diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg index 4e0babc35..59ffa7f49 100644 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg @@ -1,99 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg index 0ccfd067d..dbdf28cfb 100644 --- a/modules/ROOT/images/privileges_hierarchy_database.svg +++ b/modules/ROOT/images/privileges_hierarchy_database.svg @@ -1,9 +1 @@ - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index b90723fd5..0377bf483 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -5,8 +5,10 @@ [source, cypher, role=test-setup] ---- CREATE ROLE regularUsers; +CREATE ROLE alterDbUsers; CREATE ROLE databaseAdminUsers; CREATE DATABASE `remote-db`; +CREATE COMPOSITE DATABASE `composite`; CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; ---- //// @@ -184,6 +186,7 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not The hierarchy between the different database privileges is shown in the image below. +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] @@ -237,6 +240,52 @@ GRANT [IMMUTABLE] { START \| STOP } |=== +[role=label--new-2025.08] +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify everything, database access or default language of the home database, specific database(s), or all databases. +Only applies to standard databases. + +|=== + +[role=label--new-2025.08] +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { ALTER COMPOSITE DATABASE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER COMPOSITE DATABASE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify the home database, specific database(s), or all databases. +Only applies to composite databases. + +|=== + .Database privilege syntax [cols="<15s,<85"] @@ -479,7 +528,7 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] |=== - +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] @@ -564,7 +613,7 @@ DENY [IMMUTABLE] START TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to start to the database `system`, use: [source, cypher, role=noplay] ---- @@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to stop the database `system`, use: [source, cypher, role=noplay] ---- @@ -628,6 +677,172 @@ a|Rows: 6 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. ==== +[role=label--new-2025.08] +[[access-control-database-administration-alter-db]] +== The alter database related privileges + +The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`. +For more information on the DBMS privilege versions, see the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[`DATABASE MANAGEMENT` privileges]. + + +The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER DATABASE ON DATABASE neo4j TO alterDbUsers +---- + +The `ALTER DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER DATABASE ON DATABASE system TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can be used to enable the ability to modify access, read-only or read-write, to a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database. + +For example, to grant the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can be used to enable the ability to modify the default language of a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the default Cypher language version of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the default language of the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE system TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can be used to enable the ability to modify a composite database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the home database as long as it's a composite database, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the composite database `composite`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER COMPOSITE DATABASE ON DATABASE composite TO alterDbUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE alterDbUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ALTER COMPOSITE DATABASE ON DATABASE `composite` TO `alterDbUsers`" +|"DENY ALTER DATABASE ON DATABASE `system` TO `alterDbUsers`" +|"DENY SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE `system` TO `alterDbUsers`" +|"GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO `alterDbUsers`" +|"GRANT ALTER DATABASE ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE `neo4j` TO `alterDbUsers`" +a|Rows: 8 +|=== + +[NOTE] +==== +Note that `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. +==== + [[access-control-database-administration-index]] == The `INDEX MANAGEMENT` privileges @@ -873,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] [NOTE] ==== -Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. +Note that the privileges for starting, stopping and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. These privileges are associated with administrators while other database privileges are of use to domain and application developers. ==== diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index c0d7206ff..317b03b85 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT |=== +From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to create standard databases You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. + @@ -1200,6 +1204,10 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to modify access to standard databases You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. + @@ -1226,7 +1234,11 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -[rol=label--new-2025.06] +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + +[role=label--new-2025.06] === Grant privilege to modify the default language of standard databases You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. + @@ -1253,7 +1265,11 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -[rol=label--new-2025.06] +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + +[role=label--new-2025.06] [[grant-privilege-alter-composite-database]] === Grant privilege to modify composite databases @@ -1281,6 +1297,10 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to manage composite databases You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +