Managing privileges

Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. It is possible to grant access, or deny access, or a combination of the two. The user will be able to access the resource if they have a grant (whitelist) and do not have a deny (blacklist) relevant to that resource. All other combinations of GRANT and DENY will result in the matching path being inaccessible. What this means in practice depends on whether we are talking about a read privilege or a write privilege.

  • If a entity is not accessible due to read privileges, the data will become invisible to attempts to read it. It will appear to the user as if they have a smaller database (smaller graph).

  • If an entity is not accessible due to write privileges, an error will occur on any attempt to write that data.

In this document we will often use the terms 'allows' and 'enables' in seemingly identical ways. However, there is a subtle difference. We will use 'enables' to refer to the consequences of read privileges where a restriction will not cause an error, only a reduction in the apparent graph size. We will use 'allows' to refer to the consequence of write privileges where a restriction can result in an error.

If a user was not also provided with the database ACCESS privilege then access to the entire database will be denied. Information about the database access privilege can be found in The ACCESS privilege.

Graph privilege commands (GRANT, DENY and REVOKE)

Administrators can use Cypher® commands to manage Neo4j graph administrative rights. The components of the graph privilege commands are:

  • the command:

    • GRANT – gives privileges to roles.

    • DENY – denies privileges to roles.

    • REVOKE – removes granted or denied privilege from roles.

  • graph-privilege

  • name

    • The graph or graphs to associate the privilege with. Because in Neo4j 4.3 you can have only one graph per database, this command uses the database name to refer to that graph.

      If you delete a database and create a new one with the same name, the new one will NOT have the privileges assigned to the deleted graph.

    • It can be * which means all graphs. Graphs created after this command execution will also be associated with these privileges.

    • HOME GRAPH refers to the graph associated with the home database for that user. The default database will be used as home database if a user does not have a home database configured. If the user’s home database changes for any reason after privileges have been created then these privileges will be associated with the graph attached to the new database. This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user’s home database.

  • entity

    • The graph elements this privilege applies to:

      • NODES label (nodes with the specified label(s)).

      • RELATIONSHIPS type (relationships of the specific type(s)).

      • ELEMENTS label (both nodes and relationships).

    • The label or type can be * which means all labels or types.

    • Multiple labels or types can be specified, comma-separated.

    • Defaults to ELEMENTS * if omitted.

    • Some of the commands for write privileges do not allow an entity part, see Write privileges for details.

  • role[, …​]

    • The role or roles to associate the privilege with, comma-separated.

Table 1. General graph privilege command syntax
Command Description 
GRANT graph-privilege ON {HOME GRAPH | GRAPH[S] {* | name[, ...]}} [entity] TO role[, ...]

Grant a privilege to one or multiple roles.

 
DENY graph-privilege ON {HOME GRAPH | GRAPH[S] {* | name[, ...]}} [entity] TO role[, ...]

Deny a privilege to one or multiple roles.

 
REVOKE GRANT graph-privilege ON {HOME GRAPH | GRAPH[S] {* | name[, ...]}} [entity] FROM role[, ...]

Revoke a granted privilege from one or multiple roles.

 
REVOKE DENY graph-privilege ON {HOME GRAPH | GRAPH[S] {* | name[, ...]}} [entity] FROM role[, ...]

Revoke a denied privilege from one or multiple roles.

 
REVOKE graph-privilege ON {HOME GRAPH | GRAPH[S] {* | name[, ...]}} [entity] FROM role[, ...]

Revoke a granted or denied privilege from one or multiple roles.

DENY does NOT erase a granted privilege; they both exist. Use REVOKE if you want to remove a privilege.

The general grant and deny syntax is illustrated in the following image:

grant privileges overview
Figure 1. GRANT and DENY Syntax

A more detailed syntax illustration would be the following image for graph privileges:

grant privileges graph
Figure 2. Syntax of GRANT and DENY Graph Privileges. The { and } are part of the syntax and not used for grouping.

The following image shows the hierarchy between the different graph privileges:

privilege hierarchy graph
Figure 3. Graph privileges hierarchy

Listing privileges

Available privileges can be displayed using the different SHOW PRIVILEGES commands.

Table 2. Show privileges command syntax
Command Description 
SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]

List all privileges.

 
SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]

List privileges for a specific role.

 
SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]

List privileges for a specific user, or the current user.

Please note that it is only possible for a user to show their own privileges. Therefore, if a non-native auth provider like LDAP is in use, SHOW USER PRIVILEGES will only work in a limited capacity.

