WHERE expression] -[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| CREATE DATABASE -| -[source, syntax, role="noheader"] ----- -CREATE DATABASE name [IF NOT EXISTS] -[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]] -[OPTIONS "{" option: value[, ...] "}"] -[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE DATABASE name -[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]] -[OPTIONS "{" option: value[, ...] "}"] -[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -| CREATE COMPOSITE DATABASE -| -[source, synatx, role="noheader"] ----- -CREATE COMPOSITE DATABASE name [IF NOT EXISTS] -[OPTIONS "{" "}"] -[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -[source, syntax, role="noheader"] ----- -CREATE OR REPLACE COMPOSITE DATABASE name -[OPTIONS "{" "}"] -[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -| ALTER DATABASE -| -[source, syntax, role="noheader"] ----- -ALTER DATABASE name [IF EXISTS] -{ -SET ACCESS {READ ONLY \| READ WRITE} \| -SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] -} -[WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -| STOP DATABASE -| -[source, syntax, role="noheader"] ----- -STOP DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -| START DATABASE -| -[source, syntax, role="noheader"] ----- -START DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -| DROP DATABASE -| -[source, syntax, role="noheader"] ----- -DROP [COMPOSITE] DATABASE name [IF EXISTS] [{DUMP\|DESTROY} [DATA]] [WAIT [n [SEC[OND[S]]]]\|NOWAIT] ----- - -|=== - -[[administration-databases-show-databases]] -== Listing databases - -There are four different commands for listing databases: - -* Listing all databases. -* Listing a particular database. -* Listing the default database. -* Listing the home database. - -These commands return the following columns: - -.Listing databases output -[options="header", width="100%", cols="4m,6a,2m"] -|=== -| Column | Description | Type - -| name -| The name of the database. label:default-output[] -| STRING - -| type -| The type of the database: `system`, `standard`, or `composite`. label:default-output[] -| STRING - -| aliases -| The names of any aliases the database may have. label:default-output[] -| LIST OF STRING - -| access -| The database access mode, either `read-write` or `read-only`. label:default-output[] - -[NOTE] -==== -A database may be described as read-only when using `ALTER DATABASE ... SET ACCESS READ ONLY`. -==== -| STRING - -| databaseID -| The database unique ID. -| STRING - -| serverID -| The server instance ID. -| STRING - -| address -| -Instance address in a clustered DBMS. -The default for a standalone database is `neo4j://localhost:7687`. label:default-output[] -| STRING - -| role -| The current role of the database (`primary`, `secondary`, `unknown`). label:default-output[] -| STRING - -| writer -|`true` for the database node that accepts writes (this node is the leader for this database in a cluster or this is a standalone instance). label:default-output[] -| BOOLEAN - -| requestedStatus -| The expected status of the database. label:default-output[] -| STRING - -| currentStatus -| The actual status of the database. label:default-output[] -| STRING - -| statusMessage -| A message explaining the status of the database, often explaining why it is not in the correct state. label:default-output[] -| STRING - -| default -| -Show if this is the default database for the DBMS. label:default-output[] - -[NOTE] -==== -Not returned by `SHOW HOME DATABASE` or `SHOW DEFAULT DATABASE`. -==== -| BOOLEAN - -| home -| -Shown if this is the home database for the current user. label:default-output[] - -[NOTE] -==== -Not returned by `SHOW HOME DATABASE` or `SHOW DEFAULT DATABASE`. -==== -| BOOLEAN - -| `currentPrimariesCount` -| Number of primaries for this database reported as running currently. -It is the same as the number of rows where `role=primary` and `name=this database`. -| INTEGER - -| `currentSecondariesCount` -| Number of secondaries for this database reported as running currently. -It is the same as the number of rows where `role=secondary` and `name=this database`. -| INTEGER - -| `requestedPrimariesCount` -| The requested number of primaries for this database. -May be lower than current if the DBMS is currently reducing the number of copies of the database, or higher if it is currently increasing the number of copies. -| INTEGER - -| `requestedSecondariesCount` -| The requested number of secondaries for this database. -May be lower than current if the DBMS is currently reducing the number of copies of the database, or higher if it is currently increasing the number of copies. -| INTEGER - -| creationTime -| The date and time at which the database was created. -| DATETIME - -| lastStartTime -| The date and time at which the database was last started. -| DATETIME - -| lastStopTime -| The date and time at which the database was last stopped. -| DATETIME - -| store -a| -Information about the storage engine and the store format. - -The value is a string formatted as: - -[source, syntax, role="noheader"] ----- -{storage engine}-{store format}-{major version}.{minor version} ----- -| STRING - -| lastCommittedTxn -| The ID of the last transaction received. -| INTEGER - -| replicationLag -| -Number of transactions the current database is behind compared to the database on the primary instance. -The lag is expressed in negative integers. In standalone environments, the value is always `0`. -| INTEGER - -|constituents -|The names of any constituents the database may have. label:default-output[] -| LIST OF STRING - -|=== - - -.+SHOW DATABASES+ -====== - -A summary of all available databases can be displayed using the command `SHOW DATABASES`. - -.Query -[source, cypher] ----- -SHOW DATABASES ----- - -.Result -[role="queryresult",options="header,footer",cols="13* Composite database introduction]. - -Composite databases can be created using `CREATE COMPOSITE DATABASE`. - -Composite database names are subject to the same rules as xref:administration-databases-create-database[standard databases]. -One difference is however that the deprecated syntax using dots without enclosing the name in backticks is not available. -Both dots and dashes need to be enclosed within backticks when using composite databases. - -[NOTE] -==== -Having dots (`.`) in the composite database names is not recommended. -This is due to the difficulty of determining if a dot is part of the composite database name or a delimiter for a database alias in a composite database. -==== - -.Query -[source, cypher] ----- -CREATE COMPOSITE DATABASE inventory ----- - -[role="statsonlyqueryresult"] -0 rows, System updates: 1 - -When a composite database has been created, it will show up in the listing provided by the command `SHOW DATABASES`. - - -.Query -[source, cypher] ----- -SHOW DATABASES YIELD name, type, access, role, writer, constituents ----- - -.Result -[role="queryresult",options="header,footer",cols="6*+ | +false+ | +[]+ -| +"library"+ | +"composite"+ | +"read-only"+ | ++ | +false+ | +["library.sci-fi","library.romance"]+ -| +"movies"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -| +"neo4j"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -| +"romance"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -| +"sci-fi-books"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -| +"system"+ | +"system"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -| +"topology-example"+ | +"standard"+ | +"read-write"+ | +"primary"+ | +true+ | +[]+ -6+d|Rows: 8 -|=== - -In order to create database aliases in the composite database, give the composite database as namespace for the alias. -For information about creating aliases in composite databases, see xref:administration/aliases.adoc#alias-management-create-composite-database-alias[here]. - - -[role=enterprise-edition not-on-aura] -[[administration-databases-create-database-existing]] -=== Handling Existing Databases - -These commands are optionally idempotent, with the default behavior to fail with an error if the database already exists. -Appending `IF NOT EXISTS` to the command ensures that no error is returned and nothing happens should the database already exist. -Adding `OR REPLACE` to the command will result in any existing database being deleted and a new one created. - -These behavior flags apply to both standard and composite databases (e.g. a composite database may replace a standard one or another composite.) - - -.+CREATE DATABASE+ -====== - -.Query -[source, cypher] ----- -CREATE COMPOSITE DATABASE customers IF NOT EXISTS ----- - - -====== - - -.+CREATE OR REPLACE DATABASE+ -====== - -.Query -[source, cypher] ----- -CREATE OR REPLACE DATABASE customers ----- - -This is equivalent to running `DROP DATABASE customers IF EXISTS` followed by `CREATE DATABASE customers`. - -[NOTE] -==== -The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together. -==== - -====== - - -[role=enterprise-edition not-on-aura] -[[administration-databases-create-database-options]] -=== Options - -The `CREATE DATABASE` command can have a map of options, e.g. `OPTIONS {key: 'value'}`. - -[NOTE] -==== -There are no available `OPTIONS` values for composite databases. -==== - - -[options="header"] -|=== - -| Key | Value | Description - -| `existingData` -| `use` -| -Controls how the system handles existing data on disk when creating the database. -Currently this is only supported with `existingDataSeedInstance` and must be set to `use` which indicates the existing data files should be used for the new database. - -| `existingDataSeedInstance` -| instance ID of the cluster node -| -Defines which instance is used for seeding the data of the created database. -The instance id can be taken from the id column of the `dbms.cluster.overview()` procedure. Can only be used in clusters. - -| `seedURI` -| URI to a backup or a dump from an existing database. -| -Defines an identical seed from an external source which will be used to seed all servers. - -| `seedConfig` -| comma separated list of configuration values. -| -Defines additional configuration specified by comma separated `name=value` pairs that might be required by certain seed providers. - -| `seedCredentials` -| credentials -| -Defines credentials that needs to be passed into certain seed providers. - -|=== - - -[NOTE] -==== -The `existingData`, `existingDataSeedInstance`, `seedURI`, `seedConfig` and `seedCredentials` options cannot be combined with the `OR REPLACE` part of this command. -For details about the use of these seeding options, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/clustering/databases/#cluster-seed[Operations Manual -> Seed a cluster]. -==== - - -[role=enterprise-edition not-on-aura] -[[administration-databases-alter-database]] -== Altering databases - -Standard databases can be modified using the command `ALTER DATABASE`. - -[role=enterprise-edition not-on-aura] -[[administration-databases-alter-database-access]] -=== Access - -By default, a database has read-write access mode on creation. -The database can be limited to read-only mode on creation using the configuration parameters `dbms.databases.default_to_read_only`, `dbms.databases.read_only`, and `dbms.database.writable`. -For details, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/manage-databases/configuration#manage_database_parameters[Configuration parameters]. - -A database that was created with read-write access mode can be changed to read-only. -To change it to read-only, you can use the `ALTER DATABASE` command with the sub-clause `SET ACCESS READ ONLY`. -Subsequently, the database access mode can be switched back to read-write using the sub-clause `SET ACCESS READ WRITE`. -Altering the database access mode is allowed at all times, whether a database is online or offline. - -If conflicting modes are set by the `ALTER DATABASE` command and the configuration parameters, i.e. one says read-write and the other read-only, the database will be read-only and prevent write queries. - -[NOTE] -==== -Modifying access mode is only available to standard databases and not composite databases. -==== - - -.+ALTER DATABASE+ -====== - -.Query -[source, cypher] ----- -ALTER DATABASE customers SET ACCESS READ ONLY ----- - -.Result -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -====== - - -.+SHOW DATABASES+ -====== - -The database access mode can be seen in the `access` output column of the command `SHOW DATABASES`. - -.Query -[source, cypher] ----- -SHOW DATABASES yield name, access ----- - -.Result -[role="queryresult",options="header,footer",cols="2* Alter topology] for more information. -==== - - -.+SHOW DATABASE+ -====== - -.Query -[source, cypher] ----- -SHOW DATABASES yield name, currentPrimariesCount, currentSecondariesCount, requestedPrimariesCount, requestedSecondariesCount ----- - -====== - -For more details on primary and secondary server roles, see link:{neo4j-docs-base-uri}/operations-manual/{page-version}/clustering/introduction#clustering-introduction-operational[Operations Manual -> Clustering overview]. - -[NOTE] -==== -Modifying database topology is only available to standard databases and not composite databases. -==== - -`ALTER DATABASE` commands are optionally idempotent, with the default behavior to fail with an error if the database does not exist. -Appending `IF EXISTS` to the command ensures that no error is returned and nothing happens should the database not exist. - -.Query -[source, cypher] ----- -ALTER DATABASE nonExisting IF EXISTS SET TOPOLOGY 1 PRIMARY 0 SECONDARY ----- - -[role="statsonlyqueryresult"] -0 rows - - -[role=enterprise-edition not-on-aura] -[[administration-databases-stop-database]] -== Stopping databases - -Databases can be stopped using the command `STOP DATABASE`. - - -.+STOP DATABASE+ -====== - -.Query -[source, cypher] ----- -STOP DATABASE customers ----- - -.Result -[source, result, role="noheader"] ----- -System updates: 1 -Rows: 0 ----- - -[NOTE] -==== -Both standard databases and composite databases can be stopped using this command. -==== - -====== - - -.+SHOW DATABASE+ -====== - -The status of the stopped database can be seen using the command `SHOW DATABASE name`. - -.Query -[source, cypher] ----- -SHOW DATABASE customers YIELD name, requestedStatus, currentStatus ----- - -.Result -[role="queryresult",options="header,footer",cols="3*/data/dumps`). -This can be achieved by appending `DUMP DATA` to the command (or `DESTROY DATA` to explicitly request the default behavior). -These dumps are equivalent to those produced by `neo4j-admin dump` and can be similarly restored using `neo4j-admin load`. - -.Query -[source, cypher] ----- -DROP DATABASE `topology-example` DUMP DATA ----- - -The options `IF EXISTS` and `DUMP DATA`/ `DESTROY DATA` can also be combined. -An example could look like this: - -.Query -[source, cypher] ----- -DROP DATABASE customers IF EXISTS DUMP DATA ----- - -====== - -It is also possible to ensure that only composite databases are dropped. A `DROP COMPOSITE` request would then fail if the targeted database is a standard database. - -.+DROP COMPOSITE DATABASE+ -====== - -.Query -[source, cypher] ----- -DROP COMPOSITE DATABASE inventory ----- - -[role="statsonlyqueryresult"] -0 rows, System updates: 1 - -To ensure the database to be dropped is standard and not composite, the user first needs to check the `type` column of `SHOW DATABASES` manually. - -====== - - -[role=enterprise-edition not-on-aura] -[[administration-wait-nowait]] -== Wait options - -_The_ `WAIT` _subclause was added as an option to the_ `ALTER DATABASE` _command in Neo4j 5.7._ - -Aside from `SHOW DATABASES`, all database management commands accept an optional `WAIT`/`NOWAIT` clause. -The `WAIT`/`NOWAIT` clause allows you to specify a time limit in which the command must complete and return. - -The options are: - -* `WAIT n SECONDS` - Return once completed or when the specified time limit of `n` seconds is up. -* `WAIT` - Return once completed or when the default time limit of 300 seconds is up. -* `NOWAIT` - Return immediately. - -A command using a `WAIT` clause will automatically commit the current transaction when it executes successfully, as the command needs to run immediately for it to be possible to `WAIT` for it to complete. -Any subsequent commands executed will therefore be performed in a new transaction. -This is different to the usual transactional behavior, and for this reason it is recommended that these commands be run in their own transaction. -The default behavior is `NOWAIT`, so if no clause is specified the transaction will behave normally and the action is performed in the background post-commit. - -[NOTE] -==== -A command with a `WAIT` clause may be interrupted whilst it is waiting to complete. -In this event the command will continue to execute in the background and will not be aborted. -==== - - -.+CREATE DATABASE+ -====== - -.Query -[source, cypher] ----- -CREATE DATABASE slow WAIT 5 SECONDS ----- - -.Result -[role="queryresult",options="header,footer",cols="4*>>>>>> 16e3680 (New Administration chapter (#504)) diff --git a/modules/ROOT/pages/administration/servers.adoc b/modules/ROOT/pages/administration/servers.adoc deleted file mode 100644 index 8b7a3949d..000000000 --- a/modules/ROOT/pages/administration/servers.adoc +++ /dev/null @@ -1,442 +0,0 @@ -:description: This section explains how to use Cypher to manage servers in Neo4j. -[role=enterprise-edition] -[[server-management]] -= Server management - -Servers can be added and managed using a set of Cypher administration commands executed against the `system` database. - -When connected to the DBMS over `bolt`, administration commands are automatically routed to the `system` database. - - -[[server-management-syntax]] -== Server management command syntax - -[NOTE] -==== -More details about the syntax descriptions can be found xref:administration/index.adoc#administration-syntax[here]. -==== - -[cols="<15s,<85"] -|=== -| Command -m| ENABLE SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -ENABLE SERVER 'serverId' [OPTIONS "{" option: value[,...] "}"] ----- - -| Description -a| Adds a server that has been discovered to the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| ALTER SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -ALTER SERVER 'name' SET OPTIONS "{" option: value[,...] "}" ----- - -| Description -a| Changes the constraints for a server. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| RENAME SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -RENAME SERVER 'name' TO 'newName' ----- - -| Description -a| Changes the name of a server. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| REALLOCATE DATABASES - -| Syntax -a| -[source, syntax, role=noheader] ----- -[DRYRUN] REALLOCATE DATABASE[S] ----- - -| Description -a| Re-balances databases among the servers in the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| DEALLOCATE DATABASES - -| Syntax -a| -[source, syntax, role=noheader] ----- -[DRYRUN] DEALLOCATE DATABASE[S] FROM SERVER[S] 'name'[, ...] ----- - -| Description -a| Removes all databases from the given servers. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| DROP SERVER - -| Syntax -a| -[source, syntax, role=noheader] ----- -DROP SERVER 'name' ----- - -| Description -a| Removes a server not hosting any databases from the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SERVER MANAGEMENT` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[cols="<15s,<85"] -|=== -| Command -m| SHOW SERVERS - -| Syntax -a| -[source, syntax, role=noheader] ----- -SHOW SERVER[S] - [YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] - [WHERE expression] - [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]] ----- - -| Description -a| Lists all servers visible to the cluster. -For more information see <>. - -| Required privilege -a| `GRANT SHOW SERVERS` - -(see xref:administration/access-control/dbms-administration.adoc#access-control-dbms-administration-server-management[SERVER MANAGEMENT privileges]) -|=== - -[[server-management-show-servers]] -== Listing servers - -`SHOW SERVERS` displays all servers running in the cluster, including servers that have yet to be enabled as well as dropped servers. - -The table of results shows information about the servers: - -[options="header", width="100%", cols="2a,4,2m,1,1"] -|=== -| Column -| Description -| Type -| Default output -| Full output - -| name -| Name of the server. -| STRING -| {check-mark} -| {check-mark} - -| serverId -| Id of the server. -| STRING -| -| {check-mark} - -| address -| Bolt address of the server (if enabled). -| STRING -| {check-mark} -| {check-mark} - -| httpAddress -| Http address of the server (if enabled). -| STRING -| -| {check-mark} - -| httpsAddress -| Https address of the server (if enabled). -| STRING -| -| {check-mark} - -| state -| Information of the state of the server: `free`, `enabled`, `deallocating`, or `dropped`. -| STRING -| {check-mark} -| {check-mark} - -| health -| The availability of the server: `available` or `unavailable`. -| STRING -| {check-mark} -| {check-mark} - -| hosting -| A list of databases currently hosted on the server. -| LIST OF STRING -| {check-mark} -| {check-mark} - -| requestedHosting -| A list of databases that should be hosted on the server, decided by the allocator. -| LIST OF STRING -| -| {check-mark} - -| tags -| Tags are user provided strings that can be used while allocating databases. -| LIST OF STRING -| -| {check-mark} - -| allowedDatabases -| A list of databases allowed to be hosted on the server. -| LIST OF STRING -| -| {check-mark} - -| deniedDatabases -| A list of databases not allowed to be hosted on the server. -| LIST OF STRING -| -| {check-mark} - -| modeConstraint -| Constraint for the allocator to allocate only databases in this mode on the server. -| STRING -| -| {check-mark} - -| version -| Neo4j version the server is running. -| STRING -| -| {check-mark} -|=== - -A summary of all servers can be displayed using the command `SHOW SERVERS`. - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m"] -|=== -|name|address|state|health|hosting - -| "server1" | "localhost:20000" | "Enabled" | "Available" | ["system","neo4j"] -| "server2" | "localhost:20007" | "Enabled" | "Available" | ["system","neo4j"] -| "server3" | "localhost:20014" | "Enabled" | "Available" | ["system","neo4j"] -| "0c030000-267b-49a8-801f-78bd0b5c6445" | "localhost:20021" | "Free" | "Available" | ["system"] -|=== - -[role=not-on-aura] -[[server-management-enable-server]] -== Enabling servers - -A server can be added to the cluster with the `ENABLE SERVER 'name'` command. -The servers initial name is its id. -The server must be in the `free` state to be added to the cluster. -If the server is already `enabled` and the command is executed with the same options specified nothing is changed. -In any other case trying to enable a server fails. - -The possible options allowed when enabling a server are: - -[options="header", width="100%", cols="2a,2,^.^"] -|=== -| Option -| Allowed values -| Description - -| modeConstraint -| `PRIMARY`, `SECONDARY`, `NONE` -| Databases may only be hosted on the server in the mode specified by the constraint. -`None` means there is no constraint and any mode is allowed. - -| allowedDatabases -| list of database names -| Only databases matching the specified names may be hosted on the server. -This may not be specified in combination with `deniedDatabases`. - -| deniedDatabases -| list of database names -| Only databases **not** matching the specified names may be hosted on the server. -This may not be specified in combination with `allowedDatabases`. - -| tags -| list of server tags -| List of server tags used during database allocation and for load balancing and routing policies. -label:new[Introduced in 5.6] -|=== - -[NOTE] -==== -Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. -The composite databases are available everywhere and hold no data on their own. -==== - -[NOTE] -==== -When a server is enabled, if `tags` are not provided in `OPTIONS`, the default server tags are taken from the setting `initial.server.tags`. -==== - -[role=not-on-aura] -[[server-management-alter-server]] -== Modifying servers - -The constraints on a server can be changed with `ALTER SERVER 'name' SET OPTIONS { option: value }`. -Either the name or the id of the server can be used. - -The possible options allowed when altering a server are: - -[options="header", width="100%", cols="2a,2,^.^"] -|=== -| Option -| Allowed values -| Description - -| modeConstraint -| `PRIMARY`, `SECONDARY`, `NONE` -| Databases may only be hosted on the server in the mode specified by the constraint. -`None` means there is no constraint and any mode is allowed. - -| allowedDatabases -| list of database names -| Only databases matching the specified names may be hosted on the server. -This may not be specified in combination with `deniedDatabases`. - -| deniedDatabases -| list of database names -| Only databases **not** matching the specified names may be hosted on the server. -This may not be specified in combination with `allowedDatabases`. - -| tags -| list of server tags -| List of server tags used during database allocation and for load balancing and routing policies. -label:new[Introduced in 5.6] -|=== - -[NOTE] -==== -Composite databases are ignored by both `allowedDatabases` and `deniedDatabases`. -The composite databases are available everywhere and hold no data on their own. -==== - -[NOTE] -==== -Input provided to `SET OPTIONS {...