身份验证与授权

When we talk about database security, two key concepts are Authentication and Authorization. While they sound similar, they serve distinct purposes.

Authentication (AuthN) is about verifying who you are. It confirms your identity, typically using a username and password.

Authorization (AuthZ) is about determining what you can do. Once authenticated, the system decides what actions you're permitted to perform.

Neo4j primarily uses native authentication, where user credentials (username and password) are stored and managed directly within the database.

For enterprise setups, Neo4j also supports integration with external authentication systems like LDAP or Kerberos, but for most applications, native authentication is sufficient and simpler to manage.

Upon your first installation and startup of Neo4j, a default administrative user named neo4j is automatically created.

This user has full administrative privileges. It is crucial for security reasons to change the initial password for the neo4j user immediately after setup.

You can change the password for the currently authenticated user using a built-in Cypher procedure. This is essential for managing security.

Try changing the password for the neo4j user. Remember to replace 'your_new_password' with a strong, unique password.

Once a user is authenticated, Neo4j uses authorization to control their access. This is achieved through a system of roles and privileges.

• Roles: Groups of users that share a common set of permissions.
• Privileges: Specific permissions that define what actions can be performed (e.g., read, write, create nodes).

By assigning privileges to roles, and roles to users, you can manage access efficiently.

Neo4j offers granular control over various operations. Here are some common privilege types:

• ACCESS: Allows connection to a specific database.
• READ: Permits reading data (nodes, relationships, properties).
• WRITE: Allows creating, updating, or deleting data.
• SCHEMA: Grants permission to manage schema elements like labels, relationship types, and indexes.
• SHOW: Allows viewing database information and configurations.

Privileges can be scoped to specific graphs, labels, relationship types, or even properties.

The GRANT clause is used to assign privileges to a role. This allows users assigned to that role to perform specific actions.

For example, you might grant a viewer role the ability to read data on specific node labels within your graph.

The DENY clause explicitly forbids a privilege for a role. This is powerful because a DENY privilege always takes precedence over any GRANT privilege for the same action.

This means if a role is granted a privilege but also denied it, the deny will be enforced.

To remove a previously granted or denied privilege from a role, you use the REVOKE clause. This effectively removes the explicit permission or denial.

If a privilege was previously GRANTED and then REVOKED, the role will no longer have that specific permission.

In this lesson, we established the difference between authentication (who you are) and authorization (what you can do) in Neo4j.

You learned about the default neo4j user and the importance of changing its password. We then explored how to manage privileges using GRANT, DENY, and REVOKE clauses to control access for various roles, ensuring your graph data remains secure and accessible only to authorized users.