Neo4j Security Skill

When to Use

• Creating, altering, suspending, or dropping users
• Creating roles, granting/revoking role membership
• Granting/denying/revoking graph, database, or DBMS privileges
• Inspecting current privileges (SHOW PRIVILEGES)
• Implementing property-level access control (read/write per property)
• Setting up ABAC rules against OIDC claims
• Referencing LDAP/SSO auth provider configuration

When NOT to Use

• Writing Cypher queries against application data → neo4j-cypher-skill
• Cluster ops, backups, server config → neo4j-cli-tools-skill
• Driver connection setup → neo4j-driver-*-skill

---

MCP Write Gate — MANDATORY

Before executing ANY of the following, show the planned command and wait for explicit confirmation:

• CREATE USER / ALTER USER / DROP USER
• CREATE ROLE / DROP ROLE
• GRANT / DENY / REVOKE (any privilege)
• CREATE AUTH RULE / DROP AUTH RULE

Never auto-execute privilege changes. Show exact Cypher, annotate impact, get "yes".

---

Execution Context

All security Cypher runs against the system database:

// Neo4j auto-routes CREATE/ALTER/SHOW USER|ROLE|PRIVILEGE to system
// If using cypher-shell: cypher-shell -d system
// If using driver: use database="system"

---

1. User Management

Create user

CREATE USER alice SET PASSWORD 'secret' CHANGE NOT REQUIRED;
// CHANGE REQUIRED (default): forces password change on first login
// CHANGE NOT REQUIRED: password valid immediately
// SET STATUS ACTIVE (default) | SUSPENDED

Parameterised password (preferred in scripts)

CREATE USER $username SET PASSWORD $password CHANGE NOT REQUIRED;

Alter user

ALTER USER alice SET PASSWORD $newPw CHANGE NOT REQUIRED;
ALTER USER alice SET STATUS SUSPENDED;          // lock account
ALTER USER alice SET STATUS ACTIVE;             // unlock
ALTER USER alice SET HOME DATABASE mydb;        // default db on connect
ALTER USER alice IF EXISTS SET PASSWORD $pw;    // safe if missing

Show users

SHOW USERS YIELD username, roles, passwordChangeRequired, suspended, homeDatabase
WHERE suspended = false
RETURN username, roles ORDER BY username;

Drop user

DROP USER alice IF EXISTS;

---

2. Role Management

Create / drop role

CREATE ROLE analyst;
CREATE ROLE analyst IF NOT EXISTS;
DROP ROLE analyst IF EXISTS;

Assign / remove roles

GRANT ROLE analyst TO alice;
GRANT ROLE analyst, writer TO alice, bob;   // bulk
REVOKE ROLE analyst FROM alice;

Inspect roles

SHOW ROLES YIELD role, member ORDER BY role;
SHOW ROLE analyst PRIVILEGES AS COMMANDS;   // returns runnable GRANT commands
SHOW POPULATED ROLES YIELD role;            // only roles with members

---

3. Privilege Decision Table

DENY overrides GRANT

// Analyst can read Person but NOT the ssn property
GRANT MATCH {*} ON GRAPH mydb NODES Person TO analyst;
DENY  READ {ssn} ON GRAPH mydb NODES Person TO analyst;

REVOKE removes a specific grant or deny

REVOKE GRANT READ {email} ON GRAPH mydb NODES Person FROM analyst;
REVOKE DENY  READ {ssn}   ON GRAPH mydb NODES Person FROM analyst;
REVOKE MATCH {*} ON GRAPH mydb NODES Person FROM analyst;  // removes both grant+deny

---

4. Common Role Patterns

Read-only analyst

CREATE ROLE analyst IF NOT EXISTS;
GRANT ACCESS            ON DATABASE mydb TO analyst;
GRANT MATCH {*}         ON GRAPH mydb ELEMENTS * TO analyst;
GRANT EXECUTE PROCEDURE apoc.* TO analyst;

