You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/built-in-roles.adoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -830,7 +830,7 @@ These include the rights to perform the following classes of tasks:
830
830
** Manage link:{neo4j-docs-base-uri}/cypher-manual/current/indexes/[indexes] and link:{neo4j-docs-base-uri}/cypher-manual/current/constraints/[constraints].
831
831
** Allow the creation of labels, relationship types, or property names.
832
832
** Manage transactions.
833
-
* Manage xref:authentication-authorization/dbms-administration.adoc[DBMS privileges] to control the rights to perform actions on the entire system:
833
+
* Manage xref:authentication-authorization/dbms-administration/index.adoc[DBMS privileges] to control the rights to perform actions on the entire system:
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/database-administration.adoc
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -182,7 +182,7 @@ Use `REVOKE` if you want to remove a privilege.
182
182
183
183
Common errors, such as misspellings or attempts to revoke privileges that have not been granted or denied, will lead to notifications.
184
184
In Cypher 25, notifications for impossible `REVOKE` commands, where a user, a role, or a database does not exist, have been replaced with errors.
185
-
See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-notifications[Status Codes for Errors & Notifications -> Server notifications] for details on notifications.
185
+
See link:https://neo4j.com/docs/status-codes/current/notifications/all-notifications/[Status Codes for Errors & Notifications -> List of notification codes] for details on notifications.
186
186
187
187
The hierarchy between the different database privileges is shown in the image below.
188
188
@@ -679,7 +679,7 @@ Note that `START` and `STOP` privileges are not included in the xref:authenticat
679
679
680
680
The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
681
681
The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`.
682
-
For more information on the DBMS privilege versions, see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[The `DBMS DATABASE MANAGEMENT` privileges].
682
+
For more information on the DBMS privilege versions, see xref:authentication-authorization/dbms-administration/dbms-database-management-privileges.adoc[The `DBMS DATABASE MANAGEMENT` privileges].
683
683
684
684
685
685
The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database:
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/dbms-administration/dbms-database-management-privileges.adoc
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -150,7 +150,7 @@ The DBMS privilege version is equivalent to granting the privilege for all datab
150
150
For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
151
151
====
152
152
153
-
===Grant privilege to create standard databases
153
+
== Grant privilege to create standard databases
154
154
155
155
You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. +
156
156
For example:
@@ -176,7 +176,7 @@ SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS;
176
176
a|Rows: 1
177
177
|===
178
178
179
-
=== Grant privilege to create composite databases
179
+
== Grant privilege to create composite databases
180
180
181
181
You can grant the privilege to create composite databases using the `CREATE COMPOSITE DATABASE` privilege. +
182
182
For example:
@@ -202,7 +202,7 @@ SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS;
202
202
a|Rows: 1
203
203
|===
204
204
205
-
=== Grant privilege to delete standard databases
205
+
== Grant privilege to delete standard databases
206
206
207
207
You can grant the privilege to delete standard databases using the `DROP DATABASE` privilege. +
208
208
For example:
@@ -228,7 +228,7 @@ SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS;
228
228
a|Rows: 1
229
229
|===
230
230
231
-
=== Grant privilege to delete composite databases
231
+
== Grant privilege to delete composite databases
232
232
233
233
You can grant the privilege to delete composite databases using the `DROP COMPOSITE DATABASE` privilege. +
234
234
For example:
@@ -254,7 +254,7 @@ SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS;
254
254
a|Rows: 1
255
255
|===
256
256
257
-
=== Grant privilege to modify standard databases
257
+
== Grant privilege to modify standard databases
258
258
259
259
You can grant the privilege to modify standard databases using the `ALTER DATABASE` privilege. +
260
260
For example:
@@ -287,7 +287,7 @@ The DBMS privilege version is equivalent to granting the privilege for all datab
287
287
For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
288
288
====
289
289
290
-
=== Grant privilege to modify access to standard databases
290
+
== Grant privilege to modify access to standard databases
291
291
292
292
You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. +
293
293
For example:
@@ -321,7 +321,7 @@ For more information on the database privilege versions, see xref:authentication
321
321
====
322
322
323
323
[role=label--new-2025.06]
324
-
=== Grant privilege to modify the default language of standard databases
324
+
== Grant privilege to modify the default language of standard databases
325
325
326
326
You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. +
327
327
For example:
@@ -356,7 +356,7 @@ For more information on the database privilege versions, see xref:authentication
356
356
357
357
[role=label--new-2025.06]
358
358
[[grant-privilege-alter-composite-database]]
359
-
=== Grant privilege to modify composite databases
359
+
== Grant privilege to modify composite databases
360
360
361
361
You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
362
362
For example:
@@ -389,7 +389,7 @@ The DBMS privilege version is equivalent to granting the privilege for all datab
389
389
For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
390
390
====
391
391
392
-
=== Grant privilege to manage composite databases
392
+
== Grant privilege to manage composite databases
393
393
394
394
You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +
395
395
For example:
@@ -415,7 +415,7 @@ SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS;
415
415
a|Rows: 1
416
416
|===
417
417
418
-
=== Grant privilege to manage standard and composite databases
418
+
== Grant privilege to manage standard and composite databases
419
419
420
420
You can grant the privilege to create, delete, and modify standard and composite databases using the `DATABASE MANAGEMENT` privilege. +
You can grant the privilege to execute procedures using the `EXECUTE PROCEDURE` privilege. +
120
-
A role with this privilege is allowed to execute the procedures matched by the <<access-control-name-globbing, name-globbing>>.
120
+
A role with this privilege is allowed to execute the procedures matched by the xref:authentication-authorization/dbms-administration/index.adoc#access-control-name-globbing[name-globbing].
121
121
122
-
==== Grant privilege to execute some procedures
122
+
=== Grant privilege to execute some procedures
123
123
124
124
The following query allow the execution of procedures starting with `db.schema`:
125
125
@@ -146,7 +146,7 @@ SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS;
146
146
a|Rows: 1
147
147
|===
148
148
149
-
==== Grant privilege to execute all but some procedures
149
+
=== Grant privilege to execute all but some procedures
150
150
151
151
You can grant the privilege to execute all except a few procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
152
152
For example, the following queries allow the execution of all procedures, except those starting with `dbms.cluster`:
@@ -185,15 +185,15 @@ The `dbms.cluster.checkConnectivity`, `dbms.cluster.cordonServer`, `dbms.cluster
185
185
186
186
187
187
[[access-control-execute-boosted-procedure]]
188
-
=== Grant privilege to execute procedures with elevated privileges
188
+
== Grant privilege to execute procedures with elevated privileges
189
189
190
190
You can grant the privilege to execute procedures with elevated privileges using the `EXECUTE BOOSTED PROCEDURE` privilege. +
191
-
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <<access-control-name-globbing, name-globbing>>.
191
+
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the xref:authentication-authorization/dbms-administration/index.adoc#access-control-name-globbing[name-globbing].
192
192
The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not the execution of the procedure.
193
193
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
194
194
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
195
195
196
-
==== Grant privilege to execute some procedures with elevated privileges
196
+
=== Grant privilege to execute some procedures with elevated privileges
197
197
198
198
You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
199
199
@@ -226,7 +226,7 @@ a|Rows: 3
226
226
|===
227
227
228
228
[[grant-execute-procedure-deny-elevation]]
229
-
==== Combination of granting execution and denying privilege elevation
229
+
=== Combination of granting execution and denying privilege elevation
230
230
231
231
As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
232
232
@@ -259,7 +259,7 @@ a|Rows: 2
259
259
|===
260
260
261
261
[[grant-privilege-elevation-deny-execution]]
262
-
==== Combination of granting privilege elevation and denying execution
262
+
=== Combination of granting privilege elevation and denying execution
263
263
264
264
You can also grant the privilege to execute procedures with elevated privileges and deny the execution of specific procedures.
265
265
@@ -294,7 +294,7 @@ a|Rows: 2
294
294
|===
295
295
296
296
[[grant-deny-privilege-elevation]]
297
-
==== Combination of granting and denying privilege elevation
297
+
=== Combination of granting and denying privilege elevation
298
298
299
299
You can also grant the privilege to execute procedures with elevated privileges and deny the elevation for specific procedures.
300
300
@@ -330,7 +330,7 @@ SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS;
330
330
a|Rows: 2
331
331
|===
332
332
333
-
==== Control procedure output with privileges
333
+
=== Control procedure output with privileges
334
334
335
335
You can control the output of procedures based on the privileges granted or denied to a role using the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
336
336
For example, assume there is a procedure called `myProc`.
@@ -353,7 +353,7 @@ For comparison, when granted:
353
353
354
354
355
355
[[access-control-admin-procedure]]
356
-
=== Grant privilege to execute admin procedures
356
+
== Grant privilege to execute admin procedures
357
357
358
358
Admin procedures (annotated with `@Admin`) are special in that they require elevated privileges to be executed at all.
359
359
This means that to execute an admin procedure you need both the <<access-control-execute-procedure, `EXECUTE PROCEDURE`>> and <<access-control-execute-boosted-procedure, `EXECUTE BOOSTED PROCEDURE`>> privileges for that procedure.
@@ -396,18 +396,18 @@ Any denied `EXECUTE` privilege results in the procedure not being allowed to be
396
396
In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED PROCEDURE` or `EXECUTE ADMIN PROCEDURES` is being denied.
397
397
398
398
[[access-control-execute-user-defined-function]]
399
-
=== Grant privilege to execute user-defined functions
399
+
== Grant privilege to execute user-defined functions
400
400
401
401
//EXECUTE [USER [DEFINED]] FUNCTION[S]
402
402
You can grant the privilege to execute user-defined functions (UDFs) using the `EXECUTE USER DEFINED FUNCTION` privilege.
403
-
A role with this privilege is allowed to execute the UDFs matched by the <<access-control-name-globbing, name-globbing>>.
403
+
A role with this privilege is allowed to execute the UDFs matched by the xref:authentication-authorization/dbms-administration/index.adoc#access-control-name-globbing[name-globbing].
404
404
405
405
[IMPORTANT]
406
406
====
407
407
The `EXECUTE USER DEFINED FUNCTION` privilege does not apply to built-in functions, which are always executable.
408
408
====
409
409
410
-
==== Grant privilege to execute some user-defined functions
410
+
=== Grant privilege to execute some user-defined functions
411
411
412
412
The following query shows an example of how to grant the `EXECUTE USER DEFINED FUNCTION` privilege:
413
413
@@ -442,7 +442,7 @@ SHOW ROLE functionExecutor PRIVILEGES AS COMMANDS;
442
442
a|Rows: 1
443
443
|===
444
444
445
-
==== Grant privilege to execute all but some user-defined functions
445
+
=== Grant privilege to execute all but some user-defined functions
446
446
447
447
To allow the execution of all but a few UDFs, you can grant `+EXECUTE USER DEFINED FUNCTIONS *+` and deny the unwanted UDFs.
448
448
For example, the following queries allow the execution of all UDFs except those starting with `apoc.any.prop`:
@@ -490,11 +490,11 @@ a|Rows: 2
490
490
The `apoc.any.property` and `apoc.any.properties` are blocked, as well as any other UDFs starting with `apoc.any.prop`.
=== Grant privilege to execute user-defined functions with elevated privileges
493
+
== Grant privilege to execute user-defined functions with elevated privileges
494
494
495
495
//EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S]
496
496
You can grant the privilege to execute user-defined functions (UDFs) with elevated privileges using the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege. +
497
-
A user with this privilege will not be restricted to their other privileges when executing the UDFs matched by the <<access-control-name-globbing, name-globbing>>.
497
+
A user with this privilege will not be restricted to their other privileges when executing the UDFs matched by the xref:authentication-authorization/dbms-administration/index.adoc#access-control-name-globbing[name-globbing].
498
498
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
499
499
Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the UDFs as well.
500
500
Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
@@ -504,7 +504,7 @@ Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION`
504
504
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
505
505
====
506
506
507
-
==== Grant privilege to execute some user-defined functions with elevated privileges
507
+
=== Grant privilege to execute some user-defined functions with elevated privileges
508
508
509
509
The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege:
Copy file name to clipboardExpand all lines: modules/ROOT/pages/authentication-authorization/dbms-administration/dbms-privilege-management-privileges.adoc
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -106,7 +106,7 @@ GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT
106
106
| Enables the specified roles to list, assign, and remove privileges.
107
107
|===
108
108
109
-
===Grant privilege to list privileges
109
+
== Grant privilege to list privileges
110
110
111
111
You can grant the `SHOW PRIVILEGE` privilege to allow a user to list privileges using the `SHOW PRIVILEGE`, `SHOW ROLE roleName PRIVILEGES`, and `SHOW USER username PRIVILEGES` administration commands.
112
112
The `SHOW USER username PRIVILEGES` command also requires the `SHOW USER` privilege.
@@ -142,7 +142,7 @@ If a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will o
142
142
Other users' privileges cannot be listed when using a non-native auth provider.
143
143
====
144
144
145
-
=== Grant privilege to assign privileges
145
+
== Grant privilege to assign privileges
146
146
147
147
You can grant the privilege to assign privileges using the `ASSIGN PRIVILEGE` privilege. +
148
148
A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands. +
@@ -169,7 +169,7 @@ SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS;
169
169
a|Rows: 1
170
170
|===
171
171
172
-
=== Grant privilege to remove privileges
172
+
== Grant privilege to remove privileges
173
173
174
174
You can grant the privilege to remove privileges from roles using the `REMOVE PRIVILEGE` privilege. +
175
175
A user with this privilege is allowed to execute `REVOKE` administration commands. +
@@ -196,7 +196,7 @@ SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS;
196
196
a|Rows: 1
197
197
|===
198
198
199
-
=== Grant privilege to manage privileges
199
+
== Grant privilege to manage privileges
200
200
201
201
You can grant the privilege to list, assign, and remove privileges using the `PRIVILEGE MANAGEMENT` privilege. +
0 commit comments