}` replaces **all** existing options, rather than being combined with them. -For instance, if `SET OPTIONS {modeConstraint:'SECONDARY'}` is run followed by `SET OPTIONS {allowedDatabases:['foo']}`, the second `ALTER` removes the mode constraint. -==== - -[[server-management-rename-server]] -== Renaming servers - -The name of a server can be altered with `RENAME SERVER 'name' TO 'newName'`. -Either the id or current name of the server can be used to identify the server. -The new name of the server must be unique. - -[[server-management-reallocate]] -== Reallocate databases - -_The_ `DRYRUN` _feature was introduced in Neo4j 5.2._ - -After enabling a server, `REALLOCATE DATABASES` can be used to make the cluster re-balance databases across all servers that are part of the cluster. -Using `DRYRUN REALLOCATE DATABASE` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: - - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|database|fromServerName|fromServerId|toServerName|toServerId|mode - -| "db1" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-4" | "00000002-25a9-4984-9ad2-dc39024c9238" | "primary" -| "db3" | "server-1" | "00000000-94ff-4ede-87be-3d741b795480" | "server-5" | "00000003-0df7-4057-81fd-1cf43c9ef5f7" | "primary" -|=== - - -[role=not-on-aura] -[[server-management-deallocate]] -== Deallocate databases - -A server can be set to not host any databases with `DEALLOCATE DATABASES FROM SERVER 'name'`, in preparation for removing the server from the cluster. -Either the id or name of the server can be used. -All databases that the server is hosting are moved to other servers. -The server changes state to `deallocating`. -A deallocated server cannot readily be enabled again. - -Multiple servers can be deallocated at the same time, `DEALLOCATE DATABASES FROM SERVER 'server-1', 'server-2'`. -The command fails if there aren't enough servers available to move the databases to. - -Using `DRYRUN DEALLOCATE DATABASES FROM 'server-1', 'server-2'` returns a view of how the databases would have been re-balanced if the command was executed without `DRYRUN`: - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m"] -|=== -|database|fromServerName|fromServerId|toServerName|toServerId|mode -| "db1" | "server-1" | "00000001-8c04-4731-a2fd-7b0289c511ce" | "server-4" | "00000002-5b91-43c1-8b25-5289f674563e" | "primary" -| "db1" | "server-2" | "00000000-7e53-427c-a987-24634c4745f3" | "server-5" | "00000003-0e98-44c8-9844-f0a4eb95b0d8" | "primary" -|=== - -[role=not-on-aura] -[[server-management-drop-server]] -== Drop server - -When a server has been deallocated and is no longer hosting any databases it can be removed from the cluster with `DROP SERVER 'name'`. -Either the id or name of the server can be used. -As long as the server is running, it is listed when showing servers with the state `dropped`. diff --git a/modules/ROOT/pages/appendix/gql-conformance/analogous-cypher.adoc b/modules/ROOT/pages/appendix/gql-conformance/analogous-cypher.adoc index 9c28c5f97..3e118eec3 100644 --- a/modules/ROOT/pages/appendix/gql-conformance/analogous-cypher.adoc +++ b/modules/ROOT/pages/appendix/gql-conformance/analogous-cypher.adoc @@ -58,5 +58,4 @@ Unlike the `FOR` statement, `UNWIND` does not support yielding indexes and offse | Record types | GQL's open `RECORD` type is equivalent to the xref:values-and-types/maps.adoc[`MAP`] type in Cypher. -|=== - +|=== \ No newline at end of file diff --git a/modules/ROOT/pages/appendix/gql-conformance/index.adoc b/modules/ROOT/pages/appendix/gql-conformance/index.adoc index 8a3bf4671..6003b0aa5 100644 --- a/modules/ROOT/pages/appendix/gql-conformance/index.adoc +++ b/modules/ROOT/pages/appendix/gql-conformance/index.adoc @@ -47,4 +47,4 @@ For more information, see xref:syntax/parsing.adoc#_using_unicodes_in_cypher[Par * Cypher supports the following mandatory GQL property types: `BOOLEAN` (`BOOL`), `FLOAT` footnote:[The `FLOAT` type in Cypher always represents a 64-bit double-precision floating point number.], `INTEGER` (`SIGNED INTEGER`, or `INT`)footnote:[The `INTEGER` type in Cypher always represents a 64-bit `INTEGER`.], and `STRING` (`VARCHAR`). + Cypher also supports the following optional GQL property types: `DATE`, `DURATION`, `LIST` (`ARRAY`, `INNER_TYPE LIST`, or `INNER_TYPE ARRAY`)footnote:[The `INNER_TYPE` cannot be a `LIST` type.], `LOCAL DATETIME` (`TIMESTAMP WITHOUT TIME ZONE`), `LOCAL TIME` (`TIME WITHOUT TIME ZONE`), `POINT`, `ZONED DATETIME` (`TIME WITH TIME ZONE`), and `ZONED TIME` (`TIMESTAMP WITH TIME ZONE`). -For more information, see xref:values-and-types/property-structural-constructed.adoc#_property_types[Values and types -> property types]. +For more information, see xref:values-and-types/property-structural-constructed.adoc#_property_types[Values and types -> property types]. \ No newline at end of file diff --git a/modules/ROOT/pages/appendix/gql-conformance/supported-mandatory.adoc b/modules/ROOT/pages/appendix/gql-conformance/supported-mandatory.adoc index e66435560..b8957501d 100644 --- a/modules/ROOT/pages/appendix/gql-conformance/supported-mandatory.adoc +++ b/modules/ROOT/pages/appendix/gql-conformance/supported-mandatory.adoc @@ -219,5 +219,4 @@ For example: `MATCH (n) RETURN n."a prop"` is allowed in GQL but not Cypher. | xref:functions/aggregating.adoc#counting_with_and_without_duplicates[Counting with and without duplicates] | -|=== - +|=== \ No newline at end of file diff --git a/modules/ROOT/pages/appendix/gql-conformance/supported-optional.adoc b/modules/ROOT/pages/appendix/gql-conformance/supported-optional.adoc index 0555bdbe4..9ae3c2f56 100644 --- a/modules/ROOT/pages/appendix/gql-conformance/supported-optional.adoc +++ b/modules/ROOT/pages/appendix/gql-conformance/supported-optional.adoc @@ -243,4 +243,4 @@ GQL also defines a parameterless version of the function not in Cypher: `CURRENT [NOTE] Cypher and GQL sometimes name functions differently and, as a result, several Cypher functions offer the same (or very similar) functionality to their GQL counterpart. -For more information, see the page xref:appendix/gql-conformance/analogous-cypher.adoc[]. +For more information, see the page xref:appendix/gql-conformance/analogous-cypher.adoc[]. \ No newline at end of file diff --git a/modules/ROOT/pages/clauses/call-subquery.adoc b/modules/ROOT/pages/clauses/call-subquery.adoc deleted file mode 100644 index caf00c8de..000000000 --- a/modules/ROOT/pages/clauses/call-subquery.adoc +++ /dev/null @@ -1,959 +0,0 @@ -:description: The `+CALL {}+` clause evaluates a subquery that returns some values. - -[[query-call-subquery]] -= +CALL {}+ (subquery) - -[abstract] --- -The `+CALL {}+` clause evaluates a subquery that returns some values. --- - -`CALL` allows to execute subqueries, i.e. queries inside of other queries. -Subqueries allow you to compose queries, which is especially useful when working with `UNION` or aggregations. - -[TIP] -==== -The `CALL` clause is also used for calling procedures. -For descriptions of the `CALL` clause in this context, refer to xref::clauses/call.adoc[`CALL` procedure]. -==== - -Subqueries which end in a `RETURN` statement are called _returning subqueries_ while subqueries without such a return statement are called _unit subqueries_. - -A subquery is evaluated for each incoming input row. -Every output row of a _returning subquery_ is combined with the input row to build the result of the subquery. -That means that a returning subquery will influence the number of rows. -If the subquery does not return any rows, there will be no rows available after the subquery. - -_Unit subqueries_ on the other hand are called for their side-effects and not for their results and do therefore not influence the results of the enclosing query. - -There are restrictions on how subqueries interact with the enclosing query: - -* A subquery can only refer to variables from the enclosing query if they are explicitly imported. -* A subquery cannot return variables with the same names as variables in the enclosing query. -* All variables that are returned from a subquery are afterwards available in the enclosing query. - -The following graph is used for the examples below: - -image:graph_call_subquery_clause.svg[] - -To recreate the graph, run the following query in an empty Neo4j database: - -[source, cypher, role=test-setup] ----- -CREATE - (a:Person:Child {age: 20, name: 'Alice'}), - (b:Person {age: 27, name: 'Bob'}), - (c:Person:Parent {age: 65, name: 'Charlie'}), - (d:Person {age: 30, name: 'Dora'}) - CREATE (a)-[:FRIEND_OF]->(b) - CREATE (a)-[:CHILD_OF]->(c) -CREATE (:Counter {count: 0}) ----- - - -[[call-semantics]] -== Semantics - -A `CALL` clause is executed once for each incoming row. - - -.Execute for each incoming row -====== - -The `CALL` clause executes three times, one for each row that the `UNWIND` clause outputs. - -.Query -[source, cypher] ----- -UNWIND [0, 1, 2] AS x -CALL { - RETURN 'hello' AS innerReturn -} -RETURN innerReturn ----- - -.Result -[role="queryresult",options="header,footer",cols="m"] -|=== -| +innerReturn+ -| +'hello'+ -| +'hello'+ -| +'hello'+ -d|Rows:3 -|=== -====== - -Each execution of a `CALL` clause can observe changes from previous executions. - - -.Observe changes from previous execution -====== - -.Query -[source, cypher] ----- -UNWIND [0, 1, 2] AS x -CALL { - MATCH (n:Counter) - SET n.count = n.count + 1 - RETURN n.count AS innerCount -} -WITH innerCount -MATCH (n:Counter) -RETURN - innerCount, - n.count AS totalCount ----- - -.Result -[role="queryresult",options="header,footer",cols=""2*(next) - RETURN current AS from, next AS to -} -RETURN - from.name AS name, - from.age AS age, - to.name AS closestOlderName, - to.age AS closestOlderAge ----- - -.Result -[role="queryresult",options="header,footer",cols="4*(other:Person) - RETURN other -UNION - WITH p - OPTIONAL MATCH (p)-[:CHILD_OF]->(other:Parent) - RETURN other -} -RETURN DISTINCT p.name, count(other) ----- - -.Result -[role="queryresult",options="header,footer",cols="2*(b), - (a)-[:CHILD_OF]->(c) ----- -//// - -[[subquery-correlated-aggregation]] -== Aggregation on imported variables - -Aggregations in subqueries are scoped to the subquery evaluation, also for imported variables. -The following example counts the number of younger persons for each person in the graph: - -.Query -[source, cypher] ----- -MATCH (p:Person) -CALL { - WITH p - MATCH (other:Person) - WHERE other.age < p.age - RETURN count(other) AS youngerPersonsCount -} -RETURN p.name, youngerPersonsCount ----- - -.Result -[role="queryresult",options="header,footer",cols="2*>. -Canceling that outer transaction will cancel the inner ones. - -The following example uses a CSV file and the `LOAD CSV` clause to import more data to the example graph. -It creates nodes in separate transactions using `+CALL { ... } IN TRANSACTIONS+`: - -.friends.csv -[source, csv] ----- -1,Bill,26 -2,Max,27 -3,Anna,22 -4,Gladys,29 -5,Summer,24 ----- - -.Query -[source, cypher] ----- -LOAD CSV FROM 'file:///friends.csv' AS line -CALL { - WITH line - CREATE (:Person {name: line[1], age: toInteger(line[2])}) -} IN TRANSACTIONS ----- - -.Result -[role="queryresult",options="footer",cols="1* 100 -CALL { - WITH n - DETACH DELETE n -} IN TRANSACTIONS ----- - -.Result -[role="queryresult",options="footer",cols="1*>. - -After each execution of the inner query finishes (successfully or not), a status value is created that records information about the execution and the transaction that executed it: - -* If the inner execution produces one or more rows as output, then a binding to this status value is added to each row, under the selected variable name. -* If the inner execution fails then a single row is produced containing a binding to this status value under the selected variable, and null bindings for all variables that should have been returned by the inner query (if any). - -The status value is a map value with the following fields: - -* `started`: `true` when the inner transaction was started, `false` otherwise. -* `committed`, true when the inner transaction changes were successfully committed, false otherwise. -* `transactionId`: the inner transaction id, or null if the transaction was not started. -* `errorMessage`, the inner transaction error message, or null in case of no error. - -Example of reporting status with `ON ERROR CONTINUE`: - -.Query -[source, cypher, indent=0, role=test-result-skip] ----- -UNWIND [1, 0, 2, 4] AS i -CALL { - WITH i - CREATE (n:Person {num: 100/i}) // Note, fails when i = 0 - RETURN n -} IN TRANSACTIONS - OF 1 ROW - ON ERROR CONTINUE - REPORT STATUS AS s -RETURN n.num, s; ----- - -.Result -[role="queryresult",options="header,footer",cols="2* 2 - RETURN l AS largeLists -} -RETURN largeLists ----- - -.Error message -[source, error] ----- -Importing WITH should consist only of simple references to outside variables. -WHERE is not allowed. ----- - -A solution to this restriction, necessary for any filtering or ordering of an importing `WITH` clause, is to declare a second `WITH` clause after the importing `WITH` clause. -This second `WITH` clause will act as a regular `WITH` clause. -For example, the following query will not throw an error: - -.Query -[source, cypher] ----- -UNWIND [[1,2],[1,2,3,4],[1,2,3,4,5]] AS l -CALL { - WITH l - WITH size(l) AS size, l AS l - WHERE size > 2 - RETURN l AS largeLists -} -RETURN largeLists ----- - -.Result -[role="queryresult",options="header,footer",cols="1*>>>>>> 16e3680 (New Administration chapter (#504)) ==== List functions, either all or only built-in or user-defined:: diff --git a/modules/ROOT/pages/clauses/where.adoc b/modules/ROOT/pages/clauses/where.adoc index ba4cedf6c..09c338450 100644 --- a/modules/ROOT/pages/clauses/where.adoc +++ b/modules/ROOT/pages/clauses/where.adoc @@ -20,11 +20,7 @@ For more uses of `WHERE`, see xref:expressions/predicates/index.adoc[]. The following graph is used for the examples below: -<<<<<<< HEAD -image::graph_where_clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] -======= image::graph-where-clause.svg[Example graph with Person nodes connecting via knows relationships,width=600,role=popup] ->>>>>>> a7b5b66 (Updated images) To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/constraints/syntax.adoc b/modules/ROOT/pages/constraints/syntax.adoc index b67bf8aec..fcb83e9dc 100644 --- a/modules/ROOT/pages/constraints/syntax.adoc +++ b/modules/ROOT/pages/constraints/syntax.adoc @@ -256,7 +256,6 @@ This is the default if none is given. |[PROPERTY] UNIQUE[NESS] | Returns all property uniqueness constraints, for both nodes and relationships. -_This feature was introduced in Neo4j 5.3._ |NODE [PROPERTY] EXIST[ENCE] | Returns the node property existence constraints. @@ -311,4 +310,4 @@ This means its default behavior is to throw an error if an attempt is made to dr With the `IF EXISTS` flag, no error is thrown and nothing happens should the constraint not exist. Instead, an informational notification is returned detailing that the constraint does not exist. -For examples on how to drop constraints, see xref:constraints/managing-constraints.adoc#drop-constraint[Create, show, and drop constraints -> DROP CONSTRAINT]. +For examples on how to drop constraints, see xref:constraints/managing-constraints.adoc#drop-constraint[Create, show, and drop constraints -> DROP CONSTRAINT]. \ No newline at end of file diff --git a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc index f21405589..022de09dd 100644 --- a/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc +++ b/modules/ROOT/pages/deprecations-additions-removals-compatibility.adoc @@ -2189,7 +2189,7 @@ The `trackedSince` column returns the time when usage statistics tracking starte | Feature | Details -a| +a| label:functionality[] label:new[] @@ -2288,7 +2288,6 @@ The existing `UNIQUENESS` filter will now return both node and relationship prop === New features - [cols="2", options="header"] |=== | Feature @@ -2455,29 +2454,6 @@ More information can be found xref::planning-and-tuning/operators/operators-deta [[cypher-deprecations-additions-removals-5.3]] == Neo4j 5.3 -=== Deprecated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -//not sure what category this should be, it is more information about a coming breaking change than actual deprecation -label:returnValues[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -SHOW NODE UNIQUENESS CONSTRAINTS YIELD type ----- -a| - -The current constraint type for node property uniqueness constraints, `UNIQUENESS`, will be updated to `NODE_UNIQUENESS` in Neo4j version 6.0. - -This will also be reflected in updates to some error messages and query statistics. - -|=== - === Updated features [cols="2", options="header"] @@ -4328,1576 +4304,4 @@ MATCH (n:N {prop1: 42} WHERE n.prop2 > 42) a| New syntax that enables inlining of `WHERE` clauses inside node patterns. -|=== -<<<<<<< HEAD -======= - - -[[cypher-deprecations-additions-removals-4.3]] -== Neo4j 4.3 - -=== Deprecated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON (node:Label) -ASSERT exists(node.property) ----- -a| Replaced by: -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON (node:Label) -ASSERT node.property IS NOT NULL ----- - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON ()-[rel:REL]-() -ASSERT exists(rel.property) ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON ()-[rel:REL]-() -ASSERT rel.property IS NOT NULL ----- - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -exists(prop) ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -prop IS NOT NULL ----- - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -NOT exists(prop) ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -prop IS NULL ----- - -a| -label:syntax[] -label:deprecated[] + -`BRIEF [OUTPUT]` for `SHOW INDEXES` and `SHOW CONSTRAINTS`. -a| -Replaced by default output columns. - - -a| -label:syntax[] -label:deprecated[] + -`VERBOSE [OUTPUT]` for `SHOW INDEXES` and `SHOW CONSTRAINTS`. -a| -Replaced by: -[source, cypher, role="noheader"] ----- -YIELD * ----- - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -SHOW EXISTS CONSTRAINTS ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -SHOW [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -SHOW NODE EXISTS CONSTRAINTS ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -SHOW NODE [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -SHOW RELATIONSHIP EXISTS CONSTRAINTS ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -SHOW RELATIONSHIP [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -Still allows `BRIEF` and `VERBOSE` but not `YIELD` or `WHERE`. - -a| -label:syntax[] -label:deprecated[] + -For privilege commands: -[source, cypher, role="noheader"] ----- -ON DEFAULT DATABASE ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -ON HOME DATABASE ----- - - -a| -label:syntax[] -label:deprecated[] + -For privilege commands: -[source, cypher, role="noheader"] ----- -ON DEFAULT GRAPH ----- -a| -Replaced by: -[source, cypher, role="noheader"] ----- -ON HOME GRAPH ----- - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -MATCH (a) RETURN (a)--() ----- -a| -Pattern expressions producing lists of paths are deprecated, but they can still be used as existence predicates, for example in `WHERE` clauses. -Instead, use a pattern comprehension: -[source, cypher, role="noheader"] ----- -MATCH (a) RETURN [p=(a)--() \| p] ----- -|=== - -=== Updated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW INDEXES WHERE ... ----- -a| -Now allows filtering for: -[source, cypher, role="noheader"] ----- -SHOW INDEXES ----- - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW CONSTRAINTS WHERE ... ----- -a| -Now allows filtering for: -[source, cypher, role="noheader"] ----- -SHOW CONSTRAINTS ----- - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW INDEXES YIELD ... -[WHERE ...] -[RETURN ...] ----- -a| -Now allows `YIELD`, `WHERE`, and `RETURN` clauses to `SHOW INDEXES` to change the output. - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW CONSTRAINTS YIELD ... -[WHERE ...] -[RETURN ...] ----- -a| -Now allows `YIELD`, `WHERE`, and `RETURN` clauses to `SHOW CONSTRAINTS` to change the output. - - -a| -label:syntax[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -a| -New syntax for filtering `SHOW CONSTRAINTS` on property existence constraints. + -Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. - - -a| -label:syntax[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW NODE [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -a| -New syntax for filtering `SHOW CONSTRAINTS` on node property existence constraints. + -Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. - - -a| -label:syntax[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW REL[ATIONSHIP] [PROPERTY] EXIST[ENCE] CONSTRAINTS ----- -a| -New syntax for filtering `SHOW CONSTRAINTS` on relationship property existence constraints. + -Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW FULLTEXT INDEXES ----- -a| -Now allows easy filtering for `SHOW INDEXES` on fulltext indexes. + -Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW LOOKUP INDEXES ----- -a| -Now allows easy filtering for `SHOW INDEXES` on token lookup indexes. + -Allows `YIELD` and `WHERE` but not `BRIEF` or `VERBOSE`. -|=== - -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE DATABASE ... -[OPTIONS {...}] ----- -a| -New syntax to pass options to `CREATE DATABASE`. -This can be used to specify a specific cluster node to seed data from. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON (node:Label) -ASSERT node.property IS NOT NULL ----- -a| -New syntax for creating node property existence constraints. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] -ON ()-[rel:REL]-() -ASSERT rel.property IS NOT NULL ----- -a| -New syntax for creating relationship property existence constraints. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -ALTER USER name IF EXISTS ... ----- -a| -Makes altering users idempotent. -If the specified name does not exists, no error is thrown. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -ALTER USER ... -SET HOME DATABASE ... ----- -a| -Now allows setting home database for user. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -ALTER USER ... -REMOVE HOME DATABASE ----- -a| -Now allows removing home database for user. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE USER ... -SET HOME DATABASE ... ----- -a| -`CREATE USER` now allows setting home database for user. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW HOME DATABASE ----- -a| -New syntax for showing the home database of the current user. - - -a| -label:syntax[] -label:new[] + -New privilege: -[source, cypher, role="noheader"] ----- -SET USER HOME DATABASE ----- -a| -New Cypher command for administering privilege for changing users home database. - - -a| -label:syntax[] -label:new[] + -For privilege commands: -[source, cypher, role="noheader"] ----- -ON HOME DATABASE ----- -a| -New syntax for privileges affecting home database. - - -a| -label:syntax[] -label:new[] + -For privilege commands: -[source, cypher, role="noheader"] ----- -ON HOME GRAPH ----- -a| -New syntax for privileges affecting home graph. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE FULLTEXT INDEX ... ----- -a| -Allows creating fulltext indexes on nodes or relationships. -They can be dropped by using their name. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE INDEX FOR ()-[r:TYPE]-() ... ----- -a| -Allows creating indexes on relationships with a particular relationship type and property combination. -They can be dropped by using their name. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE LOOKUP INDEX ... ----- -a| -Create token lookup index for nodes with any labels or relationships with any relationship type. -They can be dropped by using their name. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -RENAME ROLE ----- -a| -New Cypher command for changing the name of a role. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -RENAME USER ----- -a| -New Cypher command for changing the name of a user. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW PROCEDURE[S] -[EXECUTABLE [BY {CURRENT USER \| username}]] -[YIELD ...] -[WHERE ...] -[RETURN ...] ----- -a| -New Cypher commands for listing procedures. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW [ALL \| BUILT IN \| USER DEFINED] FUNCTION[S] -[EXECUTABLE [BY {CURRENT USER \| username}]] -[YIELD ...] -[WHERE ...] -[RETURN ...] ----- -a| -New Cypher commands for listing functions. - -|=== - - -[[cypher-deprecations-additions-removals-4.2]] -== Neo4j 4.2 - -=== Deprecated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -0... ----- -a| -Replaced by `+0o...+`. - - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -0X... ----- -a| -Only `+0x...+` (lowercase x) is supported. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -CALL { RETURN 1 } ----- -a| -Unaliased expressions are deprecated in subquery `RETURN` clauses. Replaced by: -[source, cypher, role="noheader"] ----- -CALL { RETURN 1 AS one } ----- -|=== - -=== Updated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW ROLE name PRIVILEGES ----- -a| -Can now handle multiple roles. -[source, cypher, role="noheader"] ----- -SHOW ROLES n1, n2, ... PRIVILEGES ----- - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW USER name PRIVILEGES ----- -a| -Can now handle multiple users. -[source, cypher, role="noheader"] ----- -SHOW USERS n1, n2, ... PRIVILEGES ----- - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -round(expression, precision) ----- -a| -The `round()` function can now take an additional argument to specify rounding precision. - - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -round(expression, precision, mode) ----- -a| -The `round()` function can now take two additional arguments to specify rounding precision and rounding mode. -|=== - -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW PRIVILEGES [AS [REVOKE] COMMAND[S]] ----- -a| -Privileges can now be shown as Cypher commands. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -DEFAULT GRAPH ----- -a| -New optional part of the Cypher commands for database privileges. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -0o... ----- -a| -Cypher now interprets literals with prefix `0o` as an octal integer literal. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -SET [PLAINTEXT \| ENCRYPTED] PASSWORD ----- -a| -For `CREATE USER` and `ALTER USER`, it is now possible to set (or update) a password when the plaintext password is unknown, but the encrypted password is available. - - -a| -label:functionality[] -label:new[] + -New privilege: -[source, cypher, role="noheader"] ----- -EXECUTE ----- -a| -New Cypher commands for administering privileges for executing procedures and user defined functions. -See link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-execute[The DBMS `EXECUTE` privileges]. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE [BTREE] INDEX ... [OPTIONS {...}] ----- -a| -Allows setting index provider and index configuration when creating an index. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT ... IS NODE KEY [OPTIONS {...}] ----- -a| -Allows setting index provider and index configuration for the backing index when creating a node key constraint. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT ... IS UNIQUE [OPTIONS {...}] ----- -a| -Allows setting index provider and index configuration for the backing index when creating a property uniqueness constraint. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW CURRENT USER ----- -a| -New Cypher command for showing current logged-in user and roles. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW [ALL \| BTREE] INDEX[ES] [BRIEF \| VERBOSE [OUTPUT]] ----- -a| -New Cypher commands for listing indexes. - -Replaces the procedures `db.indexes`, `db.indexDetails` (verbose), and partially `db.schemaStatements` (verbose). - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW [ALL \| UNIQUE \| NODE EXIST[S] \| RELATIONSHIP EXIST[S] \| EXIST[S] \| NODE KEY] CONSTRAINT[S] [BRIEF \| VERBOSE [OUTPUT]] ----- -a| -New Cypher commands for listing constraints. - -Replaces the procedures `db.constraints` and partially `db.schemaStatements` (verbose). - -a| -label:functionality[] -label:new[] + -New privilege: -[source, cypher, role="noheader"] ----- -SHOW INDEX ----- -a| -New Cypher command for administering privilege for listing indexes. - - -a| -label:functionality[] -label:new[] + -New privilege: -[source, cypher, role="noheader"] ----- -SHOW CONSTRAINTS ----- -a| -New Cypher command for administering privilege for listing constraints. -|=== - - -[[cypher-deprecations-additions-removals-4.1.3]] -== Neo4j 4.1.3 - -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE INDEX [name] IF NOT EXISTS FOR ... ----- -a| -Makes index creation idempotent. If an index with the name or schema already exists no error will be thrown. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -DROP INDEX name IF EXISTS ----- -a| -Makes index deletion idempotent. If no index with the name exists no error will be thrown. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] IF NOT EXISTS ON ... ----- -a| -Makes constraint creation idempotent. If a constraint with the name or type and schema already exists no error will be thrown. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT name IF EXISTS ----- -a| -Makes constraint deletion idempotent. If no constraint with the name exists no error will be thrown. - -|=== - - -[[cypher-deprecations-additions-removals-4.1]] -== Neo4j 4.1 - -=== Restricted features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:restricted[] -[source, cypher, role="noheader"] ----- -REVOKE ... ----- -a| -No longer revokes sub-privileges when revoking a compound privilege, e.g. when revoking `INDEX MANAGEMENT`, any `CREATE INDEX` and `DROP INDEX` privileges will no longer be revoked. - -a| -label:functionality[] -label:restricted[] -[source, cypher, role="noheader"] ----- -ALL DATABASE PRIVILEGES ----- -a| -No longer includes the privileges `START DATABASE` and `STOP DATABASE`. -|=== - -=== Updated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:procedure[] -label:updated[] -[source, cypher, role="noheader"] ----- -queryId ----- -a| -The `queryId` procedure format has changed, and no longer includes the database name. For example, `mydb-query-123` is now `query-123`. This change affects built-in procedures `dbms.listQueries()`, `dbms.listActiveLocks(queryId)`, `dbms.killQueries(queryIds)` `and dbms.killQuery(queryId)`. - -a| -label:functionality[] -label:updated[] -[source, cypher, role="noheader"] ----- -SHOW PRIVILEGES ----- -a| -The returned privileges are a closer match to the original grants and denies, e.g. if granted `MATCH` the command will show that specific privilege and not the `TRAVERSE` and `READ` privileges. Added support for `YIELD` and `WHERE` clauses to allow filtering results. -|=== - -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:new[] + -New role: -[source, cypher, role="noheader"] ----- -PUBLIC ----- -a| -The `PUBLIC` role is automatically assigned to all users, giving them a set of base privileges. - -a| -label:syntax[] -label:new[] + -For privileges: -[source, cypher, role="noheader"] ----- -REVOKE MATCH ----- -a| -The `MATCH` privilege can now be revoked. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW USERS ----- -a| -New support for `YIELD` and `WHERE` clauses to allow filtering results. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW ROLES ----- -a| -New support for `YIELD` and `WHERE` clauses to allow filtering results. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -SHOW DATABASES ----- -a| -New support for `YIELD` and `WHERE` clauses to allow filtering results. - -a| -label:functionality[] -label:new[] + -link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/database-administration/#access-control-database-administration-transaction[TRANSACTION MANAGEMENT] privileges -a| -New Cypher commands for administering transaction management. - -a| -label:functionality[] -label:new[] + -DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-user-management[USER MANAGEMENT] privileges -a| -New Cypher commands for administering user management. - -a| -label:functionality[] -label:new[] + -DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-database-management[DATABASE MANAGEMENT] privileges -a| -New Cypher commands for administering database management. - -a| -label:functionality[] -label:new[] + -DBMS link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/dbms-administration/#access-control-dbms-administration-privilege-management[PRIVILEGE MANAGEMENT] privileges -a| -New Cypher commands for administering privilege management. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -ALL DBMS PRIVILEGES ----- -a| -New Cypher command for administering role, user, database and privilege management. - - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -ALL GRAPH PRIVILEGES ----- -a| -New Cypher command for administering read and write privileges. - -a| -label:functionality[] -label:new[] + -Write privileges -a| -New Cypher commands for administering write privileges. - -a| -label:functionality[] -label:new[] -[source, cypher, role="noheader"] ----- -ON DEFAULT DATABASE ----- -a| -New optional part of the Cypher commands for database privileges. -|=== - - -[[cypher-deprecations-additions-removals-4.0]] -== Neo4j 4.0 - -=== Removed features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -rels() ----- -a| -Replaced by xref:functions/list.adoc#functions-relationships[relationships()]. - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -toInt() ----- -a| -Replaced by xref:functions/scalar.adoc#functions-tointeger[toInteger()]. - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -lower() ----- -a| -Replaced by xref:functions/string.adoc#functions-tolower[toLower()]. - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -upper() ----- -a| -Replaced by xref:functions/string.adoc#functions-toupper[toUpper()]. - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -extract() ----- -a| -Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. - -a| -label:function[] -label:removed[] -[source, cypher, role="noheader"] ----- -filter() ----- -a| -Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. - -a| -label:functionality[] -label:removed[] + -For Rule planner: -[source, cypher, role="noheader"] ----- -CYPHER planner=rule ----- -a| -The `RULE` planner was removed in 3.2, but still possible to trigger using `START` or `CREATE UNIQUE` clauses. Now it is completely removed. - - -a| -label:functionality[] -label:removed[] + -Explicit indexes -a| -The removal of the `RULE` planner in 3.2 was the beginning of the end for explicit indexes. Now they are completely removed, including the removal of the link:https://neo4j.com/docs/cypher-manual/3.5/schema/index/#explicit-indexes-procedures[built-in procedures for Neo4j 3.3 to 3.5]. - - -a| -label:functionality[] -label:removed[] + -For compiled runtime: -[source, cypher, role="noheader"] ----- -CYPHER runtime=compiled ----- -a| -Replaced by the new `pipelined` runtime which covers a much wider range of queries. - - -a| -label:clause[] -label:removed[] -[source, cypher, role="noheader"] ----- -CREATE UNIQUE ----- -a| -Running queries with this clause will cause a syntax error. - -a| -label:clause[] -label:removed[] -[source, cypher, role="noheader"] ----- -START ----- -a| -Running queries with this clause will cause a syntax error. - -a| -label:syntax[] -label:removed[] -[source, cypher, role="noheader"] ----- -MATCH (n)-[:A\|:B\|:C {foo: 'bar'}]-() RETURN n ----- -a| -Replaced by `MATCH (n)-[:A\|B\|C {foo: 'bar'}]-() RETURN n`. - -a| -label:syntax[] -label:removed[] -[source, cypher, role="noheader"] ----- -MATCH (n)-[x:A\|:B\|:C]-() RETURN n ----- -a| -Replaced by `MATCH (n)-[x:A\|B\|C]-() RETURN n`. - - -a| -label:syntax[] -label:removed[] -[source, cypher, role="noheader"] ----- -MATCH (n)-[x:A\|:B\|:C*]-() RETURN n ----- -a| -Replaced by `MATCH (n)-[x:A\|B\|C*]-() RETURN n`. - - -a| -label:syntax[] -label:removed[] -[source, cypher, role="noheader"] ----- -{parameter} ----- -a| -Replaced by xref:syntax/parameters.adoc[$parameter]. -|=== - -=== Deprecated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -MATCH (n)-[rs*]-() RETURN rs ----- -a| -As in Cypher 3.2, this is replaced by: -[source, cypher, role="noheader"] ----- -MATCH p=(n)-[*]-() RETURN relationships(p) AS rs ----- - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -CREATE INDEX ON :Label(prop) ----- -a| -Replaced by `CREATE INDEX FOR (n:Label) ON (n.prop)`. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -DROP INDEX ON :Label(prop) ----- -a| -Replaced by `DROP INDEX name`. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT ON (n:Label) ASSERT (n.prop) IS NODE KEY ----- -a| -Replaced by `DROP CONSTRAINT name`. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT ON (n:Label) ASSERT (n.prop) IS UNIQUE ----- -a| -Replaced by `DROP CONSTRAINT name`. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT ON (n:Label) ASSERT exists(n.prop) ----- -a| -Replaced by `DROP CONSTRAINT name`. - -a| -label:syntax[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT ON ()-[r:Type]-() ASSERT exists(r.prop) ----- -a| -Replaced by `DROP CONSTRAINT name`. - -|=== - -=== Restricted features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:function[] -label:restricted[] -[source, cypher, role="noheader"] ----- -length() ----- -a| -Restricted to only work on paths. See xref:functions/scalar.adoc#functions-length[length()] for more details. - -a| -label:function[] -label:restricted[] -[source, cypher, role="noheader"] ----- -size() ----- -a| -Only works for strings, lists and pattern comprehensions, and no longer works for paths. -For versions above 5.0, use a `COUNT` expression instead: -[source, cypher, role="noheader"] ----- -RETURN COUNT { (a)-[]->(b) } ----- -For versions below 5.0, use a pattern comprehension instead: -[source, cypher, role="noheader"] ----- -RETURN size([ (a)-[]->(b) \| a ]) ----- -See xref:functions/scalar.adoc#functions-size[size()] and xref:subqueries/count.adoc[Count Subqueries] for more details. -|=== - -=== Updated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:syntax[] -label:extended[] -[source, cypher, role="noheader"] ----- -CREATE CONSTRAINT [name] ON ... ----- -a| -The create constraint syntax can now include a name. - -The `IS NODE KEY` and `IS UNIQUE` versions of this command replace the procedures `db.createNodeKey` and `db.createUniquePropertyConstraint`, respectively. - -|=== - -=== New features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:new[] + -Pipelined runtime: -[source, cypher, role="noheader"] ----- -CYPHER runtime=pipelined ----- -a| -This Neo4j Enterprise Edition only feature involves a new runtime that has many performance enhancements. - -a| -label:functionality[] -label:new[] + -link:{neo4j-docs-base-uri}/operations-manual/current/database-administration/standard-databases/manage-databases/[Multi-database administration] -a| -New Cypher commands for administering multiple databases. - -a| -label:functionality[] -label:new[] + -link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/[Access control] -a| -New Cypher commands for administering role-based access control. - -a| -label:functionality[] -label:new[] + -link:{neo4j-docs-base-uri}/operations-manual/current/authentication-authorization/manage-privileges/[Fine-grained security] -a| -New Cypher commands for administering dbms, database, graph and sub-graph access control. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -CREATE INDEX [name] FOR (n:Label) ON (n.prop) ----- -a| -New syntax for creating indexes, which can include a name. - -Replaces the `db.createIndex` procedure. - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -DROP INDEX name ----- -a| -xref:indexes/search-performance-indexes/managing-indexes.adoc#indexes-drop-an-index[New command] for dropping an index by name. - - -a| -label:syntax[] -label:new[] -[source, cypher, role="noheader"] ----- -DROP CONSTRAINT name ----- -a| -xref:constraints/managing-constraints.adoc#drop-constraint[New command] for dropping a constraint by name, no matter the type. - - -a| -label:clause[] -label:new[] -[source, cypher, role="noheader"] ----- -WHERE EXISTS {...