Write role (no admin)

CREATE ROLE writer IF NOT EXISTS;
GRANT ACCESS  ON DATABASE mydb TO writer;
GRANT MATCH {*} ON GRAPH mydb ELEMENTS * TO writer;
GRANT WRITE   ON GRAPH mydb TO writer;

Read-only on specific labels only

CREATE ROLE limited_reader IF NOT EXISTS;
GRANT ACCESS    ON DATABASE mydb TO limited_reader;
GRANT TRAVERSE  ON GRAPH mydb ELEMENTS * TO limited_reader;      // can traverse
GRANT MATCH {*} ON GRAPH mydb NODES Person TO limited_reader;    // Person props visible
GRANT MATCH {*} ON GRAPH mydb NODES Company TO limited_reader;   // Company props visible
// Other labels: traversable but properties invisible

DBA role (full admin)

CREATE ROLE dba IF NOT EXISTS;
GRANT ALL ON DBMS     TO dba;
GRANT ALL ON DATABASE * TO dba;

---

5. Property-Level Access Control (Enterprise)

Restrict read access to individual properties:

// Grant read on all Person props, then deny sensitive ones
GRANT MATCH {*}   ON GRAPH mydb NODES Person TO analyst;
DENY  READ {ssn, dateOfBirth} ON GRAPH mydb NODES Person TO analyst;

Property-based pattern matching (sub-graph access):

// Only see Person nodes where classification = 'public'
GRANT MATCH {*} ON GRAPH mydb
  FOR (n:Person) WHERE n.classification = 'public'
  TO analyst;

// Block access to classified nodes
DENY MATCH {*} ON GRAPH mydb
  FOR (n) WHERE n.classification <> 'UNCLASSIFIED'
  TO regularUsers;

Constraints:

• FOR pattern applies to read privileges only — not write
• Each property-based privilege restricted by a single property
• Performance overhead scales with number of rules; TRAVERSE rules cost more than READ
• Ensure the property used for rules cannot be modified by the restricted role

---

6. ABAC — Attribute-Based Access Control (Enterprise + OIDC)

ABAC grants roles dynamically from JWT/OIDC claims rather than explicit GRANT ROLE ... TO user.

Prerequisites

# neo4j.conf
dbms.security.abac.authorization_providers=<oidc-provider-alias>

Create auth rule

CREATE AUTH RULE salesRule
  SET CONDITION abac.oidc.user_attribute('department') = 'sales';

GRANT ROLE analyst TO AUTH RULE salesRule;

Compound conditions

CREATE OR REPLACE AUTH RULE seniorRule
  SET CONDITION abac.oidc.user_attribute('department') = 'engineering'
    AND abac.oidc.user_attribute('level') >= 5;

GRANT ROLE senior_engineer TO AUTH RULE seniorRule;

Manage auth rules

SHOW AUTH RULES YIELD ruleName, condition, roles;
ALTER AUTH RULE salesRule SET ENABLED false;     // disable without dropping
RENAME AUTH RULE salesRule TO salesDeptRule;
DROP AUTH RULE salesDeptRule;
REVOKE ROLE analyst FROM AUTH RULE salesRule;

Notes:

• Missing claims evaluate to NULL → rule condition false → role not granted
• Rules apply immediately to existing sessions when claims are already loaded
• ABAC works only with OIDC providers (not native or LDAP)

---

7. SHOW PRIVILEGES Patterns

// All privileges in the system
SHOW PRIVILEGES YIELD *;

// Privileges for a specific user (as runnable commands)
SHOW USER alice PRIVILEGES AS COMMANDS;

// Privileges for a specific role
SHOW ROLE analyst PRIVILEGES YIELD privilege, action, resource, graph, segment;

// Find who has access to a database
SHOW PRIVILEGES YIELD *
WHERE graph = 'mydb'
RETURN role, action, resource, segment ORDER BY role;

