diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg index 4e0babc35..59ffa7f49 100644 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg @@ -1,99 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg index 0ccfd067d..dbdf28cfb 100644 --- a/modules/ROOT/images/privileges_hierarchy_database.svg +++ b/modules/ROOT/images/privileges_hierarchy_database.svg @@ -1,9 +1 @@ - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index b90723fd5..0582e255d 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -5,8 +5,10 @@ [source, cypher, role=test-setup] ---- CREATE ROLE regularUsers; +CREATE ROLE alterDbUsers; CREATE ROLE databaseAdminUsers; CREATE DATABASE `remote-db`; +CREATE COMPOSITE DATABASE `composite`; CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; ---- //// @@ -72,7 +74,7 @@ This can be quite powerful as it allows permissions to be switched from one data For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[]. ==== -.General grant +ON DATABASE+ privilege syntax +.`GRANT ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -92,7 +94,7 @@ GRANT [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| na |=== -.General deny +ON DATABASE+ privilege syntax +.`DENY ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -112,7 +114,7 @@ DENY [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| nam |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE GRANT ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -132,7 +134,7 @@ REVOKE [IMMUTABLE] GRANT database-privilege ON { HOME DATABASE \| DATABASE[S] { |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE DENY ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -152,7 +154,7 @@ REVOKE [IMMUTABLE] DENY database-privilege ON { HOME DATABASE \| DATABASE[S] { * |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -184,12 +186,13 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not The hierarchy between the different database privileges is shown in the image below. +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] -.Database privilege syntax +.`GRANT ACCESS` privilege syntax [cols="<15s,<85"] |=== @@ -216,7 +219,7 @@ Grants the specified roles the privilege to access: |=== -.Database privilege syntax +.`GRANT START | STOP` privilege syntax [cols="<15s,<85"] |=== @@ -237,8 +240,54 @@ GRANT [IMMUTABLE] { START \| STOP } |=== +[role=label--new-2025.08 label--cypher-25] +.`GRANT ALTER DATABASE | SET DATABASE ACCESS | SET DATABASE DEFAULT LANGUAGE` privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify everything, database access or default language of the home database, specific database(s), or all databases. +Only applies to standard databases. + +|=== + +[role=label--new-2025.08 label--cypher-25] +.`GRANT ALTER COMPOSITE DATABASE` privilege syntax +[cols="<15s,<85"] +|=== -.Database privilege syntax +| Command +m| +GRANT { ALTER COMPOSITE DATABASE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER COMPOSITE DATABASE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify the home database, specific database(s), or all databases. +Only applies to composite databases. + +|=== + + +.`GRANT CREATE | DROP | SHOW INDEX` privilege syntax [cols="<15s,<85"] |=== @@ -260,7 +309,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] |=== -.Database privilege syntax +.`GRANT INDEX` privilege syntax [cols="<15s,<85"] |=== @@ -282,7 +331,7 @@ GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT CREATE | DROP | SHOW CONSTRAINT` privilege syntax [cols="<15s,<85"] |=== @@ -304,7 +353,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] |=== -.Database privilege syntax +.`GRANT CONSTRAINT` privilege syntax [cols="<15s,<85"] |=== @@ -326,7 +375,7 @@ GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT CREATE NEW LABEL` privilege syntax [cols="<15s,<85"] |=== @@ -348,7 +397,7 @@ GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] |=== -.Database privilege syntax +.`GRANT CREATE NEW TYPE` privilege syntax [cols="<15s,<85"] |=== @@ -370,7 +419,7 @@ GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] |=== -.Database privilege syntax +.`GRANT CREATE NEW NAME` privilege syntax [cols="<15s,<85"] |=== @@ -392,7 +441,7 @@ GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] |=== -.Database privilege syntax +.`GRANT NAME` privilege syntax [cols="<15s,<85"] |=== @@ -414,7 +463,7 @@ GRANT [IMMUTABLE] NAME [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT ALL` privilege syntax [cols="<15s,<85"] |=== @@ -436,7 +485,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] |=== -.Database privilege syntax +.`GRANT { SHOW \| TERMINATE } TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -458,7 +507,7 @@ GRANT [IMMUTABLE] { SHOW \| TERMINATE } TRANSACTION[S] [( { * \| user[, ...] } ) |=== -.Database privilege syntax +.`GRANT TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -479,8 +528,8 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] |=== - -image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure +image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of `GRANT` and `DENY` database privileges"] [[access-control-database-administration-access]] @@ -564,7 +613,7 @@ DENY [IMMUTABLE] START TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to start to the database `system`, use: [source, cypher, role=noplay] ---- @@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to stop the database `system`, use: [source, cypher, role=noplay] ---- @@ -628,6 +677,172 @@ a|Rows: 6 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. ==== +[role=label--new-2025.08 label--cypher-25] +[[access-control-database-administration-alter-db]] +== The alter database-related privileges + +The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`. +For more information on the DBMS privilege versions, see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[The `DBMS DATABASE MANAGEMENT` privileges]. + + +The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER DATABASE ON DATABASE neo4j TO alterDbUsers +---- + +The `ALTER DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER DATABASE ON DATABASE system TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can be used to enable the ability to modify access, read-only or read-write, to a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database. + +For example, to grant the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can be used to enable the ability to modify the default language of a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the default Cypher language version of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the default language of the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE system TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can be used to enable the ability to modify a composite database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the home database as long as it's a composite database, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the composite database `composite`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER COMPOSITE DATABASE ON DATABASE composite TO alterDbUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE alterDbUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ALTER COMPOSITE DATABASE ON DATABASE `composite` TO `alterDbUsers`" +|"DENY ALTER DATABASE ON DATABASE `system` TO `alterDbUsers`" +|"DENY SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE `system` TO `alterDbUsers`" +|"GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO `alterDbUsers`" +|"GRANT ALTER DATABASE ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE `neo4j` TO `alterDbUsers`" +a|Rows: 8 +|=== + +[NOTE] +==== +Note that `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. +==== + [[access-control-database-administration-index]] == The `INDEX MANAGEMENT` privileges @@ -873,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] [NOTE] ==== -Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. +Note that the privileges for starting, stopping, and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. These privileges are associated with administrators while other database privileges are of use to domain and application developers. ==== @@ -906,7 +1121,7 @@ a|Rows: 1 The right to run the commands `SHOW TRANSACTIONS`, `TERMINATE TRANSACTIONS`, and the deprecated procedures `dbms.listTransactions`, `dbms.listQueries`, `dbms.killQuery`, `dbms.killQueries`, `dbms.killTransaction` and `dbms.killTransactions` is now managed through the `SHOW TRANSACTION` and `TERMINATE TRANSACTION` privileges. -.Database privilege syntax +.`GRANT SHOW TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -928,7 +1143,7 @@ GRANT [IMMUTABLE] SHOW TRANSACTION[S] [( { * \| user[, ...] } )] |=== -.Database privilege syntax +.`GRANT TERMINATE TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -950,7 +1165,7 @@ GRANT [IMMUTABLE] TERMINATE TRANSACTION[S] [( { * \| user[, ...] } )] |=== -.Database privilege syntax +.`GRANT TRANSACTION` privilege syntax [cols="<15s,<85"] |=== diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index c0d7206ff..4869f4a6f 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1070,6 +1070,13 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT |=== +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== + === Grant privilege to create standard databases You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. + @@ -1200,6 +1207,13 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== + === Grant privilege to modify access to standard databases You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. + @@ -1226,7 +1240,14 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -[rol=label--new-2025.06] +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE ACCESS` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== + +[role=label--new-2025.06] === Grant privilege to modify the default language of standard databases You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. + @@ -1253,7 +1274,14 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -[rol=label--new-2025.06] +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE DEFAULT LANGUAGE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== + +[role=label--new-2025.06] [[grant-privilege-alter-composite-database]] === Grant privilege to modify composite databases @@ -1281,6 +1309,13 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== + === Grant privilege to manage composite databases You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +