用户管理与角色

Welcome to securing your Neo4j database! Just like any valuable asset, your graph data needs protection.

This lesson introduces the essential steps to manage who can access and modify your Neo4j database.

Why bother with user management? Imagine a bank vault without proper access control – chaos!

• Security: Prevent unauthorized access.
• Accountability: Track who does what.
• Compliance: Meet regulatory requirements.

It's about making sure only the right people have the right permissions.

These terms are often confused, but they're distinct:

• Authentication (AuthN): Who are you? This verifies a user's identity (e.g., username and password).
• Authorization (AuthZ): What can you do? This determines what actions an authenticated user is allowed to perform.

First, we prove who we are (AuthN), then the system decides what we can do (AuthZ).

When you first install Neo4j, a default administrative user named neo4j is created.

• It has full administrative privileges.
• The initial password is also neo4j.
• Important: Always change this default password immediately after installation for security!

This user is your entry point to managing the database.

To add new individuals or applications to your database, you'll create new user accounts.

Each user needs a unique username and a strong password. This ensures proper authentication before any actions are taken.

Let's see how to do this using Cypher, Neo4j's query language.

The CREATE USER command is straightforward. Remember to choose a secure password!

Try running this example in your Neo4j Browser or cypher-shell:

Passwords should be changed regularly, and users might forget them. Neo4j provides commands to manage user passwords.

• Change your own password: ALTER CURRENT USER SET PASSWORD 'newPassword';
• Change another user's password (admin only): ALTER USER 'alice' SET PASSWORD 'anotherNewPass';

Always use strong, unique passwords!

Roles are collections of privileges that can be assigned to users. Instead of giving individual permissions to each user, you assign them a role.

Neo4j comes with several built-in roles, such as:

• admin: Full administrative access.
• architect: Can create/manage schema (nodes, relationships, properties).
• publisher: Can write data.
• reader: Can only read data.

This simplifies managing permissions across many users.

Once you've created users and understand roles, the next step is to grant specific roles to users. A user can have multiple roles.

Use the GRANT ROLE command to assign roles. To remove a role, use REVOKE ROLE.

Let's grant our new user 'alice' the 'reader' role:

You've learned how to create users and assign roles. Let's test your knowledge!

Great job! In this lesson, we covered the fundamentals of user management and roles in Neo4j:

• The importance of authentication and authorization.
• How to create new users using CREATE USER.
• Managing user passwords with ALTER USER.
• Understanding built-in roles like admin, reader, and publisher.
• Assigning roles to users with GRANT ROLE.

This knowledge is crucial for securing your graph database! Next, we'll dive deeper into defining custom access privileges.