// Find all DENY rules
SHOW PRIVILEGES YIELD *
WHERE access = 'DENIED'
RETURN role, action, resource, segment;

---

8. Built-in Roles (do not drop)

Assign built-in roles: GRANT ROLE reader TO alice;

---

9. Auth Provider Config Reference (operational — not Cypher)

Native (default)

dbms.security.auth_enabled=true
dbms.security.auth_max_failed_attempts=3    # lockout threshold

LDAP

dbms.security.auth_provider=ldap
dbms.security.ldap.host=ldap://ldap.example.com
dbms.security.ldap.authentication.mechanism=simple
dbms.security.ldap.authentication.user_dn_template=uid={0},ou=users,dc=example,dc=com
dbms.security.ldap.authorization.group_membership_attributes=memberOf
dbms.security.ldap.authorization.group_to_role_mapping=\
  "cn=analysts,ou=groups,dc=example,dc=com" = analyst;\
  "cn=admins,ou=groups,dc=example,dc=com"   = admin

OIDC / SSO (Okta, Auth0, Entra ID)

dbms.security.oidc.<alias>.display_name=Okta
dbms.security.oidc.<alias>.auth_flow=pkce
dbms.security.oidc.<alias>.well_known_discovery_uri=https://example.okta.com/.well-known/openid-configuration
dbms.security.oidc.<alias>.audience=neo4j
dbms.security.oidc.<alias>.claims.username=email
dbms.security.oidc.<alias>.claims.groups=groups
dbms.security.oidc.<alias>.authorization.group_to_role_mapping=\
  "neo4j-analysts" = analyst;\
  "neo4j-admins"   = admin

Config changes require server restart. Roles referenced in mappings must exist in Neo4j (native or created via Cypher).

---

Checklist — New Role Setup

• [ ] Determine required operations: read / write / admin
• [ ] Identify target database(s) and graph scope (all labels vs specific)
• [ ] Identify any properties that must be hidden (→ DENY READ)
• [ ] Create role: CREATE ROLE ... IF NOT EXISTS
• [ ] Grant ACCESS on database
• [ ] Grant MATCH / TRAVERSE / WRITE as needed
• [ ] Apply DENY for restricted properties
• [ ] Run SHOW ROLE ... PRIVILEGES AS COMMANDS to verify
• [ ] Assign to users: GRANT ROLE ... TO ...
• [ ] Test with SHOW USER ... PRIVILEGES AS COMMANDS

Full privilege syntax → references/privilege-reference.md

neo4j-security-skill

Skill for programmatic security management in Neo4j — users, roles, privileges, and auth configuration.

Covers:

• User management: CREATE USER, ALTER USER (password, status, home database), DROP USER, SHOW USERS
• Role management: CREATE ROLE, GRANT ROLE, REVOKE ROLE, DROP ROLE, SHOW ROLES
• Privilege grants: GRANT/DENY/REVOKE for graph, database, and DBMS privileges
• Property-level access control: GRANT READ {prop}, DENY READ {prop} per label/type (Enterprise)
• Sub-graph access control: FOR (n:Label) WHERE n.prop = val pattern restrictions (Enterprise)
• ABAC: CREATE AUTH RULE with OIDC claim conditions → dynamic role assignment (Enterprise)
• SHOW PRIVILEGES: inspection patterns including AS COMMANDS for audit/export
• Auth provider config reference: native, LDAP, OIDC/SSO (operational config — not Cypher)

Edition requirements:

• Basic RBAC: Community and Enterprise
• Property-level, sub-graph, ABAC, LDAP, SSO: Enterprise only

Not covered:

• Writing application Cypher queries → neo4j-cypher-skill
• Cluster ops, backups, neo4j-admin → neo4j-cli-tools-skill
• Driver connection and session management → neo4j-driver-*-skill

References:

• privilege-reference.md — full GRANT/DENY/REVOKE syntax for all privilege types

Install:

npx skills add https://github.com/neo4j-contrib/neo4j-skills --skill neo4j-security-skill

Or paste this link into your coding assistant: https://github.com/neo4j-contrib/neo4j-skills/tree/main/neo4j-security-skill

Neo4j Privilege Reference

Full GRANT / DENY / REVOKE syntax for all privilege types. All commands execute against the system database.

---

General Syntax

{GRANT | DENY} [IMMUTABLE] <privilege>
  ON { GRAPH[S] {* | name[,...]} | DATABASE[S] {* | name[,...]} | HOME GRAPH | DBMS }
  [<entity>]
  TO <role>[,...]

REVOKE [IMMUTABLE] [GRANT | DENY] <privilege>
  ON { GRAPH[S] ... | DATABASE[S] ... | DBMS }
  [<entity>]
  FROM <role>[,...]

IMMUTABLE — privilege cannot be revoked by non-admin users; only admin can remove.

---

Graph Privileges

Entity scope

Read privileges

GRANT TRAVERSE  ON GRAPH mydb NODES Person TO role;          -- can see node, not properties
GRANT READ {*}  ON GRAPH mydb NODES Person TO role;          -- read all properties
GRANT READ {name, email} ON GRAPH mydb NODES Person TO role; -- read specific properties
GRANT MATCH {*} ON GRAPH mydb NODES Person TO role;          -- TRAVERSE + READ combined
GRANT MATCH {*} ON GRAPH mydb ELEMENTS * TO role;            -- all nodes + rels

Write privileges

GRANT WRITE     ON GRAPH mydb TO role;              -- all writes (shorthand)
GRANT CREATE    ON GRAPH mydb NODES Person TO role; -- create Person nodes
GRANT SET PROPERTY {name} ON GRAPH mydb NODES Person TO role;
GRANT MERGE     ON GRAPH mydb NODES Person TO role; -- MERGE statement
GRANT DELETE    ON GRAPH mydb NODES Person TO role;
GRANT SET LABEL Person ON GRAPH mydb TO role;
GRANT REMOVE LABEL Person ON GRAPH mydb TO role;
GRANT CREATE    ON GRAPH mydb RELATIONSHIPS KNOWS TO role;
GRANT DELETE    ON GRAPH mydb RELATIONSHIPS KNOWS TO role;

Property-based (sub-graph) read

// Pattern in FOR clause must have exactly one property condition
GRANT MATCH {*} ON GRAPH mydb
  FOR (n:Document) WHERE n.visibility = 'public'
  TO reader;

DENY MATCH {*} ON GRAPH mydb
  FOR (n) WHERE n.classification <> 'UNCLASSIFIED'
  TO regularUsers;

GRANT READ { address } ON GRAPH *
  FOR (n:Email|Website) WHERE n.domain = 'example.com'
  TO regularUsers;

---

Database Privileges

GRANT ACCESS          ON DATABASE mydb TO role;   -- required for any db connection
GRANT START           ON DATABASE mydb TO role;
GRANT STOP            ON DATABASE mydb TO role;
GRANT CREATE INDEX    ON DATABASE mydb TO role;
GRANT DROP INDEX      ON DATABASE mydb TO role;
GRANT SHOW INDEX      ON DATABASE mydb TO role;
GRANT INDEX           ON DATABASE mydb TO role;   -- CREATE + DROP + SHOW INDEX
GRANT CREATE CONSTRAINT ON DATABASE mydb TO role;
GRANT DROP CONSTRAINT   ON DATABASE mydb TO role;
GRANT SHOW CONSTRAINT   ON DATABASE mydb TO role;
GRANT CONSTRAINT        ON DATABASE mydb TO role; -- CREATE + DROP + SHOW CONSTRAINT
GRANT CREATE NEW ELEMENT TYPES ON DATABASE mydb TO role;  -- new labels/types/props
GRANT NAME MANAGEMENT   ON DATABASE mydb TO role; -- all element type management
GRANT ALL ON DATABASE mydb TO role;               -- all database privileges
GRANT ALL ON DATABASE * TO role;                  -- all databases