} ----- -a| -`EXISTS` subqueries are subclauses used to filter the results of a `MATCH`, `OPTIONAL MATCH`, or `WITH` clause. - -a| -label:clause[] -label:new[] -[source, cypher, role="noheader"] ----- -USE neo4j ----- -a| -New clause to specify which graph a query, or query part, is executed against. - -|=== - - -[[cypher-deprecations-additions-removals-3.5]] -== Neo4j 3.5 - -=== Deprecated features - -[cols="2", options="header"] -|=== -| Feature -| Details - -a| -label:functionality[] -label:deprecated[] + -Compiled runtime: -[source, cypher, role="noheader"] ----- -CYPHER runtime=compiled ----- -a| -The compiled runtime will be discontinued in the next major release. It might still be used for default queries in order to not cause regressions, but explicitly requesting it will not be possible. - -a| -label:function[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -extract() ----- -a| -Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. - -a| -label:function[] -label:deprecated[] -[source, cypher, role="noheader"] ----- -filter() ----- -a| -Replaced by xref:values-and-types/lists.adoc#cypher-list-comprehension[list comprehension]. -|=== - - -[[cypher-deprecations-additions-removals-3.4]] -== Neo4j 3.4 -[options="header"] -|=== -| Feature | Type | Change | Details -| xref:values-and-types/spatial.adoc[Spatial point types] | Functionality | Amendment | A point -- irrespective of which Coordinate Reference System is used -- can be stored as a property and is able to be backed by an index. Prior to this, a point was a virtual property only. -| xref:functions/spatial.adoc#functions-point-cartesian-3d[point() - Cartesian 3D] | Function | Added | -| xref:functions/spatial.adoc#functions-point-wgs84-3d[point() - WGS 84 3D] | Function | Added | -| xref:functions/scalar.adoc#functions-randomuuid[randomUUID()] | Function | Added | -| xref:values-and-types/temporal.adoc[Temporal types] | Functionality | Added | Supports storing, indexing and working with the following temporal types: Date, Time, LocalTime, DateTime, LocalDateTime and Duration. -| xref:functions/temporal/index.adoc[Temporal functions] | Functionality | Added | Functions allowing for the creation and manipulation of values for each temporal type -- _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ and _Duration_. -| xref:syntax/operators.adoc#query-operators-temporal[Temporal operators] | Functionality | Added | Operators allowing for the manipulation of values for each temporal type -- _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ and _Duration_. -| xref:functions/string.adoc#functions-tostring[toString()] | Function | Extended | Now also allows temporal values as input (i.e. values of type _Date_, _Time_, _LocalTime_, _DateTime_, _LocalDateTime_ or _Duration_). -|=== - - -[[cypher-deprecations-additions-removals-3.3]] -== Neo4j 3.3 -[options="header"] -|=== -| Feature | Type | Change | Details -| `START` | Clause | Removed | As in Cypher 3.2, any queries using the `START` clause will revert back to Cypher 3.1 `planner=rule`. -However, there are link:https://neo4j.com/docs/cypher-manual/3.5/schema/index/#explicit-indexes-procedures[built-in procedures for Neo4j versions 3.3 to 3.5] for accessing explicit indexes. The procedures will enable users to use the current version of Cypher and the cost planner together with these indexes. -An example of this is `CALL db.index.explicit.searchNodes('my_index','email:me*')`. -| `CYPHER runtime=slotted` (Faster interpreted runtime) | Functionality | Added | Neo4j Enterprise Edition only -| xref:functions/aggregating.adoc#functions-max[max()], xref:functions/aggregating.adoc#functions-min[min()] | Function | Extended | Now also supports aggregation over sets containing lists of strings and/or numbers, as well as over sets containing strings, numbers, and lists of strings and/or numbers -|=== - - -[[cypher-deprecations-additions-removals-3.2]] -== Neo4j 3.2 -[options="header"] -|=== -| Feature | Type | Change | Details -| `CYPHER planner=rule` (Rule planner) | Functionality | Removed | All queries now use the cost planner. Any query prepended thus will fall back to using Cypher 3.1. -| `CREATE UNIQUE` | Clause | Removed | Running such queries will fall back to using Cypher 3.1 (and use the rule planner) -| `START` | Clause | Removed | Running such queries will fall back to using Cypher 3.1 (and use the rule planner) -| `MATCH (n)-[rs*]-() RETURN rs` | Syntax | Deprecated | Replaced by `MATCH p=(n)-[*]-() RETURN relationships(p) AS rs` -| `MATCH (n)-[:A\|:B\|:C {foo: 'bar'}]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[:A\|B\|C {foo: 'bar'}]-() RETURN n` -| `MATCH (n)-[x:A\|:B\|:C]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C]-() RETURN n` -| `MATCH (n)-[x:A\|:B\|:C*]-() RETURN n` | Syntax | Deprecated | Replaced by `MATCH (n)-[x:A\|B\|C*]-() RETURN n` -| link:/docs/java-reference/5/extending-neo4j/aggregation-functions#extending-neo4j-aggregation-functions[User-defined aggregation functions] | Functionality | Added | -| xref:indexes/search-performance-indexes/managing-indexes.adoc[Composite indexes] | Index | Added | -| xref:constraints/managing-constraints.adoc#create-key-constraint[Node Key] | Index | Added | Neo4j Enterprise Edition only -| `CYPHER runtime=compiled` (Compiled runtime) | Functionality | Added | Neo4j Enterprise Edition only -| xref:functions/list.adoc#functions-reverse-list[reverse()] | Function | Extended | Now also allows a list as input -| xref:functions/aggregating.adoc#functions-max[max()], xref:functions/aggregating.adoc#functions-min[min()] | Function | Extended | Now also supports aggregation over a set containing both strings and numbers -|=== - - -[[cypher-deprecations-additions-removals-3.1]] -== Neo4j 3.1 -[options="header"] -|=== -| Feature | Type | Change | Details -| `rels()` | Function | Deprecated | Replaced by xref:functions/list.adoc#functions-relationships[relationships()] -| `toInt()` | Function | Deprecated | Replaced by xref:functions/scalar.adoc#functions-tointeger[toInteger()] -| `lower()` | Function | Deprecated | Replaced by xref:functions/string.adoc#functions-tolower[toLower()] -| `upper()` | Function | Deprecated | Replaced by xref:functions/string.adoc#functions-toupper[toUpper()] -| xref:functions/scalar.adoc#functions-toboolean[toBoolean()] | Function | Added | -| xref:values-and-types/maps.adoc#cypher-map-projection[Map projection] | Syntax | Added | -| xref:values-and-types/lists.adoc#cypher-pattern-comprehension[Pattern comprehension] | Syntax | Added | -| link:/docs/java-reference/5/extending-neo4j/functions#extending-neo4j-functions[User-defined functions] | Functionality | Added | -| xref:clauses/call.adoc[CALL\...YIELD\...WHERE] | Clause | Extended | Records returned by `YIELD` may be filtered further using `WHERE` -|=== - - -[[cypher-deprecations-additions-removals-3.0]] -== Neo4j 3.0 -[options="header"] -|=== -| Feature | Type | Change | Details -| `has()` | Function | Removed | Replaced by xref:functions/predicate.adoc#functions-exists[exists()] -| `str()` | Function | Removed | Replaced by xref:functions/string.adoc#functions-tostring[toString()] -| `+{parameter}+` | Syntax | Deprecated | Replaced by xref:syntax/parameters.adoc[$parameter] -| xref:functions/scalar.adoc#functions-properties[properties()] | Function | Added | -| xref:clauses/call.adoc[CALL [\...YIELD\]] | Clause | Added | -| xref:functions/spatial.adoc#functions-point-cartesian-2d[point() - Cartesian 2D] | Function | Added | -| xref:functions/spatial.adoc#functions-point-wgs84-2d[point() - WGS 84 2D] | Function | Added | -| xref:functions/spatial.adoc#functions-distance[distance()] | Function | Added | -| link:/docs/java-reference/5/extending-neo4j/procedures#extending-neo4j-procedures[User-defined procedures] | Functionality | Added | -| xref:functions/string.adoc#functions-tostring[toString()] | Function | Extended | Now also allows Boolean values as input -|=== ->>>>>>> 5ec3805 (Document relationship key and uniqueness constraints (#225)) +|=== \ No newline at end of file diff --git a/modules/ROOT/pages/expressions/map-expressions.adoc b/modules/ROOT/pages/expressions/map-expressions.adoc index 9eb94e695..9a0e4defd 100644 --- a/modules/ROOT/pages/expressions/map-expressions.adoc +++ b/modules/ROOT/pages/expressions/map-expressions.adoc @@ -12,7 +12,7 @@ The xref:functions/list.adoc#functions-keys[`keys()`] function can be used to re The following graph is used for the examples below: -image::values_and_types_maps_graph.svg[width="700",role="middle"] +image::values-and-types-maps-graph.svg[Example graph featuring connections between person and movie nodes,width="700",role="middle"] To recreate the graph, run the following query against an empty Neo4j database: diff --git a/modules/ROOT/pages/functions/list.adoc b/modules/ROOT/pages/functions/list.adoc index 44c06ea4a..912f319e8 100644 --- a/modules/ROOT/pages/functions/list.adoc +++ b/modules/ROOT/pages/functions/list.adoc @@ -19,11 +19,7 @@ The following graph is used for the examples below: image::graph-list-functions.svg[Example graph connecting people after their roles as administrator, designer, and developer,role=popup,width=600] -<<<<<<< HEAD To recreate the graph, run the following query against an empty Neo4j database: -======= -To recreate the graph, run the following query in an empty Neo4j database: ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher, role=test-setup] ---- @@ -64,10 +60,7 @@ CREATE ====== .Query -<<<<<<< HEAD // tag::functions_list_keys[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Alice' @@ -81,13 +74,8 @@ A `LIST` containing the names of all the properties on the node bound to [role="queryresult",options="header,footer",cols="1*>>>>>> bec9309 (5.8 dev reconciliation (#564)) 1+d|Rows: 1 |=== @@ -121,10 +109,7 @@ A `LIST` containing the names of all the properties on the node bound to ====== .Query -<<<<<<< HEAD // tag::functions_list_labels[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Alice' @@ -172,10 +157,7 @@ A `LIST` containing all the labels of the node bound to `a` is returned. ====== .Query -<<<<<<< HEAD // tag::functions_list_nodes[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -226,10 +208,7 @@ The only exception where the range does not contain `start` are empty ranges. ====== .Query -<<<<<<< HEAD // tag::functions_list_range[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN range(0, 10), range(2, 18, 3), range(0, 5, -1) @@ -278,10 +257,7 @@ As such, Cypher's `reduce()` is analogous to the `fold` or `reduce` methods in f ====== .Query -<<<<<<< HEAD // tag::functions_list_reduce[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -329,10 +305,7 @@ The `age` property of all `NODE` values in the `PATH` are summed and returned as ====== .Query -<<<<<<< HEAD // tag::functions_list_relationships[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH p = (a)-->(b)-->(c) @@ -381,10 +354,7 @@ A `LIST` containing all the `RELATIONSHIP` values in the `PATH` `p ====== .Query -<<<<<<< HEAD // tag::functions_list_reverse[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- WITH [4923,'abc',521, null, 487] AS ids @@ -421,10 +391,7 @@ RETURN reverse(ids) ====== .Query -<<<<<<< HEAD // tag::functions_list_tail[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- MATCH (a) WHERE a.name = 'Eskil' @@ -525,10 +492,7 @@ toBooleanList(['a string', true, 'false', null, ['A','B']]) as mixedList ====== .Query -<<<<<<< HEAD // tag::functions_list_to_float_list[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN toFloatList(null) as noList, @@ -578,10 +542,7 @@ toFloatList(['a string', 2.5, '3.14159', null, ['A','B']]) as mixedList ====== .Query -<<<<<<< HEAD // tag::functions_list_to_integer_list[] -======= ->>>>>>> bec9309 (5.8 dev reconciliation (#564)) [source, cypher] ---- RETURN toIntegerList(null) as noList, diff --git a/modules/ROOT/pages/index.adoc b/modules/ROOT/pages/index.adoc deleted file mode 100644 index 0eb155bf2..000000000 --- a/modules/ROOT/pages/index.adoc +++ /dev/null @@ -1,98 +0,0 @@ -:description: This is the Cypher Query Language documentation for Neo4j, authored by the Neo4j Team. - -[[cypher-manual]] -= The Neo4j Cypher Manual v{neo4j-version} -:neo4j-buildnumber: {neo4j-version-minor} - -Cypher is Neo4j's graph query language that allows users to store and retrieve data from the graph database. -It is a declarative, SQL-inspired language for describing visual patterns in graphs. -The syntax provides a visual and logical way to match patterns of nodes and relationships in the graph. - - -== Documentation updates for Neo4j 5 - -Neo4j {neo4j-version} includes a number of new features and updates. -A highlight of these include: - -* Cypher syntax improvements with Graph Pattern Matching (relationships and labels): -+ -** In `MATCH` clauses, `WHERE` can be placed inside a relationship pattern to filter relationships. -** In `MATCH` clauses, nodes and relationships can be filtered using more sophisticated label (type) expressions. -** Simpler alternative syntax to navigate and traverse graphs using the following operators: -*** `&`: logical `AND` -*** `|`: logical `OR` -*** `!`: logical `NOT` -*** `%`: a "wildcard", meaning "any label" (in Cypher this translates to `size(labels(n)) > 0`). + - -+ -For more information, see the xref:syntax/expressions.adoc#label-expressions[section on Label expressions] and in xref:clauses/where.adoc[the `WHERE` clause]. - -* New `elementID` for graph objects: -+ -New IDs are introduced to uniquely identify graph elements in Neo4j databases. -Node ID will exist with each release of Neo4j {neo4j-version}. -+ -For more information, see xref:functions/scalar.adoc#functions-elementid[`elementId()`]. - -* Composite databases. -+ -Composite databases allow queries that access multiple graphs at once. -You can create, update, and remove configurations without a restart, whether the database is within the same cluster, or hosted remotely. -+ -For more information on composite databases, and how to create composite databases, see link:https://neo4j.com/docs/operations-manual/current/composite-databases/[Operations Manual -> Composite databases], and xref:databases.adoc#administration-databases-create-composite-database[Creating composite databases]. - -* Immutable privileges. -+ -Immutable privileges are useful for restricting the actions of users who themselves are able to administer privileges. + -For more information, see xref:access-control/privileges-immutable.adoc[Immutable privileges]. - -* `Execute` and `ExecuteBoosted` privilege. -+ -The permissions for the execution of admin procedures have been refreshed; these two privileges are now hierarchically related. -+ -For more information, see xref:access-control/dbms-administration.adoc#access-control-execute-procedure[the `EXECUTE PROCEDURE` privilege] and xref:access-control/dbms-administration.adoc#access-control-execute-boosted-procedure[the `EXECUTE BOOSTED PROCEDURE` privilege]. - -* `EXISTS` and `COUNT` are now both expressions. -+ -For more information, see xref:syntax/expressions.adoc#cypher-subquery-expressions[Subquery expressions]. - -* `SHOW` and `TERMINATE TRANSACTIONS` improvements. -+ -You can now combine these two commands in the same query. -The ability to yield and filter the output from `TERMINATE TRANSACTIONS` has been added. -+ -For more information, see xref:deprecations-additions-removals-compatibility.adoc#_updated_features[Updated features list]. - -* `SHOW SETTINGS` clause. -+ -You can now query configuration settings using `SHOW SETTINGS` clause. -+ -For more information, see xref:clauses/listing-settings.adoc[SHOW SETTINGS]. - -* Changes to Neo4j indexes: -+ -** The B-tree index type has been removed. -** New Range and Point index types are available now. -** Faster Text index provider for `ENDS WITH` and `CONTAINS` queries is introduced. -** Full-text indexes can now index lists of strings. - -+ -For more information, see xref:indexes-for-search-performance.adoc[new index types]. - - -ifdef::backend-html5[(C) {copyright}] -ifndef::backend-pdf[] - -Documentation license: link:{common-license-page-uri}[Creative Commons 4.0] -endif::[] -ifdef::backend-pdf[] -(C) {copyright} - -Documentation license: <> -endif::[] - -ifdef::backend-pdf[] -include::license.adoc[leveloffset=+1] -endif::[] - - diff --git a/modules/ROOT/pages/introduction/aura.adoc b/modules/ROOT/pages/introduction/aura.adoc deleted file mode 100644 index 449df071e..000000000 --- a/modules/ROOT/pages/introduction/aura.adoc +++ /dev/null @@ -1,52 +0,0 @@ -= Aura and Cypher - -== Introduction - -Aura is Neo4j's fully managed cloud service. -It consists of AuraDB and AuraDS. -AuraDB is a graph database service for developers building intelligent applications, and AuraDS is a Graph Data Science (GDS) service for data scientists building predictive models and analytics workflows. - -AuraDB is available on the following tiers: - -* AuraDB Free -* AuraDB Pro -* AuraDB Enterprise - -For more information, see link:{neo4j-docs-base-uri}/aura/auradb[Aura docs - Neo4j AuraDB overview]. - -AuraDS is available on the following tiers: - -* AuraDS Pro -* AuraDS Enterprise - -For more information, see link:{neo4j-docs-base-uri}/aura/aurads[Aura docs - Neo4j AuraDS overview] - -== Using Cypher on Aura - -Most Cypher features are available on all tiers of Aura. -There are, however, some features which are not available to Aura instances. -For example, it is not possible to create, alter, or drop databases using Aura, nor is it possible to alter or drop servers. - -There are also certain Cypher features which are only available on AuraDB Enterprise instances. -These can be categorized as the role-based access-control features of Cypher. -For example, it is not possible to create, alter, or drop roles using AuraDB Free, AuraDB Pro, AuraDS Pro, or AuraDS Enterprise, but it is possible using AuraDB Enterprise. - -The Cypher Manual uses two different labels to differentiate this distinction: - -[options="header,cols=""2a,2a"] -|=== -| Label | Description -| label:not-on-aura[] | Cypher feature not available on any tier of Aura. -| label:aura-db-enterprise[] | Cypher feature only available on AuraDB Enterprise. -|=== - -//// -TODO: remove comment blocks once Aura Cheat Sheet has been published. - -== Aura and the Cypher Cheat Sheet - -Each different tier of Aura has a customized version of the Cypher Cheat Sheet which only shows the features of Cypher available for the chosen tier. - -The Aura Cheat Sheet can be accessed here: //Add url when available -Note that the default tier is AuraDB Enterprise. -//// diff --git a/modules/ROOT/pages/introduction/cypher-overview.adoc b/modules/ROOT/pages/introduction/cypher-overview.adoc index 2f3e659eb..6f4642b42 100644 --- a/modules/ROOT/pages/introduction/cypher-overview.adoc +++ b/modules/ROOT/pages/introduction/cypher-overview.adoc @@ -13,15 +13,6 @@ MERGE (keanu)-[:ACTED_IN]->(matrix) ---- //// -//// -[source, cypher, role=test-setup] ----- -MERGE (matrix:Movie {title: 'The Matrix', rating: 10}) -MERGE (keanu:Person {name: 'Keanu Reeves'}) -MERGE (keanu)-[:ACTED_IN]->(matrix) ----- -//// - == What is Cypher? Cypher is Neo4j’s declarative graph query language. @@ -91,4 +82,4 @@ RETURN actor.name Neo4j supports the APOC (Awesome Procedures on Cypher) Core library. The APOC Core library provides access to user-defined procedures and functions which extend the use of the Cypher query language into areas such as data integration, graph algorithms, and data conversion. -For more details, visit the link:{neo4j-docs-base-uri}/apoc/current[APOC Core page]. +For more details, visit the link:{neo4j-docs-base-uri}/apoc/current[APOC Core page]. \ No newline at end of file diff --git a/modules/ROOT/pages/values-and-types/maps.adoc b/modules/ROOT/pages/values-and-types/maps.adoc new file mode 100644 index 000000000..8f3057faf --- /dev/null +++ b/modules/ROOT/pages/values-and-types/maps.adoc @@ -0,0 +1,36 @@ +:description: This section describes how to use maps in Cyphers. + +[[cypher-maps]] += Maps + +Cypher supports the construction of maps. + +[NOTE] +==== +For information about the property access operators `.` and `[]`, see xref:expressions/map-expressions#map-operators[Map expressions -> Map operators]. + +For information about how the `[]` operator behaves with respect to `null`, see xref::values-and-types/working-with-null.adoc#cypher-null-bracket-operator[Working with `null` -> The `[\]` operator and `null`]. +==== + + +[[cypher-literal-maps]] +== Literal maps + +The key names in a map must be literals. +If returned through an link:{neo4j-docs-base-uri}/http-api/current[HTTP API call], a JSON object will be returned. +If returned in Java, an object of type `java.util.Map` will be returned. + + +.Query +[source, cypher, indent=0] +---- +RETURN {key: 'Value', listKey: [{inner: 'Map1'}, {inner: 'Map2'}]} AS map +---- + +.Result +[role="queryresult",options="header,footer",cols="1* Date: Wed, 21 May 2025 11:59:39 +0200 Subject: [PATCH 29/32] fixing rebase --- .../images/graph_expression_subqueries.svg | 121 ------------------ .../pages/clauses/transaction-clauses.adoc | 6 +- 2 files changed, 5 insertions(+), 122 deletions(-) delete mode 100644 modules/ROOT/images/graph_expression_subqueries.svg diff --git a/modules/ROOT/images/graph_expression_subqueries.svg b/modules/ROOT/images/graph_expression_subqueries.svg deleted file mode 100644 index 0b116c781..000000000 --- a/modules/ROOT/images/graph_expression_subqueries.svg +++ /dev/null @@ -1,121 +0,0 @@ - - - - - - -H - - - -Andy - -Swedish, Person - -age = 36 - name = 'Andy' - - - -AndyDog - -Dog - -name = 'Andy' - - - -Andy->AndyDog - - -HAS_DOG -  since = 2016 - - - -Timothy - -Person - -age = 25 - name = 'Timothy' - nickname = 'Tim' - - - -Mittens - -Cat - -name = 'Mittens' - - - -Timothy->Mittens - - -HAS_CAT -  since = 2019 - - - -Peter - -Person - -age = 25 - name = 'Peter' - nickname = 'Pete' - - - -Ozzy - -Dog - -name = 'Ozzy' - - - -Peter->Ozzy - - -HAS_DOG -  since = 2018 - - - -Fido - -Dog - -name = 'Fido' - - - -Peter->Fido - - -HAS_DOG -  since = 2010 - - - -Banana - -Toy - -name = 'Banana' - - - -Fido->Banana - - -  HAS_TOY - - - diff --git a/modules/ROOT/pages/clauses/transaction-clauses.adoc b/modules/ROOT/pages/clauses/transaction-clauses.adoc index cb8409a2d..5bddba41e 100644 --- a/modules/ROOT/pages/clauses/transaction-clauses.adoc +++ b/modules/ROOT/pages/clauses/transaction-clauses.adoc @@ -127,6 +127,7 @@ m| activeLockCount a| Count of active locks held by the transaction. m| INTEGER + m| currentQueryActiveLockCount a| Count of active locks held by the query currently executing in this transaction. m| INTEGER @@ -163,6 +164,7 @@ m| currentQueryIdleTime a| Idle time for the query currently executing in this transaction, or `null` if unavailable or no query is currently executing. m| DURATION + m| currentQueryAllocatedBytes a| The number of bytes allocated on the heap so far by the query currently executing in this transaction, or `null` if unavailable or no query is currently executing. m| INTEGER @@ -183,10 +185,12 @@ m| pageFaults a| The total number of page cache faults that the transaction performed. m| INTEGER + m| currentQueryPageHits a| The total number of page cache hits that the query currently executing in this transaction performed. m| INTEGER + m| currentQueryPageFaults a| The total number of page cache faults that the query currently executing in this transaction performed. m| INTEGER @@ -607,4 +611,4 @@ RETURN txId, newUser AS user, database, currentQuery, status 5+d|Rows: 2 |=== -====== +====== \ No newline at end of file From 9ec5c4674ffbf22a1fbfa2ca5e6ce7b89ad6d0ff Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Wed, 21 May 2025 12:04:47 +0200 Subject: [PATCH 30/32] page order-by --- modules/ROOT/images/graph_order_by_clause.svg | 1 + modules/ROOT/pages/clauses/order-by.adoc | 500 +++++++++++++----- 2 files changed, 362 insertions(+), 139 deletions(-) create mode 100644 modules/ROOT/images/graph_order_by_clause.svg diff --git a/modules/ROOT/images/graph_order_by_clause.svg b/modules/ROOT/images/graph_order_by_clause.svg new file mode 100644 index 000000000..a571834d7 --- /dev/null +++ b/modules/ROOT/images/graph_order_by_clause.svg @@ -0,0 +1 @@ +CONTAINSOrderid:STRINGordeDate:DATEtotal:INTEGERstatus:STRINGItemname:STRINGprice:INTEGER \ No newline at end of file diff --git a/modules/ROOT/pages/clauses/order-by.adoc b/modules/ROOT/pages/clauses/order-by.adoc index 5fb7c07d7..f18ad4db2 100644 --- a/modules/ROOT/pages/clauses/order-by.adoc +++ b/modules/ROOT/pages/clauses/order-by.adoc @@ -1,118 +1,154 @@ -:description: `ORDER BY` is a sub-clause following `RETURN` or `WITH`, and it specifies that the output should be sorted and how. - -[[query-order]] = ORDER BY +:description: Information about Cypher's `ORDER BY` subclause. +:table-caption!: -`ORDER BY` specifies how the output of a clause should be sorted. -It be used as a sub-clause following `RETURN` or `WITH`. +`ORDER BY` is a subclause that determines how the results of a xref:clauses/return.adoc[`RETURN`] or xref:clauses/with.adoc[`WITH`] clause are ordered. +It can also be used as a standalone clause, either on its own or in combination with `SKIP`/`OFFSET` or `LIMIT`. -`ORDER BY` relies on comparisons to sort the output, see xref:values-and-types/ordering-equality-comparison.adoc[Ordering and comparison of values]. -You can sort on many different values, e.g. node/relationship properties, the node/relationship ids, or on most expressions. +`ORDER BY` defaults to sorting results in an ascending order, though it can be modified to sort results in a xref:clauses/order-by.adoc#ascending-descending-order[descending order]. -[NOTE] -==== +`ORDER BY` relies on comparisons to sort the output (see xref:values-and-types/ordering-equality-comparison.adoc[] for more details). +You can sort on different values, such as node or relationship properties, IDs, or the result of expressions. + +[IMPORTANT] Unless `ORDER BY` is used, Neo4j does not guarantee the row order of a query result. -==== + [[example-graph]] == Example graph -The following graph is used for the examples below: +A graph with the following schema is used for the examples below: -image::graph-order-by-clause.svg[Example graph connecting Person nodes,width=600,role=popup] +image::graph_order_by_clause.svg[width="400", role="middle"] To recreate it, run the following query against an empty Neo4j database: [source, cypher, role=test-setup] ---- -CREATE - (andy: Person {name: 'Andy', age: 34, length: 170}), - (bernard: Person {name: 'Bernard', age: 36}), - (charlotte: Person {name: 'Charlotte', age: 32, length: 185}), - (andy)-[:KNOWS]->(bernard), - (bernard)-[:KNOWS]->(charlotte) +CREATE (o1:Order {id: 'ORD-001', orderDate: datetime('2024-05-01T10:00:00'), total: 550, status: 'shipped'}), + (o2:Order {id: 'ORD-002', orderDate: datetime('2024-05-02T14:30:00'), total: 1000, status: 'pending'}), + (o3:Order {id: 'ORD-003', orderDate: datetime('2024-05-03T09:15:00'), total: 550, status: 'pending'}), + (o4:Order {id: 'ORD-004', orderDate: datetime('2024-05-04T12:45:00'), total: 200}), + (o5:Order {id: 'ORD-005', orderDate: datetime('2024-05-05T15:00:00'), total: 800, status: 'shipped'}), + + (i1:Item {name: 'Phone', price: 500}), + (i2:Item {name: 'Laptop', price: 1000}), + (i3:Item {name: 'Headphones', price: 250}), + (i4:Item {name: 'Charger', price: 50}), + (i5:Item {name: 'Keyboard', price: 200}), + + (o1)-[:CONTAINS]->(i1), + (o1)-[:CONTAINS]->(i4), + (o2)-[:CONTAINS]->(i2), + (o3)-[:CONTAINS]->(i1), + (o3)-[:CONTAINS]->(i4), + (o4)-[:CONTAINS]->(i5), + (o5)-[:CONTAINS]->(i1), + (o5)-[:CONTAINS]->(i3), + (o5)-[:CONTAINS]->(i4) ---- -[[order-nodes-by-property]] -== Order nodes by property -`ORDER BY` is used to sort the output. +[[basic-examples]] +== Basic examples -.Query +.Order by property values +===== + +`ORDER BY` can be used to sort the result by property values. + +.Order by node property // tag::clauses_order_by[] [source, cypher] ---- -MATCH (n) -RETURN n.name, n.age -ORDER BY n.name +MATCH (o:Order) +RETURN o.id AS order, + o.total AS total + ORDER BY total ---- // end::clauses_order_by[] -The nodes are returned, sorted by their name. +The nodes are returned, sorted by the value of the `total` properties in an ascending order. .Result [role="queryresult",options="header,footer",cols="2*(:Item) } AS itemCount + ORDER BY itemCount +---- .Result -[role="queryresult",options="header,footer",cols="3* -| "Andy" | 34 | 170 -| "Charlotte" | 32 | 185 -3+d|Rows: 3 +| order | itemCount + +| "ORD-002" | 1 +| "ORD-004" | 1 +| "ORD-001" | 2 +| "ORD-003" | 2 +| "ORD-005" | 3 + +2+d|Rows: 5 |=== +===== -[[order-nodes-in-descending-order]] -== Order nodes in descending order +[[order-by-values-not-in-result]] +== Order by values not in the result -By adding `DESC[ENDING]` after the variable to sort on, the sort will be done in reverse order. +`ORDER BY` can sort by values that are not included in the result set. +That is, the sort key does not need to be part of the preceding `RETURN` or `WITH` clause. +For example, the query below sorts orders based on how many items they contain, even though that count is not returned. -.Query +.Order by values not in the returned results [source, cypher] ---- -MATCH (n) -RETURN n.name, n.age -ORDER BY n.name DESC +MATCH (o:Order) +RETURN o.id AS order + ORDER BY COUNT { (o)-[:CONTAINS]->(:Item) } ---- -The example returns the nodes, sorted by their name in reverse order. +.Result +[role="queryresult",options="header,footer",cols="1*(i:Item) +RETURN o.id AS order, + o.total, + collect(i.name) AS items +---- .Result [role="queryresult",options="header,footer",cols="3* | "Bernard" | 36 -3+d|Rows: 3 +| order | total | items + +| "ORD-005" | 800 | ["Phone", "Headphones", "Charger"] + +3+d|Rows: 1 +|=== + +[[null]] +== Null values + +When sorting, `null` values appear last in ascending order and first in descending order. + +.Sort on null property +[source, cypher] +---- +MATCH (o:Order) +RETURN o.id AS order, + o.status AS status + ORDER BY status DESC +---- + +.Result +[role="queryresult",options="header,footer",cols="2*(i:Item) +WITH o, i + ORDER BY i.price DESC +RETURN o.id AS order, + collect(i.name || " ($" || toString(i.price) || ")") AS orderedListOfItems ---- -The list of names built from the `collect` aggregating function contains the names in order of the `age` property. - .Result -[role="queryresult",options="header,footer",cols="1*(i:Item) +WITH o.id AS order, + i.name AS item + ORDER BY o.orderDate +RETURN order, item +---- + +* If the `RETURN` or `WITH` performs an aggregation or uses `DISTINCT` only the projected variables from either operation are available to `ORDER BY`. +This is because these operations alter the number of rows produced by the clause and any variables not explicitly projected are discarded. -It is also not allowed to use aggregating expressions in the `ORDER BY` sub-clause if they are not also listed in the projecting clause. -This rule is to make sure that `ORDER BY` does not change the results, only the order of them. +.`ORDER BY` following a `WITH` clause projecting an aggregated value +[source, cypher, role=test-fail] +---- +MATCH (o:Order)-[:CONTAINS]->(i:Item) +WITH collect(o.id) AS orders, + i.name AS items + ORDER BY o.orderDate +RETURN orders, items +---- +.Error message +[source, error] +---- +In a WITH/RETURN with DISTINCT or an aggregation, it is not possible to access variables declared before the WITH/RETURN: o +---- + +[[indexes]] == ORDER BY and indexes The performance of Cypher queries using `ORDER BY` on node properties can be influenced by the existence and use of an index for finding the nodes. @@ -247,43 +467,45 @@ Read more about this capability in xref::indexes/search-performance-indexes/usin `ORDER BY` can be used as a standalone clause, or in conjunction with `SKIP`/`OFFSET` or `LIMIT`. - .Standalone use of `ORDER BY` // tag::clauses_order_by_standalone[] [source, cypher] ---- -MATCH (n) -ORDER BY n.name -RETURN collect(n.name) AS names +MATCH (i:Item) +ORDER BY i.price +RETURN collect(i.name || " ($" || toString(i.price) || ")") AS orderedPriceList ---- // end::clauses_order_by_standalone[] .Result [role="queryresult",options="header,footer",cols="1* Date: Wed, 4 Jun 2025 13:30:22 +0200 Subject: [PATCH 31/32] fixes after review --- modules/ROOT/images/graph-union-clause.svg | 34 +++--- .../ROOT/images/path-pattern-expressions.svg | 15 +++ .../ROOT/images/path_pattern_expressions.svg | 1 - modules/ROOT/images/patterns-equijoins.svg | 113 ++++++++++++++++-- .../patterns-group-variables-graph2.svg | 108 ++++++++--------- .../patterns-group-variables-graph3.svg | 56 +++++---- .../images/patterns-qpp-query-breakdown.svg | 6 +- .../images/patterns-second-shortest-paths.svg | 47 ++++---- .../predicates/path-pattern-expressions.adoc | 2 +- .../patterns/variable-length-patterns.adoc | 2 +- 10 files changed, 241 insertions(+), 143 deletions(-) create mode 100644 modules/ROOT/images/path-pattern-expressions.svg delete mode 100644 modules/ROOT/images/path_pattern_expressions.svg diff --git a/modules/ROOT/images/graph-union-clause.svg b/modules/ROOT/images/graph-union-clause.svg index 3e20d96f9..910d8a2f0 100644 --- a/modules/ROOT/images/graph-union-clause.svg +++ b/modules/ROOT/images/graph-union-clause.svg @@ -1,18 +1,18 @@ - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/path-pattern-expressions.svg b/modules/ROOT/images/path-pattern-expressions.svg new file mode 100644 index 000000000..b5130c9ec --- /dev/null +++ b/modules/ROOT/images/path-pattern-expressions.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/path_pattern_expressions.svg b/modules/ROOT/images/path_pattern_expressions.svg deleted file mode 100644 index e236e0637..000000000 --- a/modules/ROOT/images/path_pattern_expressions.svg +++ /dev/null @@ -1 +0,0 @@ -WORKS_FORsince:2023WORKS_FORsince:2015Personname:'Alice'age:65role:'Project manager'Personname:'Cecil'age:25role:'Software developer'Personname:'Cecilia'age:31role:'Software developer' \ No newline at end of file diff --git a/modules/ROOT/images/patterns-equijoins.svg b/modules/ROOT/images/patterns-equijoins.svg index 5dd50e280..29335a413 100644 --- a/modules/ROOT/images/patterns-equijoins.svg +++ b/modules/ROOT/images/patterns-equijoins.svg @@ -1,31 +1,56 @@ - + - + + + + - + + + + + + + + + + + + + + + + + + + + + + - + + - - - + + + - + - + - - - - + + + + @@ -37,4 +62,66 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-group-variables-graph2.svg b/modules/ROOT/images/patterns-group-variables-graph2.svg index e56e93379..fe1d3b9e0 100644 --- a/modules/ROOT/images/patterns-group-variables-graph2.svg +++ b/modules/ROOT/images/patterns-group-variables-graph2.svg @@ -1,73 +1,73 @@ - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - + + - + - - + + diff --git a/modules/ROOT/images/patterns-group-variables-graph3.svg b/modules/ROOT/images/patterns-group-variables-graph3.svg index 6af584064..2c126005b 100644 --- a/modules/ROOT/images/patterns-group-variables-graph3.svg +++ b/modules/ROOT/images/patterns-group-variables-graph3.svg @@ -1,48 +1,46 @@ - - - - - - - - - - - + + + + + + + + + - - - - + + + + - - - - - - - - + + + + + + + + - + - - + + - + - - + + diff --git a/modules/ROOT/images/patterns-qpp-query-breakdown.svg b/modules/ROOT/images/patterns-qpp-query-breakdown.svg index c8c699857..b88d2baaf 100644 --- a/modules/ROOT/images/patterns-qpp-query-breakdown.svg +++ b/modules/ROOT/images/patterns-qpp-query-breakdown.svg @@ -1,11 +1,11 @@ - + - + - + diff --git a/modules/ROOT/images/patterns-second-shortest-paths.svg b/modules/ROOT/images/patterns-second-shortest-paths.svg index fb321cb13..e25663b48 100644 --- a/modules/ROOT/images/patterns-second-shortest-paths.svg +++ b/modules/ROOT/images/patterns-second-shortest-paths.svg @@ -1,25 +1,24 @@ - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ROOT/pages/expressions/predicates/path-pattern-expressions.adoc b/modules/ROOT/pages/expressions/predicates/path-pattern-expressions.adoc index e3ae5b486..baf6f7115 100644 --- a/modules/ROOT/pages/expressions/predicates/path-pattern-expressions.adoc +++ b/modules/ROOT/pages/expressions/predicates/path-pattern-expressions.adoc @@ -28,7 +28,7 @@ The following sections will demonstrate how to use path pattern expressions in a The following graph is used for the examples below: -image::path_pattern_expressions.svg[width="500",role="middle"] +image::path-pattern-expressions.svg[Example graph connecting people who work together,width=400,role=popup] To recreate the graph, run the following query in an empty Neo4j database: diff --git a/modules/ROOT/pages/patterns/variable-length-patterns.adoc b/modules/ROOT/pages/patterns/variable-length-patterns.adoc index 498976cc6..cda213f8a 100644 --- a/modules/ROOT/pages/patterns/variable-length-patterns.adoc +++ b/modules/ROOT/pages/patterns/variable-length-patterns.adoc @@ -53,7 +53,7 @@ image::patterns-qpp-solutions.svg[Graph showing two patterns,width=600,role=popu The following motif represents a fixed-length path pattern that matches the service that departs from `Denmark Hill` station at `17:07`: -image::patterns-qpp-motif1.svg[Example of a fixed-length path pattern that matches the service that departs from Denmark Hill station,width=600,role=popup] +image::patterns-qpp-motif1.svg[Example of a fixed-length path pattern that matches the service that departs from Denmark Hill station,width=800,role=popup] To match the second train service, leaving `Denmark Hill` at `17:10`, a shorter path pattern is needed: From dff33c706b6140183df9f1071f8d3e27aa82015a Mon Sep 17 00:00:00 2001 From: lidiazuin Date: Thu, 5 Jun 2025 09:54:36 +0200 Subject: [PATCH 32/32] more fixes --- .../images/patterns-equijoin-reference.svg | 37 +++++-------------- .../images/patterns-qpp-query-breakdown.svg | 6 +-- .../images/patterns-second-shortest-paths.svg | 22 +++++------ 3 files changed, 24 insertions(+), 41 deletions(-) diff --git a/modules/ROOT/images/patterns-equijoin-reference.svg b/modules/ROOT/images/patterns-equijoin-reference.svg index e5f5997b0..50776245c 100644 --- a/modules/ROOT/images/patterns-equijoin-reference.svg +++ b/modules/ROOT/images/patterns-equijoin-reference.svg @@ -1,29 +1,12 @@ -<<<<<<< HEAD -<<<<<<< HEAD -======= ->>>>>>> 1962a7f (Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated) - - - - - - - - - - -<<<<<<< HEAD -======= - - - - - - - - ->>>>>>> a7b5b66 (Updated images) -======= ->>>>>>> 1962a7f (Second batch of images. Please refer to docs file for updated listed of images that are not being used but were updated) + + + + + + + + + + diff --git a/modules/ROOT/images/patterns-qpp-query-breakdown.svg b/modules/ROOT/images/patterns-qpp-query-breakdown.svg index b88d2baaf..80cf4d11e 100644 --- a/modules/ROOT/images/patterns-qpp-query-breakdown.svg +++ b/modules/ROOT/images/patterns-qpp-query-breakdown.svg @@ -1,11 +1,11 @@ - - + + - + diff --git a/modules/ROOT/images/patterns-second-shortest-paths.svg b/modules/ROOT/images/patterns-second-shortest-paths.svg index e25663b48..367ebf4e9 100644 --- a/modules/ROOT/images/patterns-second-shortest-paths.svg +++ b/modules/ROOT/images/patterns-second-shortest-paths.svg @@ -1,23 +1,23 @@ - - - - - - - + + + + + + + - + - - + + - +