Other users' privileges cannot be listed when using a non-native auth provider.

When using the RETURN clause, the YIELD clause is mandatory and may not be omitted.

For an easy overview of the existing privileges, it is recommended to use the AS COMMANDS version of the show command. This returns the privileges as the commands that are granted or denied.

Omitting the AS COMMANDS clause instead gives the result as multiple columns describing the privilege:

  • access: whether the privilege is granted or denied.

  • action: which type of privilege this is, for example traverse, read, index management, or role management.

  • resource: what type of scope this privilege applies to: the entire dbms, a database, a graph or sub-graph access.

  • graph: the specific database or graph this privilege applies to.

  • segment: when applicable, the scope this privilege applies to: labels, relationship types, procedures, functions, or transactions.

  • role: the role the privilege is granted to.

Examples for listing all privileges

Available privileges can be displayed using the different SHOW PRIVILEGES commands.

Command syntax
SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [WHERE expression]

SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
SHOW PRIVILEGES

Lists all privileges for all roles:

Table 3. Result
access action resource graph segment role

"GRANTED"

"execute"

"database"

"*"

"FUNCTION(*)"

"PUBLIC"

"GRANTED"

"execute"

"database"

"*"

"PROCEDURE(*)"

"PUBLIC"

"GRANTED"

"access"

"database"

"DEFAULT"

"database"

"PUBLIC"

"GRANTED"

"match"

"all_properties"

"*"

"NODE(*)"

"admin"

"GRANTED"

"write"

"graph"

"*"

"NODE(*)"

"admin"

"GRANTED"

"match"

"all_properties"

"*"

"RELATIONSHIP(*)"

"admin"

"GRANTED"

"write"

"graph"

"*"

"RELATIONSHIP(*)"

"admin"

"GRANTED"

"transaction_management"

"database"

"*"

"USER(*)"

"admin"

"GRANTED"

"access"

"database"

"*"

"database"

"admin"

"GRANTED"

"constraint"

"database"

"*"

"database"

"admin"

"GRANTED"

"dbms_actions"

"database"

"*"

"database"

"admin"

"GRANTED"

"index"

"database"

"*"

"database"

"admin"

"GRANTED"

"start_database"

"database"

"*"

"database"

"admin"

"GRANTED"

"stop_database"

"database"

"*"

"database"

"admin"

"GRANTED"

"token"

"database"

"*"

"database"

"admin"

"GRANTED"

"match"

"all_properties"

"*"

"NODE(*)"

"architect"

"GRANTED"

"write"

"graph"

"*"

"NODE(*)"

"architect"

"GRANTED"

"match"

"all_properties"

"*"

"RELATIONSHIP(*)"

"architect"

"GRANTED"

"write"

"graph"

"*"

"RELATIONSHIP(*)"

"architect"

"GRANTED"

"access"

"database"

"*"

"database"

"architect"

"GRANTED"

"constraint"

"database"

"*"

"database"

"architect"

"GRANTED"

"index"

"database"

"*"

"database"

"architect"

"GRANTED"

"token"

"database"

"*"

"database"

"architect"

"GRANTED"

"match"

"all_properties"

"*"

"NODE(*)"

"editor"

"GRANTED"

"write"

"graph"

"*"

"NODE(*)"

"editor"

"GRANTED"

"match"

"all_properties"

"*"

"RELATIONSHIP(*)"

"editor"

"GRANTED"

"write"

"graph"

"*"

"RELATIONSHIP(*)"

"editor"

"GRANTED"

"access"

"database"

"*"

"database"

"editor"

"DENIED"

"access"

"database"

"neo4j"

"database"

"noAccessUsers"

"GRANTED"

"match"

"all_properties"

"*"

"NODE(*)"

"publisher"

"GRANTED"

"write"

"graph"

"*"

"NODE(*)"

"publisher"

"GRANTED"

"match"

"all_properties"

"*"

"RELATIONSHIP(*)"

"publisher"

"GRANTED"

"write"

"graph"

"*"

"RELATIONSHIP(*)"

"publisher"

"GRANTED"

"access"

"database"

"*"

"database"

"publisher"

"GRANTED"

"token"

"database"

"*"

"database"

"publisher"

"GRANTED"

"match"

"all_properties"

"*"

"NODE(*)"

"reader"

"GRANTED"

"match"

"all_properties"

"*"

"RELATIONSHIP(*)"

"reader"

"GRANTED"

"access"

"database"

"*"

"database"

"reader"

"GRANTED"

"access"

"database"

"neo4j"

"database"

"regularUsers"

Rows: 39

The token action corresponds to the NAME MANAGEMENT privilege.