---

DBMS Privileges

// User management
GRANT SHOW USER     ON DBMS TO role;
GRANT CREATE USER   ON DBMS TO role;
GRANT SET USER STATUS ON DBMS TO role;
GRANT SET PASSWORDS ON DBMS TO role;
GRANT ALTER USER    ON DBMS TO role;
GRANT DROP USER     ON DBMS TO role;
GRANT USER MANAGEMENT ON DBMS TO role;   -- all user management

// Role management
GRANT SHOW ROLE     ON DBMS TO role;
GRANT CREATE ROLE   ON DBMS TO role;
GRANT RENAME ROLE   ON DBMS TO role;
GRANT DROP ROLE     ON DBMS TO role;
GRANT ASSIGN ROLE   ON DBMS TO role;     -- GRANT ROLE ... TO user
GRANT REMOVE ROLE   ON DBMS TO role;     -- REVOKE ROLE ... FROM user
GRANT ROLE MANAGEMENT ON DBMS TO role;  -- all role management

// Privilege management
GRANT SHOW PRIVILEGE  ON DBMS TO role;
GRANT ASSIGN PRIVILEGE ON DBMS TO role;
GRANT REMOVE PRIVILEGE ON DBMS TO role;
GRANT PRIVILEGE MANAGEMENT ON DBMS TO role; -- all privilege management

// Database management
GRANT CREATE DATABASE ON DBMS TO role;
GRANT DROP DATABASE   ON DBMS TO role;
GRANT ALTER DATABASE  ON DBMS TO role;
GRANT SET DATABASE ACCESS ON DBMS TO role;
GRANT DATABASE MANAGEMENT ON DBMS TO role; -- all database management

// Procedure / function execution
GRANT EXECUTE PROCEDURE apoc.* TO role;
GRANT EXECUTE BOOSTED PROCEDURE apoc.* TO role;  -- elevated mode
GRANT EXECUTE USER DEFINED FUNCTION apoc.* TO role;
GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.* TO role;

// Full DBMS admin
GRANT ALL ON DBMS TO role;

---

REVOKE Variants

// Remove a GRANT
REVOKE GRANT MATCH {*} ON GRAPH mydb NODES Person FROM analyst;

// Remove a DENY
REVOKE DENY READ {ssn} ON GRAPH mydb NODES Person FROM analyst;

// Remove both GRANT and DENY at once
REVOKE MATCH {*} ON GRAPH mydb NODES Person FROM analyst;

In Cypher 25, REVOKE on a non-existent privilege raises an error (was a notification in earlier versions).

---

SHOW PRIVILEGE Commands

SHOW PRIVILEGES YIELD *;
SHOW PRIVILEGES YIELD * WHERE access = 'DENIED';
SHOW PRIVILEGES YIELD * WHERE graph = 'mydb' ORDER BY role;

SHOW USER alice PRIVILEGES;
SHOW USER alice PRIVILEGES AS COMMANDS;       -- returns runnable GRANT statements

SHOW ROLE analyst PRIVILEGES;
SHOW ROLE analyst PRIVILEGES AS COMMANDS;

SHOW ROLE analyst PRIVILEGES YIELD privilege, action, resource, graph, segment
WHERE action = 'read';

---

Access Decision Rules

1. DENY overrides GRANT — user with both gets the DENY. 2. Roles are additive — union of all assigned privileges, minus any DENY. 3. Missing ACCESS ON DATABASE = connection refused regardless of graph privileges. 4. Read restriction makes data invisible (not an error); write restriction returns an error. 5. FOR pattern restrictions apply at query time — every node match is filtered against the condition.

---

Edition Notes