DBMS privileges

In order to have an administrator role with a subset of privileges that includes all DBMS privileges, but not all database privileges, you can copy the admin role and revoke or deny the unwanted privileges. A second option is to build a custom administrator from scratch by granting the wanted privileges instead.

As an example, an administrator role can be created to only manage users and roles by using the second option:

The resulting role has privileges that only allow user and role management. To list all privileges for the role usermanager as commands, run this query:

Note that this role does not allow all DBMS capabilities. For example, the role is missing privileges for management, creation and drop of databases as well as execution of admin procedures. To create a more powerful administrator, you can grant a different set of privileges.

In the following example, a new administrator role is created to perform almost all DBMS capabilities, excluding database management. However, the role still has some limited database capabilities, such as managing transactions:

The resulting role has privileges that include all DBMS privileges except creating, dropping, and modifying databases and aliases, as well as managing transactions. Use the following query to list all privileges for the role customAdministrator as commands:

The DBMS privileges for role management are assignable using Cypher administrative commands. They can be granted, denied, and revoked like other privileges.

The ability to add roles can be granted via the CREATE ROLE privilege. See an example:

The resulting role has privileges that only allow adding roles. List all privileges for the role roleAdder as commands by using the following query:

The ability to rename roles can be granted via the RENAME ROLE privilege. See an example:

The resulting role has privileges that only allow renaming roles. List all privileges for the role roleNameModifier using the following query:

The ability to delete roles can be granted via the DROP ROLE privilege. See an example:

The resulting role has privileges that only allow deleting roles. List all privileges for the role roleDropper by using the following query:

The ability to assign roles to users can be granted via the ASSIGN ROLE privilege. See an example:

The resulting role has privileges that only allow assigning/granting roles. List all privileges for the role roleAssigner as commands by using the following query:

The ability to remove roles from users can be granted via the REMOVE ROLE privilege. See an example:

The resulting role has privileges that only allow removing/revoking roles. List all privileges for the role roleRemover as commands by using the following query:

The ability to show roles can be granted via the SHOW ROLE privilege. A role with this privilege is allowed to execute the SHOW ROLES and SHOW POPULATED ROLES administration commands. For the SHOW ROLES WITH USERS and SHOW POPULATED ROLES WITH USERS administration commands, both this privilege and the SHOW USER privilege are required. The following query shows an example of how to grant the SHOW ROLE privilege:

In order to use SHOW ROLES WITH USERS and SHOW POPULATED ROLES WITH USERS administration commands, both the SHOW ROLE and the SHOW USER privileges are required. See an example of how to grant the SHOW ROLE privilege:

The resulting role has privileges that only allow showing roles. List all privileges for the role roleShower as commands by using the following query:

The privileges to create, rename, delete, assign, remove, and list roles can be granted via the ROLE MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage roles. List all privileges for the role roleManager as commands by using the following query:

The DBMS privileges for user management can be assigned using Cypher administrative commands. They can be granted, denied, and revoked like other privileges.

The ability to add users can be granted via the CREATE USER privilege. See an example:

The resulting role has privileges that only allow adding users. List all privileges for the role userAdder as commands by using this query:

The ability to rename users can be granted via the RENAME USER privilege. The following query shows an example of this:

The resulting role has privileges that only allow renaming users:

Lists all privileges for role userNameModifier:

The ability to modify users can be granted via the ALTER USER privilege. See an example:

The resulting role has privileges that only allow modifying users. List all privileges for the role userModifier as commands by using the following query:

A user that is granted the ALTER USER privilege is allowed to run the ALTER USER administration command with one or several of the SET PASSWORD, SET PASSWORD CHANGE [NOT] REQUIRED, SET AUTH, REMOVE AUTH and SET STATUS parts:

The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the SET PASSWORDS privilege. See an example:

The resulting role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login. List all privileges for the role passwordModifier as commands by using the following query:

A user that is granted the SET PASSWORDS privilege is allowed to run the ALTER USER administration command with one or both of the SET PASSWORD and SET PASSWORD CHANGE [NOT] REQUIRED parts:

Introduced in 5.24 A user that is granted the SET AUTH privilege is allowed to run the ALTER USER administration command with one or both of the SET AUTH and REMOVE AUTH parts:

The ability to modify the account status of users can be granted via the SET USER STATUS privilege. See an example:

The resulting role has privileges that only allow modifying the account status of users. List all privileges for the role statusModifier as commands by using the following query:

A user that is granted the SET USER STATUS privilege is allowed to run the ALTER USER administration command with only the SET STATUS part:

In order to be able to modify the home database of users, grant the SET USER HOME DATABASE privilege. See an example:

The resulting role has privileges that only allow modifying the home database of users. List all privileges for the role statusModifier as commands by using the following query:

A user that is granted the SET USER HOME DATABASE privilege is allowed to run the ALTER USER administration command with only the SET HOME DATABASE or REMOVE HOME DATABASE part:

The ability to delete users can be granted via the DROP USER privilege. See an example:

The resulting role has privileges that only allow deleting users. List all privileges for the role userDropper as commands by using the following query:

The ability to show users can be granted via the SHOW USER privilege. See an example:

The resulting role has privileges that only allow showing users. List all privileges for the role userShower as commands by using the following query:

The privileges to create, rename, modify, delete, and list users can be granted via the USER MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage users. List all privileges for the role userManager as commands by using the following query:

The DBMS privileges for impersonation can be assigned through Cypher administrative commands. They can be granted, denied, and revoked like other privileges.

Impersonation is the ability of a user to assume another user’s roles (and therefore privileges), with the restriction of not being able to execute updating admin commands as the impersonated user (i.e. they would still be able to use SHOW commands).

The ability to impersonate users can be granted via the IMPERSONATE privilege.

The following query shows an example of this. Note that userImpersonator must be an existing role in order to make this query work:

The resulting role has privileges that allow impersonating all users:

It is also possible to deny and revoke that privilege. See an example which shows of how the userImpersonator user would be able to impersonate all users, except alice:

To grant (or revoke) the permissions to impersonate a specific user or a subset of users, you can first list them with this query:

The DBMS privileges for database management can be assigned by using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to create standard databases and aliases can be granted via the CREATE DATABASE privilege. See an example:

The resulting role has privileges that only allow creating standard databases and aliases. List all privileges for the role databaseAdder as commands by using the following query:

The ability to create composite databases can be granted via the CREATE COMPOSITE DATABASE privilege. See an example:

The resulting role has privileges that only allow creating composite databases. List all privileges for the role compositeDatabaseAdder as commands by using the following query:

The ability to delete standard databases and aliases can be granted via the DROP DATABASE privilege. See an example:

The resulting role has privileges that only allow deleting standard databases and aliases. List all privileges for the role databaseDropper as commands by using the following query:

The ability to delete composite databases can be granted via the DROP COMPOSITE DATABASE privilege. See an example:

The resulting role has privileges that only allow deleting composite databases. List all privileges for the role compositeDatabaseDropper as commands by using the following query:

The ability to modify standard databases and aliases can be granted via the ALTER DATABASE privilege. See an example:

The resulting role has privileges that only allow modifying standard databases and aliases. List all privileges for the role databaseModifier as commands by using the following query:

The ability to modify access to standard databases can be granted via the SET DATABASE ACCESS privilege. See an example:

The resulting role has privileges that only allow modifying access to standard databases. List all privileges for the role accessModifier as commands by using the following query:

The ability to create and delete composite databases can be granted via the COMPOSITE DATABASE MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage composite databases. List all privileges for the role compositeDatabaseManager as commands by using the following query:

The ability to create, delete, and modify databases and aliases can be granted via the DATABASE MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage standard and composite databases as well as aliases. List all privileges for the role databaseManager as commands by using the following query:

The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases. They can be granted, denied and revoked like other privileges. It is also possible to manage aliases with database management commands.

The ability to create aliases can be granted via the CREATE ALIAS privilege. See an example:

The resulting role has privileges that only allow creating aliases. List all privileges for the role aliasAdder as commands by using the following query:

The ability to delete aliases can be granted via the DROP ALIAS privilege. See an example:

The resulting role has privileges that only allow deleting aliases. See all privileges for the role aliasDropper as commands by using the following query:

The ability to modify aliases can be granted via the ALTER ALIAS privilege. See an example:

The resulting role has privileges that only allow modifying aliases. List all privileges for the role aliasModifier as commands by using the following query:

The ability to list aliases can be granted via the SHOW ALIAS privilege. See an example:

The resulting role has privileges that only allow modifying aliases. List all privileges for the role aliasLister as commands by using the following query:

The privileges to list, create, delete, and modify aliases can be granted via the ALIAS MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage aliases. List all privileges for the role aliasManager as commands by using the following query:

The DBMS privileges for server management can be assigned using Cypher administrative commands. They can be granted, denied, and revoked like other privileges.

The DBMS privileges for privilege management can be assigned by using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The ability to list privileges can be granted via the SHOW PRIVILEGE privilege.

A user with this privilege is allowed to execute the SHOW PRIVILEGES and SHOW ROLE roleName PRIVILEGES administration commands. To execute the SHOW USER username PRIVILEGES administration command, both this privilege and the SHOW USER privilege are required. The following query shows an example of how to grant the SHOW PRIVILEGE privilege:

The resulting role has privileges that only allow showing privileges. List all privileges for the role privilegeShower as commands by using the following query:

The ability to assign privileges to roles can be granted via the ASSIGN PRIVILEGE privilege. A user with this privilege is allowed to execute GRANT and DENY administration commands. See an example of how to grant this privilege:

The resulting role has privileges that only allow assigning privileges. List all privileges for the role privilegeAssigner as commands by using the following query:

The ability to remove privileges from roles can be granted via the REMOVE PRIVILEGE privilege.

A user with this privilege is allowed to execute REVOKE administration commands. See an example of how to grant this privilege:

The resulting role has privileges that only allow removing privileges. List all privileges for the role privilegeRemover as commands by using the following query:

The privileges to list, assign, and remove privileges can be granted via the PRIVILEGE MANAGEMENT privilege. See an example:

The resulting role has all privileges to manage privileges. List all privileges for the role privilegeManager as commands by using the following query:

The DBMS privileges for procedure and user-defined function execution can be assigned by using Cypher administrative commands. They can be granted, denied and revoked like other privileges.

The right to perform the following privileges can be achieved with a single command:

For example, to grant the role dbmsManager the abilities above, use the following query:

The privileges granted can be seen using the SHOW PRIVILEGES command:

The name-globbing for procedures, user-defined functions, and setting names is a simplified version of globbing for filename expansions. It only allows two wildcard characters: * and ?, which are used for multiple and single-character matches. In this case, * means 0 or more characters, and ? matches exactly one character.

Given the following list of procedures:

The following examples demonstrate how name-globbing patterns can be used in controlling access to procedures. Note that the same rules apply to user-defined functions and settings.

Users with the role globbing1 can run all the procedures.

Users with the role globbing2 can run procedures mine.public.exampleProcedure and mine.private.exampleProcedure, but no other procedures.

Users with the role globbing3 can run procedures mine.public.exampleProcedure1, mine.private.exampleProcedure1, and mine.private.exampleProcedure2, but no other procedures.

Users with the role globbing4 can run procedures your.exampleProcedure, mine.public.exampleProcedure, and mine.private.exampleProcedure, but no other procedures.

Users with the role globbing5 can run procedures mine.public.exampleProcedure, mine.public.exampleProcedure1 and mine.public.exampleProcedure42, but no other procedures.

Users with the role globbing6 can run procedures mine.public.with#Special§Characters, and mine.private.with#Special§Characters, but no other procedures.