It is also possible to filter and sort the results by using YIELD, ORDER BY and WHERE:

SHOW PRIVILEGES YIELD role, access, action, segment ORDER BY action WHERE role = 'admin'

In this example:

  • The number of columns returned has been reduced with the YIELD clause.

  • The order of the returned columns has been changed.

  • The results have been filtered to only return the admin role using a WHERE clause.

  • The results are ordered by the action column using ORDER BY.

SKIP and LIMIT can also be used to paginate the results.

Table 4. Result
role access action segment

"admin"

"GRANTED"

"access"

"database"

"admin"

"GRANTED"

"constraint"

"database"

"admin"

"GRANTED"

"dbms_actions"

"database"

"admin"

"GRANTED"

"index"

"database"

"admin"

"GRANTED"

"match"

"NODE(*)"

"admin"

"GRANTED"

"match"

"RELATIONSHIP(*)"

"admin"

"GRANTED"

"start_database"

"database"

"admin"

"GRANTED"

"stop_database"

"database"

"admin"

"GRANTED"

"token"

"database"

"admin"

"GRANTED"

"transaction_management"

"USER(*)"

"admin"

"GRANTED"

"write"

"NODE(*)"

"admin"

"GRANTED"

"write"

"RELATIONSHIP(*)"

Rows: 12

The token action corresponds to the NAME MANAGEMENT privilege.

WHERE can be used without YIELD:

SHOW PRIVILEGES WHERE graph <> '*'

In this example, the WHERE clause is used to filter privileges down to those that target specific graphs only.

Table 5. Result
access action graph resource role segment

"GRANTED"

"access"

"DEFAULT"

"database"

"PUBLIC"

"database"

"DENIED"

"access"

"neo4j"

"database"

"noAccessUsers"

"database"

"GRANTED"

"access"

"neo4j"

"database"

"regularUsers"

"database"

Rows: 3

Aggregations in the RETURN clause can be used to group privileges. In this case, by user and granted / denied:

SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) as privileges
Table 6. Result
role access privileges

"PUBLIC"

"GRANTED"

[["*","database","FUNCTION(*)","execute"],["*","database","PROCEDURE(*)","execute"],["DEFAULT","database","database","access"]]

"admin"

"GRANTED"

[["*","all_properties","NODE(*)","match"],["*","graph","NODE(*)","write"],["*","all_properties","RELATIONSHIP(*)","match"],["*","graph","RELATIONSHIP(*)","write"],["*","database","USER(*)","transaction_management"],["*","database","database","access"],["*","database","database","constraint"],["*","database","database","dbms_actions"],["*","database","database","index"],["*","database","database","start_database"],["*","database","database","stop_database"],["*","database","database","token"]]

"architect"

"GRANTED"

[["*","all_properties","NODE(*)","match"],["*","graph","NODE(*)","write"],["*","all_properties","RELATIONSHIP(*)","match"],["*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"],["*","database","database","constraint"],["*","database","database","index"],["*","database","database","token"]]

"editor"

"GRANTED"

[["*","all_properties","NODE(*)","match"],["*","graph","NODE(*)","write"],["*","all_properties","RELATIONSHIP(*)","match"],["*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"]]

"noAccessUsers"

"DENIED"

[["neo4j","database","database","access"]]

"publisher"

"GRANTED"

[["*","all_properties","NODE(*)","match"],["*","graph","NODE(*)","write"],["*","all_properties","RELATIONSHIP(*)","match"],["*","graph","RELATIONSHIP(*)","write"],["*","database","database","access"],["*","database","database","token"]]

"reader"

"GRANTED"

[["*","all_properties","NODE(*)","match"],["*","all_properties","RELATIONSHIP(*)","match"],["*","database","database","access"]]

"regularUsers"

"GRANTED"

[["neo4j","database","database","access"]]

Rows: 8

The token action corresponds to the NAME MANAGEMENT privilege.

The RETURN clause can also be used to order and paginate the results, which is useful when combined with YIELD and WHERE. In this example the query returns privileges for display five-per-page, and skips the first five to display the second page.

SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5
Table 7. Result
access action graph resource role segment

"GRANTED"

"match"

"*"

"all_properties"

"admin"

"RELATIONSHIP(*)"

"GRANTED"

"write"

"*"

"graph"

"admin"

"RELATIONSHIP(*)"

"GRANTED"

"transaction_management"

"*"

"database"

"admin"

"USER(*)"

"GRANTED"

"access"

"*"

"database"

"admin"

"database"

"GRANTED"

"constraint"

"*"

"database"

"admin"

"database"

Rows: 5

Available privileges can also be output as Cypher commands, by appending AS COMMAND[S] to the show command:

SHOW PRIVILEGES AS COMMANDS
Table 8. Result
command

"DENY ACCESS ON DATABASE neo4j TO `noAccessUsers`"

"GRANT ACCESS ON DATABASE * TO `admin`"

"GRANT ACCESS ON DATABASE * TO `architect`"

"GRANT ACCESS ON DATABASE * TO `editor`"

"GRANT ACCESS ON DATABASE * TO `publisher`"

"GRANT ACCESS ON DATABASE * TO `reader`"

"GRANT ACCESS ON DATABASE neo4j TO `regularUsers`"

"GRANT ACCESS ON HOME DATABASE TO `PUBLIC`"

"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`"

"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`"

"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`"

"GRANT EXECUTE FUNCTION * ON DBMS TO `PUBLIC`"

"GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`"

"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`"

"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `editor`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `reader`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`"

"GRANT START ON DATABASE * TO `admin`"

"GRANT STOP ON DATABASE * TO `admin`"

"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`"

"GRANT WRITE ON GRAPH * TO `admin`"

"GRANT WRITE ON GRAPH * TO `architect`"

"GRANT WRITE ON GRAPH * TO `editor`"

"GRANT WRITE ON GRAPH * TO `publisher`"

Rows: 35

Like other SHOW commands, the output can also be processed using YIELD / WHERE / RETURN:

SHOW PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MANAGEMENT'
Table 9. Result
command

"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`"

"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`"

"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`"

"GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `architect`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`"

"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`"

Rows: 8

It is also possible to get the privilege commands formatted for revoking instead of granting or denying the privileges:

SHOW PRIVILEGES AS REVOKE COMMANDS
Table 10. Result
command

"REVOKE DENY ACCESS ON DATABASE neo4j FROM `noAccessUsers`"

"REVOKE GRANT ACCESS ON DATABASE * FROM `admin`"

"REVOKE GRANT ACCESS ON DATABASE * FROM `architect`"

"REVOKE GRANT ACCESS ON DATABASE * FROM `editor`"

"REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`"

"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`"

"REVOKE GRANT ACCESS ON DATABASE neo4j FROM `regularUsers`"

"REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`"

"REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`"

"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`"

"REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`"

"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM `PUBLIC`"

"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`"

"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`"

"REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`"

"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`"

"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`"

"REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`"

"REVOKE GRANT START ON DATABASE * FROM `admin`"

"REVOKE GRANT STOP ON DATABASE * FROM `admin`"

"REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`"

"REVOKE GRANT WRITE ON GRAPH * FROM `admin`"

"REVOKE GRANT WRITE ON GRAPH * FROM `architect`"

"REVOKE GRANT WRITE ON GRAPH * FROM `editor`"

"REVOKE GRANT WRITE ON GRAPH * FROM `publisher`"

Rows: 35

For more info about revoking privileges, please see The REVOKE command.

Examples for listing privileges for specific roles

Available privileges for specific roles can be displayed using SHOW ROLE name PRIVILEGES.

SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [WHERE expression]

SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
SHOW ROLE regularUsers PRIVILEGES

Lists all privileges for role regularUsers.

Table 11. Result
access action graph resource role segment

"GRANTED"

"access"

"database"

"neo4j"

"database"

"regularUsers"

Rows: 1

 
SHOW ROLES regularUsers, noAccessUsers PRIVILEGES

Lists all privileges for roles regularUsers and noAccessUsers.

Table 12. Result
access action graph resource role segment

"DENIED"

"access"

"database"

"neo4j"

"database"

"noAccessUsers"

"GRANTED"

"access"

"database"

"neo4j"

"database"

"regularUsers"

Rows: 2

Similar to the other show privilege commands, the available privileges for roles can also be output as Cypher commands with the optional AS COMMAND[S].

Table 13. Result
command

"GRANT ACCESS ON DATABASE * TO `admin`"

"GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`"

"GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`"

"GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`"

"GRANT MATCH {*} ON GRAPH * NODE * TO `admin`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`"

"GRANT NAME MANAGEMENT ON DATABASE * TO `admin`"

"GRANT START ON DATABASE * TO `admin`"

"GRANT STOP ON DATABASE * TO `admin`"

"GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`"

"GRANT WRITE ON GRAPH * TO `admin`"

Rows: 11

The output can be processed using YIELD / WHERE / RETURN here as well.

SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH'
Table 14. Result
command

"GRANT MATCH {*} ON GRAPH * NODE * TO `architect`"

"GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`"

Rows: 2

Again, is it possible to get the privilege commands formatted for revoking instead of granting or denying the privileges. For more info about revoking privileges, please see The REVOKE command.

SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS
Table 15. Result
command

"REVOKE GRANT ACCESS ON DATABASE * FROM `reader`"

"REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`"

"REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`"

Rows: 3

Examples for listing privileges for specific users

Available privileges for specific users can be displayed using SHOW USER name PRIVILEGES.

Please note that if a non-native auth provider like LDAP is in use, SHOW USER PRIVILEGES will only work in a limited capacity; It is only possible for a user to show their own privileges. Other users' privileges cannot be listed when using a non-native auth provider.

 
SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    [WHERE expression]

SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
    YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
    [WHERE expression]
    [RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]
SHOW USER jake PRIVILEGES

Lists all privileges for user jake.

Table 16. Result
access action resource graph resource role segment

"GRANTED"

"execute"

"database"

"*"

"FUNCTION(*)"

"PUBLIC"

"jake"

"GRANTED"

"execute"

"database"

"*"

"PROCEDURE(*)"

"PUBLIC"

"jake"

"GRANTED"

"access"

"database"

"DEFAULT"

"database"

"PUBLIC"

"jake"

"GRANTED"

"access"

"database"

"neo4j"

"database"

"regularUsers"

"jake"

Rows: 4

 
SHOW USERS jake, joe PRIVILEGES

Lists all privileges for users jake and joe.

Table 17. Result
access action resource graph resource role segment

"GRANTED"

"execute"

"database"

"*"

"FUNCTION(*)"

"PUBLIC"

"jake"

"GRANTED"

"execute"

"database"

"*"

"PROCEDURE(*)"

"PUBLIC"

"jake"

"GRANTED"

"access"

"database"

"DEFAULT"

"database"

"PUBLIC"

"jake"

"GRANTED"

"access"

"database"

"neo4j"

"database"

"regularUsers"

"jake"

"GRANTED"

"execute"

"database"

"*"

"FUNCTION(*)"

"PUBLIC"

"joe"

"GRANTED"

"execute"

"database"

"*"

"PROCEDURE(*)"

"PUBLIC"

"joe"

"GRANTED"

"access"

"database"

"DEFAULT"

"database"

"PUBLIC"

"joe"

"DENIED"

"access"

"database"

"neo4j"

"database"

"noAccessUsers"

"joe"

Rows: 8

The same command can be used at all times to review available privileges for the current user. For this purpose, a shorter form of the the command also exists: SHOW USER PRIVILEGES

SHOW USER PRIVILEGES

As for the other privilege commands, available privileges for users can also be output as Cypher commands with the optional AS COMMAND[S].

When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. This can be used to quickly create new roles based on the privileges of specific users.

 
SHOW USER jake PRIVILEGES AS COMMANDS
Table 18. Result
command

"GRANT ACCESS ON DATABASE neo4j TO $role"

"GRANT ACCESS ON HOME DATABASE TO $role"

"GRANT EXECUTE FUNCTION * ON DBMS TO $role"

"GRANT EXECUTE PROCEDURE * ON DBMS TO $role"

Rows: 4

Like other SHOW commands, the output can also be processed using YIELD / WHERE / RETURN. Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges.

SHOW USER jake PRIVILEGES AS REVOKE COMMANDS WHERE command CONTAINS 'EXECUTE'
Table 19. Result
command

"REVOKE GRANT EXECUTE FUNCTION * ON DBMS FROM $role"

"REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role"

Rows: 2

Revoking privileges

Privileges that were granted or denied earlier can be revoked using the REVOKE command:

REVOKE
    [ GRANT | DENY ] graph-privilege
    FROM role[, ...]

An example usage of the REVOKE command is given here:

REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers

While it can be explicitly specified that revoke should remove a GRANT or DENY, it is also possible to revoke either one by not specifying at all as the next example demonstrates. Because of this, if there happen to be a GRANT and a DENY on the same privilege, it would remove both.

REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers