From 4120c227ab58536e98446955f47145af97be98cb Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Tue, 3 Dec 2024 20:40:57 +0000 Subject: [PATCH 01/27] Document immutable roles --- modules/ROOT/content-nav.adoc | 3 +- .../privileges_grant_and_deny_syntax.svg | 2 +- .../database-administration.adoc | 2 +- .../immutable-roles-privileges.adoc | 146 ++++++++++++++++++ .../manage-privileges.adoc | 6 +- .../manage-roles.adoc | 36 +++-- .../privileges-immutable.adoc | 46 ------ modules/ROOT/pages/index.adoc | 5 +- modules/ROOT/pages/tutorial/index.adoc | 1 - .../tutorial-immutable-privileges.adoc | 61 -------- 10 files changed, 183 insertions(+), 125 deletions(-) create mode 100644 modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc delete mode 100644 modules/ROOT/pages/authentication-authorization/privileges-immutable.adoc delete mode 100644 modules/ROOT/pages/tutorial/tutorial-immutable-privileges.adoc diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc index bffd13898..74ed086d7 100644 --- a/modules/ROOT/content-nav.adoc +++ b/modules/ROOT/content-nav.adoc @@ -184,9 +184,9 @@ *** xref:authentication-authorization/dbms-administration.adoc[] *** xref:authentication-authorization/load-privileges.adoc[] *** xref:authentication-authorization/limitations.adoc[] -*** xref:authentication-authorization/privileges-immutable.adoc[] *** xref:authentication-authorization/manage-execute-permissions.adoc[] ** xref:authentication-authorization/built-in-roles.adoc[] +** xref:authentication-authorization/immutable-roles-privileges.adoc[] ** Integration with auth systems *** xref:authentication-authorization/auth-providers.adoc[] *** xref:authentication-authorization/ldap-integration.adoc[] @@ -246,7 +246,6 @@ ** xref:tutorial/tutorial-composite-database.adoc[] ** xref:tutorial/access-control.adoc[] ** xref:tutorial/tutorial-sso-configuration.adoc[] -** xref:tutorial/tutorial-immutable-privileges.adoc[] ** xref:tutorial/tutorial-clustering-docker.adoc[] // ** xref:clustering-advanced/index.adoc[] diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax.svg index c3677a303..4267b5462 100644 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax.svg +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index 0dee40aed..3a7e5430a 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -27,7 +27,7 @@ The components of the database privilege commands are: * _mutability_: ** `IMMUTABLE` - When used in conjunction with `GRANT` or `DENY`, specifies that a privilege cannot subsequently be removed unless auth is disabled. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. -See also xref:authentication-authorization/privileges-immutable.adoc[]. +See also xref:authentication-authorization/immutable-roles-privileges.adoc[]. * _database-privilege_ ** `ACCESS` - allows access to a specific database or remote database alias. diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc new file mode 100644 index 000000000..226297ac9 --- /dev/null +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -0,0 +1,146 @@ +[role=enterprise-edition not-on-aura] +[[immutable-roles-and-privileges]] += Immutable roles and privileges +:description: This section explains how to use Cypher to manage immutable roles and privileges. + +[NOTE] +==== +Immutable roles are available starting with Neo4j 5.26. +==== + +Immutable privileges and roles are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[roles] xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges]. + + +[CAUTION] +==== +Immutable privileges and roles should only be used in situations where changes are rare. +They are intentionally difficult to modify, so changes should be undertaken with caution (e.g., when the DBMS has been isolated by some other means and unauthorized access can be reliably prevented). +Typically, this type of modification should only be made once during the commissioning phase of a DBMS. +==== + +[[administer-immutable-roles-and-privileges]] +== Administer immutable roles and privileges + +After the DBMS is safely isolated from external connections, follow these steps to administer immutable roles and privileges: + +. Change the config setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] to `false`. +. Restart the DBMS. +. Create or remove immutable privileges and roles in the same way as regular privileges and roles but with the addition of the `IMMUTABLE` keyword. +See <>. +. Change the config setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] back to `true`. +. Restart the DBMS. + +Privileges and roles created in this way can now appear to all users as an immutable part of the DBMS. +If you want to change or remove them, you must repeat the process of setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] to `false`. + +[[immutable-roles-privileges-examples]] +== Examples + +The following examples demonstrate how to use Cypher to manage immutable roles and privileges. + +=== Restricting the actions of users who can manage privileges + +To prevent all users, including the `admin` user, from performing *database management*, follow these steps: + +. Ensure that you have completed steps 1 an 2 from <>. +. Run the following command to deny the `IMMUTABLE DATABASE MANAGEMENT` privilege to the `PUBLIC` role: ++ +[source, cypher, role=test-skip] +---- +DENY IMMUTABLE DATABASE MANAGEMENT ON DBMS TO PUBLIC +---- + +. Verify that the `IMMUTABLE` keyword has been added to the privilege: ++ +[source, cypher, role=noplay] +---- +SHOW PRIVILEGES WHERE IMMUTABLE +---- ++ +.Result +[options="header,footer", width="100%", cols="1m,2m,1m,1m,1m,1m,1m"] +|=== +|access +|action +|resource +|graph +|segment +|role +|immutable + +|"DENIED" +|"database_management" +|"database" +|"*" +|"database" +|"PUBLIC" +|true + +7+a|Rows: 2 +|=== ++ +The result shows that all users are restricted from adding or removing privileges, including the `admin` user. +. Ensure you have completed steps 4 and 5 from <>. + +=== Restricting the actions of users who can manage roles and privileges + +If you want permanent privileges but with more control over which users they apply to, you need to use immutable roles with immutable privileges. +For example, you have a user called `alice` who has `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges. +To prevent `alice` from dropping any databases and from being able to remove this restriction using their `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, follow these steps: + +. Ensure that you have completed steps 1 an 2 from <>. +. Create an immutable role to hold the immutable privileges: ++ +[source, cypher, role=noplay] +---- +CREATE IMMUTABLE ROLE restrictedAdmin +---- + +. Immutably deny the `DROP DATABASE` privilege: ++ +[source, cypher, role=noplay] +---- +DENY IMMUTABLE DROP DATABASE ON DBMS TO restrictedAdmin +---- + +. Grant the restrictedAdmin role to `alice` to prevent her dropping databases: ++ +[source, cypher, role=noplay] +---- +GRANT restrictedAdmin TO alice +---- ++ +. Ensure you have completed steps 4 and 5 from <>. ++ +Now, despite having `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, `alice` will not be able do any of the following: ++ +.Drop databases: +[source, cypher, role=noplay] +---- +DROP DATABASE foo +---- ++ +.Remove the restrictedAdmin role from `alice` +[source, cypher, role=noplay] +---- +REVOKE ROLE restrictedAdmin FROM alice +---- ++ +.Remove the `DROP DATABASE` privilege from the restrictedAdmin role +[source, cypher, role=noplay] +---- +DROP ROLE restrictedAdmin +---- ++ +.Remove `DENY DROP DATABASE` from the restrictedAdmin role +[source, cypher, role=noplay] +---- +REVOKE DENY DROP DATABASE ON DBMS FROM restrictedAdmin +---- + +[NOTE] +==== +Only immutable privileges (e.g. `DENY IMMUTABLE DROP DATABASE` in the example above) can be assigned to immutable roles. +This is to make sure that the role and all of its privileges is explicitly and completely immutable. +==== + diff --git a/modules/ROOT/pages/authentication-authorization/manage-privileges.adoc b/modules/ROOT/pages/authentication-authorization/manage-privileges.adoc index 6f667575b..9db8afb8a 100644 --- a/modules/ROOT/pages/authentication-authorization/manage-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/manage-privileges.adoc @@ -45,7 +45,11 @@ The components of the graph privilege commands are: ** `REVOKE` – removes granted or denied privileges from roles. * _mutability_: -** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. See also xref:authentication-authorization/privileges-immutable.adoc[]. +** `IMMUTABLE` can optionally be specified when performing a `GRANT` or `DENY` to indicate that the privilege cannot be subsequently removed unless auth is disabled. +Auth must also be disabled in order to `GRANT` or `DENY` an immutable privilege. +Contrastingly, when `IMMUTABLE` is specified in conjunction with a `REVOKE` command, it will act as a filter and only remove matching _immutable_ privileges. +Starting from Neo4j 5.26, immutable privileges can also be used together with immutable roles. +See xref:authentication-authorization/immutable-roles-privileges.adoc[] for more information. * _graph-privilege_: ** Can be either a xref:authentication-authorization/privileges-reads.adoc[read privilege] or xref:authentication-authorization/privileges-writes.adoc[write privilege]. diff --git a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc index 26d1aeb5a..7707bfaba 100644 --- a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc +++ b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc @@ -62,7 +62,7 @@ GRANT SHOW ROLE ---- -(see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]). +See xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[DBMS ROLE MANAGEMENT privileges]. |=== @@ -140,7 +140,7 @@ a| GRANT SHOW PRIVILEGE ---- -(see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]) +See xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[DBMS PRIVILEGE MANAGEMENT privileges]. |=== @@ -150,7 +150,7 @@ GRANT SHOW PRIVILEGE | Command -m| CREATE ROLE +m| CREATE [IMMUTABLE] ROLE | Syntax a| @@ -339,7 +339,9 @@ For more information, see xref:authentication-authorization/dbms-administration. == Listing roles -You can view all available roles using the Cypher command `SHOW ROLES`, which returns a single column. +You can view all available roles using the Cypher command `SHOW ROLES`, which returns a single column by default. +Starting from 5.26, you can optionally use `SHOW ROLES YIELD *` to see if the role is immutable. +See <> for more information. .`SHOW ROLES` output [options="header", width="100%", cols="2a,4,2m"] @@ -351,6 +353,10 @@ You can view all available roles using the Cypher command `SHOW ROLES`, which re | role | Role name | STRING + +| immutable +| `true` if the role is immutable, otherwise `false`. +| BOOLEAN |=== .List all roles @@ -481,18 +487,18 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results. [[access-control-create-roles]] == Creating roles -Roles can be created using `CREATE ROLE`: +Roles can be created using `CREATE [IMMUTABLE] ROLE`: [source, syntax] ---- -CREATE ROLE name [IF NOT EXISTS] [AS COPY OF otherName] +CREATE [IMMUTABLE] ROLE name [IF NOT EXISTS] [AS COPY OF otherName] ---- -Roles can be created or replaced by using `CREATE OR REPLACE ROLE`: +Roles can be created or replaced by using `CREATE OR REPLACE [IMMUTABLE] ROLE`: [source, syntax] ---- -CREATE OR REPLACE ROLE name [AS COPY OF otherName] +CREATE OR REPLACE [IMMUTABLE] ROLE name [AS COPY OF otherName] ---- [NOTE] @@ -504,7 +510,7 @@ The following naming rules apply: * Role names are case sensitive. ==== -A role can be copied, keeping its privileges, using `CREATE ROLE name AS COPY OF otherName`. +A role can be copied, keeping its privileges, using `CREATE [IMMUTABLE] ROLE name AS COPY OF otherName`. .Copy a role ====== @@ -573,9 +579,19 @@ This is equivalent to running `DROP ROLE myrole IF EXISTS` followed by `CREATE R [NOTE] ==== -* The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. +The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXISTS`. ==== +[role=new-in-5.26] +[[access-control-immutable-roles]] +== Immutable roles + +Immutable roles are those that cannot be modified in the usual way. +This means they cannot be created, renamed, dropped, or have privileges granted to or revoked from them. +See xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges] for details. + +They are useful in cases where you need a permanent built-in system role that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. + [[access-control-rename-roles]] == Renaming roles diff --git a/modules/ROOT/pages/authentication-authorization/privileges-immutable.adoc b/modules/ROOT/pages/authentication-authorization/privileges-immutable.adoc deleted file mode 100644 index 556f76bbb..000000000 --- a/modules/ROOT/pages/authentication-authorization/privileges-immutable.adoc +++ /dev/null @@ -1,46 +0,0 @@ -[role=enterprise-edition not-on-aura] -[[access-control-privileges-immutable]] -= Immutable privileges -:description: This section explains how to use Cypher to manage immutable privileges. - -Unlike regular privileges, having xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privilege management] privileges is not sufficient to enable immutable privileges to be added or removed. They can only be administered when auth is disabled -- that is, when the configuration setting <> is set to `false`. - -[[access-control-privileges-immutable-usecase]] -== When to use immutable privileges - -Immutable privileges are useful for restricting the actions of users who can xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[administer privileges]. - -For example, you may want to prevent all users from performing Database Management, even the `admin` user (who are themselves able to add or remove privileges). -To do so, you could run: - -[source, cypher] ----- -DENY DATABASE MANAGEMENT ON DBMS TO PUBLIC ----- - -However, this would not be adequate. -In case the `admin` user subsequently runs this: - -[source, cypher] ----- -REVOKE DENY DATABASE MANAGEMENT ON DBMS FROM PUBLIC ----- - -They would effectively regain Database Management privileges. -Instead, run the following query to prevent this scenario: - -[source, cypher, role=test-skip] ----- -DENY IMMUTABLE DATABASE MANAGEMENT ON DBMS TO PUBLIC ----- - - -[[access-control-privileges-immutable-admin]] -== How to administer immutable privileges - -Immutable privileges can only be administered when auth is disabled -- that is when the configuration setting <> is set to `false`, for example. -Under these conditions, immutable privileges can be added and removed in a similar manner to regular privileges, using the `IMMUTABLE` keyword. - -See the xref:tutorial/tutorial-immutable-privileges.adoc[Immutable privileges tutorial] for examples of how to administer immutable privileges. - -See xref:authentication-authorization/manage-privileges.adoc[Managing Privileges] for more detail on syntax. diff --git a/modules/ROOT/pages/index.adoc b/modules/ROOT/pages/index.adoc index b3a0186ef..3cc5ab684 100644 --- a/modules/ROOT/pages/index.adoc +++ b/modules/ROOT/pages/index.adoc @@ -80,9 +80,10 @@ You can find more information in the xref:tools/cypher-shell.adoc[Cypher Shell s * Immutable privileges. + -Immutable privileges are useful for restricting the actions of users who themselves are able to administer privileges. + +Immutable privileges are useful for restricting the actions of users who themselves are able to administer privileges. +Starting with Neo4j 5.26, immutable roles are also vailable. + Cloud operators can use sidecar design pattern to control RBAC-based permissions. + -You can find xref:tutorial/tutorial-immutable-privileges.adoc[a tutorial] on how to administer immutable privileges. +For more information, see xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges]. * Changes to Neo4j indexes ** The B-tree index type has been removed. diff --git a/modules/ROOT/pages/tutorial/index.adoc b/modules/ROOT/pages/tutorial/index.adoc index 2dd79272a..c47fca284 100644 --- a/modules/ROOT/pages/tutorial/index.adoc +++ b/modules/ROOT/pages/tutorial/index.adoc @@ -11,5 +11,4 @@ The following step-by-step tutorials cover common operational tasks or otherwise * xref:tutorial/tutorial-composite-database.adoc[Set up and use a Composite database] -- This tutorial walks through the basics of setting up and using Composite databases. * xref:tutorial/access-control.adoc[Fine-grained access control (example)] -- This tutorial presents an example that illustrates various aspects of security and fine-grained access control. * xref:tutorial/tutorial-sso-configuration.adoc[Configuring Neo4j Single Sign-On (SSO)] -- This tutorial presents examples and solutions to common problems when configuring SSO. -* xref:tutorial/tutorial-immutable-privileges.adoc[Administering immutable privileges] -- This tutorial describes methods for administering immutable privileges. * xref:tutorial/tutorial-clustering-docker.adoc[Deploy a Neo4j cluster in a Docker container] -- This tutorial walks through setting up a Neo4j cluster on your local computer for testing purposes. diff --git a/modules/ROOT/pages/tutorial/tutorial-immutable-privileges.adoc b/modules/ROOT/pages/tutorial/tutorial-immutable-privileges.adoc deleted file mode 100644 index 99d82bffe..000000000 --- a/modules/ROOT/pages/tutorial/tutorial-immutable-privileges.adoc +++ /dev/null @@ -1,61 +0,0 @@ -[role=enterprise-edition] -[[tutorial-immutable-privileges]] -= Administering immutable privileges -:description: This tutorial describes methods for administering immutable privileges. - -This tutorial describes how to administer immutable privileges, which are useful assets for restricting the actions of users who themselves are able to administer privileges. -They offer a way to prevent such users from simply removing any restrictions by using their xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privilege management] privileges. - -In other words, having xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privilege management] privileges is not sufficient to add or remove immutable privileges. -The only way immutable privileges can be added or removed is when auth is disabled. - -[CAUTION] -==== -This should only be performed when you have other means of preventing access to the Neo4j DBMS. -==== - -When auth is disabled, immutable privileges can be added and removed in the same way as regular privileges. -To do so, follow these steps: - -. Change the config setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] to `false`. -. Restart the Neo4j DBMS. -. Create or remove immutable privileges in the same way as regular privileges using the keyword `IMMUTABLE`. -For example: -[source, cypher, role=noplay] ----- -DENY IMMUTABLE DATABASE MANAGEMENT ON DBMS TO PUBLIC ----- -[start=4] -. Change the config setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] to `true`. -. Restart the Neo4j DBMS. -. Observe that the following immutable privileges are now in place: - -[source, cypher, role=noplay] ----- -SHOW PRIVILEGES WHERE IMMUTABLE ----- - -.Result -[options="header,footer", width="100%", cols="m,m,m,m,m,m,m"] -|=== -|access -|action -|resource -|graph -|segment -|role -|immutable - -|"DENIED" -|"database_management" -|"database" -|"*" -|"database" -|"PUBLIC" -|true - -7+a|Rows: 1 -|=== - -Privileges like this one can now be considered to be an immutable part of the DBMS. -The only way to subsequently remove it would be to repeat this process. From a7a4c141cc891cd24d2162a3f72e42aedeac8a1d Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:49:51 +0000 Subject: [PATCH 02/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 226297ac9..c176fa848 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -8,7 +8,8 @@ Immutable roles are available starting with Neo4j 5.26. ==== -Immutable privileges and roles are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[roles] xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges]. +Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges]. +Immutable roles are useful for providing _system roles_, which appear as permanent parts of the DBMS. [CAUTION] From 21d25ea484354fc97ef18f15af2e2c33e8a78c15 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:50:15 +0000 Subject: [PATCH 03/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index c176fa848..592af080e 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -31,7 +31,7 @@ See <>. . Change the config setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] back to `true`. . Restart the DBMS. -Privileges and roles created in this way can now appear to all users as an immutable part of the DBMS. +Privileges and roles created in this way now appear as an immutable part of the DBMS. If you want to change or remove them, you must repeat the process of setting xref:configuration/configuration-settings.adoc#config_dbms.security.auth_enabled[`dbms.security.auth_enabled`] to `false`. [[immutable-roles-privileges-examples]] From 918b89b5cec055f98b55521f890e9a0bf387ab2d Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:53:32 +0000 Subject: [PATCH 04/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 592af080e..e3fd2ac3f 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -41,7 +41,8 @@ The following examples demonstrate how to use Cypher to manage immutable roles a === Restricting the actions of users who can manage privileges -To prevent all users, including the `admin` user, from performing *database management*, follow these steps: +To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role. +The `PUBLIC` role implicitly and irrevocably applies to all users. . Ensure that you have completed steps 1 an 2 from <>. . Run the following command to deny the `IMMUTABLE DATABASE MANAGEMENT` privilege to the `PUBLIC` role: From 1a03007c9f3e57180eb6dd23a6e26b2849091b63 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:53:40 +0000 Subject: [PATCH 05/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index e3fd2ac3f..c7b582c73 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -44,7 +44,7 @@ The following examples demonstrate how to use Cypher to manage immutable roles a To prevent all users (including those with `PRIVILEGE MANAGEMENT` privileges) from performing *database management*, attach an immutable privilege to the `PUBLIC` role. The `PUBLIC` role implicitly and irrevocably applies to all users. -. Ensure that you have completed steps 1 an 2 from <>. +. Ensure that you have completed steps 1 and 2 from <>. . Run the following command to deny the `IMMUTABLE DATABASE MANAGEMENT` privilege to the `PUBLIC` role: + [source, cypher, role=test-skip] From cfb1ce3c9a766782895309c133c6c42bcbce5a86 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:55:13 +0000 Subject: [PATCH 06/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index c7b582c73..4ed46249f 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -84,11 +84,12 @@ SHOW PRIVILEGES WHERE IMMUTABLE The result shows that all users are restricted from adding or removing privileges, including the `admin` user. . Ensure you have completed steps 4 and 5 from <>. -=== Restricting the actions of users who can manage roles and privileges +=== Creating permanent roles which cannot be changed + +You can use immutable roles to create permanent built-in system roles that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. + +For example, you want to create an `analyst` role that cannot be dropped, renamed, or have any of its privileges changed (even by users with the `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges). -If you want permanent privileges but with more control over which users they apply to, you need to use immutable roles with immutable privileges. -For example, you have a user called `alice` who has `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges. -To prevent `alice` from dropping any databases and from being able to remove this restriction using their `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, follow these steps: . Ensure that you have completed steps 1 an 2 from <>. . Create an immutable role to hold the immutable privileges: From cb59fabfce377c7b43a7d96f10167013510d31a0 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:55:22 +0000 Subject: [PATCH 07/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 4ed46249f..54a599a51 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -91,7 +91,7 @@ You can use immutable roles to create permanent built-in system roles that canno For example, you want to create an `analyst` role that cannot be dropped, renamed, or have any of its privileges changed (even by users with the `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges). -. Ensure that you have completed steps 1 an 2 from <>. +. Ensure that you have completed steps 1 and 2 from <>. . Create an immutable role to hold the immutable privileges: + [source, cypher, role=noplay] From 0e52d6cc2c2836897a848f1088dd16bac8c4f568 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:55:30 +0000 Subject: [PATCH 08/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 54a599a51..92000bcaf 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -96,7 +96,7 @@ For example, you want to create an `analyst` role that cannot be dropped, rename + [source, cypher, role=noplay] ---- -CREATE IMMUTABLE ROLE restrictedAdmin +CREATE IMMUTABLE ROLE analyst ---- . Immutably deny the `DROP DATABASE` privilege: From 0c0ae41370053b2405b16ef92eb0c6e1f5fc6d99 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:55:42 +0000 Subject: [PATCH 09/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 92000bcaf..e4688d906 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -99,7 +99,7 @@ For example, you want to create an `analyst` role that cannot be dropped, rename CREATE IMMUTABLE ROLE analyst ---- -. Immutably deny the `DROP DATABASE` privilege: +. Immutably grant the `MATCH` privilege: + [source, cypher, role=noplay] ---- From e0b22813b69fbac97a25d3e168893a2f153d3d08 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:55:51 +0000 Subject: [PATCH 10/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index e4688d906..6291529d5 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -103,7 +103,7 @@ CREATE IMMUTABLE ROLE analyst + [source, cypher, role=noplay] ---- -DENY IMMUTABLE DROP DATABASE ON DBMS TO restrictedAdmin +GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst ---- . Grant the restrictedAdmin role to `alice` to prevent her dropping databases: From 0319e6636c69ed81c8588836a7c6a523f4a1ee14 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:56:02 +0000 Subject: [PATCH 11/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 7 ------- 1 file changed, 7 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 6291529d5..63e1f88bb 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -106,13 +106,6 @@ CREATE IMMUTABLE ROLE analyst GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst ---- -. Grant the restrictedAdmin role to `alice` to prevent her dropping databases: -+ -[source, cypher, role=noplay] ----- -GRANT restrictedAdmin TO alice ----- -+ . Ensure you have completed steps 4 and 5 from <>. + Now, despite having `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, `alice` will not be able do any of the following: From 937ef8279d2e33ca1ca6c71c2098462920343bf8 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:56:19 +0000 Subject: [PATCH 12/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 63e1f88bb..45e1e8916 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -108,7 +108,7 @@ GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst . Ensure you have completed steps 4 and 5 from <>. + -Now, despite having `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, `alice` will not be able do any of the following: +Now, even users with `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges will not be able do any of the following: + .Drop databases: [source, cypher, role=noplay] From 65b17306c4ba69e7d5f2e14d233d8769db247b41 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:56:30 +0000 Subject: [PATCH 13/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 45e1e8916..72559ea18 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -109,20 +109,6 @@ GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst . Ensure you have completed steps 4 and 5 from <>. + Now, even users with `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges will not be able do any of the following: -+ -.Drop databases: -[source, cypher, role=noplay] ----- -DROP DATABASE foo ----- -+ -.Remove the restrictedAdmin role from `alice` -[source, cypher, role=noplay] ----- -REVOKE ROLE restrictedAdmin FROM alice ----- -+ -.Remove the `DROP DATABASE` privilege from the restrictedAdmin role [source, cypher, role=noplay] ---- DROP ROLE restrictedAdmin From fa5a9fbdaf904532f7b3f54e728e8ae16e2fa00e Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:57:39 +0000 Subject: [PATCH 14/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc --- .../immutable-roles-privileges.adoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 72559ea18..fab5e7d79 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -109,6 +109,8 @@ GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst . Ensure you have completed steps 4 and 5 from <>. + Now, even users with `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges will not be able do any of the following: ++ +.Drop the `analyst` role [source, cypher, role=noplay] ---- DROP ROLE restrictedAdmin From a388fb0fd05a79605b7e16de9d82791ce6c50b9b Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:57:49 +0000 Subject: [PATCH 15/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index fab5e7d79..9d37fc2a1 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -113,7 +113,7 @@ Now, even users with `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges wil .Drop the `analyst` role [source, cypher, role=noplay] ---- -DROP ROLE restrictedAdmin +DROP ROLE analyst ---- + .Remove `DENY DROP DATABASE` from the restrictedAdmin role From 387d33bcd0f382f57f45f79ffa4f6e3ec5b3a55a Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:58:26 +0000 Subject: [PATCH 16/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 9d37fc2a1..d18cfe9b4 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -116,10 +116,10 @@ Now, even users with `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges wil DROP ROLE analyst ---- + -.Remove `DENY DROP DATABASE` from the restrictedAdmin role +.Revoke the `MATCH` privilege from the `analyst` role [source, cypher, role=noplay] ---- -REVOKE DENY DROP DATABASE ON DBMS FROM restrictedAdmin +REVOKE MATCH {*} ON GRAPH * ELEMENTS * FROM analyst ---- [NOTE] From ed5bf16fb72b25587992c507e5c6a1e4c4b55a4a Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:58:40 +0000 Subject: [PATCH 17/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index d18cfe9b4..b1b1e5d81 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -124,7 +124,7 @@ REVOKE MATCH {*} ON GRAPH * ELEMENTS * FROM analyst [NOTE] ==== -Only immutable privileges (e.g. `DENY IMMUTABLE DROP DATABASE` in the example above) can be assigned to immutable roles. +Only immutable privileges (e.g. `GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst` in the example above) can be assigned to immutable roles. This is to make sure that the role and all of its privileges is explicitly and completely immutable. ==== From a5c9f9ab1a7934b3904bf42af8d8b9d6a966a553 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:58:55 +0000 Subject: [PATCH 18/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index b1b1e5d81..6905a936e 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -125,6 +125,6 @@ REVOKE MATCH {*} ON GRAPH * ELEMENTS * FROM analyst [NOTE] ==== Only immutable privileges (e.g. `GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst` in the example above) can be assigned to immutable roles. -This is to make sure that the role and all of its privileges is explicitly and completely immutable. +This is to make sure that an immutable role and all of its privileges is explicitly and completely immutable. ==== From e376e6b77694afb26ec3d866c73931c359426949 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:59:17 +0000 Subject: [PATCH 19/27] Update modules/ROOT/pages/authentication-authorization/manage-roles.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../ROOT/pages/authentication-authorization/manage-roles.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc index 7707bfaba..1d34c00c4 100644 --- a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc +++ b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc @@ -587,7 +587,7 @@ The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXIST == Immutable roles Immutable roles are those that cannot be modified in the usual way. -This means they cannot be created, renamed, dropped, or have privileges granted to or revoked from them. +This means they cannot be created, renamed, dropped, or have privileges granted to or revoked from them under normal operating conditions. See xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges] for details. They are useful in cases where you need a permanent built-in system role that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. From 4b4c27a418873a2760c2f92ba22cdd45150f73ed Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:59:32 +0000 Subject: [PATCH 20/27] Update modules/ROOT/pages/authentication-authorization/manage-roles.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../ROOT/pages/authentication-authorization/manage-roles.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc index 1d34c00c4..8f5eaef57 100644 --- a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc +++ b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc @@ -588,7 +588,7 @@ The `CREATE OR REPLACE ROLE` command does not allow you to use the `IF NOT EXIST Immutable roles are those that cannot be modified in the usual way. This means they cannot be created, renamed, dropped, or have privileges granted to or revoked from them under normal operating conditions. -See xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges] for details. +See xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges] for details of when and how the `IMMUTABLE` keyword may be used. They are useful in cases where you need a permanent built-in system role that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. From 9987ad9e1cc11aee82175e3b5961d0ae35d28558 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:59:48 +0000 Subject: [PATCH 21/27] Update modules/ROOT/pages/authentication-authorization/manage-roles.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../ROOT/pages/authentication-authorization/manage-roles.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc index 8f5eaef57..2d0226f04 100644 --- a/modules/ROOT/pages/authentication-authorization/manage-roles.adoc +++ b/modules/ROOT/pages/authentication-authorization/manage-roles.adoc @@ -590,7 +590,7 @@ Immutable roles are those that cannot be modified in the usual way. This means they cannot be created, renamed, dropped, or have privileges granted to or revoked from them under normal operating conditions. See xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges] for details of when and how the `IMMUTABLE` keyword may be used. -They are useful in cases where you need a permanent built-in system role that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. +They are useful in cases where you need a permanent built-in system role that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges] but yet can be granted to and revoked from users in the same way as an ordinary role. [[access-control-rename-roles]] From b36391d9f28f738144b704f240e23c0ca701a53a Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 14:59:57 +0000 Subject: [PATCH 22/27] Update modules/ROOT/pages/index.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- modules/ROOT/pages/index.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/index.adoc b/modules/ROOT/pages/index.adoc index 3cc5ab684..6b44dec63 100644 --- a/modules/ROOT/pages/index.adoc +++ b/modules/ROOT/pages/index.adoc @@ -81,7 +81,7 @@ You can find more information in the xref:tools/cypher-shell.adoc[Cypher Shell s * Immutable privileges. + Immutable privileges are useful for restricting the actions of users who themselves are able to administer privileges. -Starting with Neo4j 5.26, immutable roles are also vailable. + +Starting with Neo4j 5.26, immutable roles are also available. + Cloud operators can use sidecar design pattern to control RBAC-based permissions. + For more information, see xref:authentication-authorization/immutable-roles-privileges.adoc[Immutable roles and privileges]. From 3f1917b17676b36b811878cbf6b4485dcaaaacff Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 15:01:19 +0000 Subject: [PATCH 23/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc Co-authored-by: Phil Wright <95368282+phil198@users.noreply.github.com> --- .../immutable-roles-privileges.adoc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 6905a936e..9b1765cac 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -121,7 +121,17 @@ DROP ROLE analyst ---- REVOKE MATCH {*} ON GRAPH * ELEMENTS * FROM analyst ---- +.Rename the `analyst` role +[source, cypher, role=noplay] +---- +RENAME ROLE analyst TO dataReader +---- +[NOTE] +==== +While the make-up (name, existence, associated privileges) of immutable roles is immutable, their assignment to users is not. +This means that an immutable role can itself be granted to or revoked from a user by any user with `ROLE MANAGEMENT` privileges. +==== [NOTE] ==== Only immutable privileges (e.g. `GRANT IMMUTABLE MATCH {*} ON GRAPH * ELEMENTS * TO analyst` in the example above) can be assigned to immutable roles. From 83791eceee6497ee7fd72299ace6754f1c77884a Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 15:03:59 +0000 Subject: [PATCH 24/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc --- .../immutable-roles-privileges.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 9b1765cac..a6bfc3449 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -84,7 +84,7 @@ SHOW PRIVILEGES WHERE IMMUTABLE The result shows that all users are restricted from adding or removing privileges, including the `admin` user. . Ensure you have completed steps 4 and 5 from <>. -=== Creating permanent roles which cannot be changed +=== Creating permanent roles that cannot be changed You can use immutable roles to create permanent built-in system roles that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges]. From 8d1f5d293e3a43614fbd786df1873b5965b94b83 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 15:12:20 +0000 Subject: [PATCH 25/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc --- .../immutable-roles-privileges.adoc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index a6bfc3449..5223bf4ee 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -3,10 +3,6 @@ = Immutable roles and privileges :description: This section explains how to use Cypher to manage immutable roles and privileges. -[NOTE] -==== -Immutable roles are available starting with Neo4j 5.26. -==== Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges]. Immutable roles are useful for providing _system roles_, which appear as permanent parts of the DBMS. From 33cf739708f1a5af8e2778b161518948ab4947a4 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 15:14:38 +0000 Subject: [PATCH 26/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc --- .../authentication-authorization/immutable-roles-privileges.adoc | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 5223bf4ee..246f900a4 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -5,6 +5,7 @@ Immutable privileges are useful for restricting the actions of users who can themselves administer xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-privilege-management[privileges]. +Starting with Neo4j 5.26, Neo4j also introduces immutable roles. Immutable roles are useful for providing _system roles_, which appear as permanent parts of the DBMS. From a581192356e669882d558b69bfdcb2b57dff37d3 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 4 Dec 2024 15:20:39 +0000 Subject: [PATCH 27/27] Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc --- .../authentication-authorization/immutable-roles-privileges.adoc | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc index 246f900a4..20b37a3a4 100644 --- a/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc +++ b/modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc @@ -118,6 +118,7 @@ DROP ROLE analyst ---- REVOKE MATCH {*} ON GRAPH * ELEMENTS * FROM analyst ---- ++ .Rename the `analyst` role [source, cypher, role=noplay] ----