diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc
index 08dc1518c..6398e5afe 100644
--- a/modules/ROOT/content-nav.adoc
+++ b/modules/ROOT/content-nav.adoc
@@ -78,6 +78,7 @@
** xref:configuration/file-locations.adoc[]
//** xref:configuration/network-architecture.adoc[]
** xref:configuration/ports.adoc[]
+** xref:configuration/cypher-version-configuration.adoc[]
** xref:configuration/connectors.adoc[]
** xref:configuration/set-initial-password.adoc[]
** xref:configuration/neo4j-admin-memrec.adoc[]
@@ -116,6 +117,7 @@
*** xref:database-administration/standard-databases/seed-from-uri.adoc[]
*** xref:database-administration/standard-databases/listing-databases.adoc[]
*** xref:database-administration/standard-databases/alter-databases.adoc[]
+*** xref:database-administration/standard-databases/start-stop-databases.adoc[]
*** xref:database-administration/standard-databases/recreate-database.adoc[]
*** xref:database-administration/standard-databases/delete-databases.adoc[]
*** xref:database-administration/standard-databases/migrate-database.adoc[]
@@ -132,6 +134,8 @@
*** xref:database-administration/composite-databases/concepts.adoc[]
*** xref:database-administration/composite-databases/create-composite-databases.adoc[]
*** xref:database-administration/composite-databases/list-composite-databases.adoc[]
+*** xref:database-administration/composite-databases/alter-composite-databases.adoc[]
+*** xref:database-administration/composite-databases/start-stop-composite-databases.adoc[]
*** xref:database-administration/composite-databases/delete-composite-databases.adoc[]
*** xref:database-administration/composite-databases/querying-composite-databases.adoc[]
*** xref:database-administration/composite-databases/sharding-with-copy.adoc[]
diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
index 3d08de6ec..04def26cd 100644
--- a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
+++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
@@ -1,142 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/images/privileges_hierarchy_dbms.svg b/modules/ROOT/images/privileges_hierarchy_dbms.svg
index 77c37a377..1f7f0057d 100644
--- a/modules/ROOT/images/privileges_hierarchy_dbms.svg
+++ b/modules/ROOT/images/privileges_hierarchy_dbms.svg
@@ -1,750 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 0d3b6db31..80f0b6efa 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -9,31 +9,36 @@ CREATE ROLE roleNameModifier IF NOT EXISTS;
CREATE ROLE roleDropper IF NOT EXISTS;
CREATE ROLE roleAssigner IF NOT EXISTS;
CREATE ROLE roleRemover IF NOT EXISTS;
-CREATE ROLE roleShower IF NOT EXISTS;
+CREATE ROLE roleViewer IF NOT EXISTS;
CREATE ROLE roleManager IF NOT EXISTS;
CREATE ROLE userAdder IF NOT EXISTS;
CREATE ROLE userNameModifier IF NOT EXISTS;
CREATE ROLE userModifier IF NOT EXISTS;
-CREATE ROLE passwordModifier IF NOT EXISTS;
-CREATE ROLE statusModifier IF NOT EXISTS;
CREATE ROLE userDropper IF NOT EXISTS;
-CREATE ROLE userShower IF NOT EXISTS;
+CREATE ROLE userViewer IF NOT EXISTS;
CREATE ROLE userManager IF NOT EXISTS;
CREATE ROLE userImpersonator IF NOT EXISTS;
+CREATE ROLE allUserImpersonator IF NOT EXISTS;
+CREATE ROLE authModifier IF NOT EXISTS;
+CREATE ROLE passwordModifier IF NOT EXISTS;
+CREATE ROLE statusModifier IF NOT EXISTS;
+CREATE ROLE homeDbModifier IF NOT EXISTS;
CREATE ROLE databaseAdder IF NOT EXISTS;
CREATE ROLE compositeDatabaseAdder IF NOT EXISTS;
CREATE ROLE databaseDropper IF NOT EXISTS;
CREATE ROLE compositeDatabaseDropper IF NOT EXISTS;
CREATE ROLE databaseModifier IF NOT EXISTS;
CREATE ROLE accessModifier IF NOT EXISTS;
+CREATE ROLE languageModifier IF NOT EXISTS;
+CREATE ROLE compositeDatabaseModifier IF NOT EXISTS;
CREATE ROLE compositeDatabaseManager IF NOT EXISTS;
CREATE ROLE databaseManager IF NOT EXISTS;
CREATE ROLE aliasAdder IF NOT EXISTS;
CREATE ROLE aliasDropper IF NOT EXISTS;
CREATE ROLE aliasModifier IF NOT EXISTS;
-CREATE ROLE aliasLister IF NOT EXISTS;
+CREATE ROLE aliasViewer IF NOT EXISTS;
CREATE ROLE aliasManager IF NOT EXISTS;
-CREATE ROLE privilegeShower IF NOT EXISTS;
+CREATE ROLE privilegeViewer IF NOT EXISTS;
CREATE ROLE privilegeAssigner IF NOT EXISTS;
CREATE ROLE privilegeRemover IF NOT EXISTS;
CREATE ROLE privilegeManager IF NOT EXISTS;
@@ -57,6 +62,8 @@ CREATE ROLE globbing6 IF NOT EXISTS;
CREATE ROLE dbmsManager IF NOT EXISTS;
CREATE ROLE configurationViewer IF NOT EXISTS;
CREATE ROLE deniedConfigurationViewer IF NOT EXISTS;
+CREATE ROLE serverManager IF NOT EXISTS;
+CREATE ROLE serverViewer IF NOT EXISTS;
----
////
@@ -67,119 +74,129 @@ All DBMS privileges are relevant system-wide.
Like user management, they do not belong to one specific database or graph.
For more details on the differences between graphs, databases, and the DBMS, refer to link:{neo4j-docs-base-uri}/cypher-manual/current/introduction/cypher_neo4j/[Cypher Manual -> Cypher and Neo4j].
-image::privileges_grant_and_deny_syntax_dbms_privileges.svg[title="Syntax of GRANT and DENY DBMS Privileges"]
+image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="Syntax of GRANT and DENY DBMS privileges"]
+
+image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarchy"]
+
+[NOTE]
+====
+You can only grant, deny, or revoke privileges to or from existing roles.
+====
+
+== The `admin` role privileges
-image::privileges_hierarchy_dbms.svg[title="DBMS privileges hierarchy"]
+The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] role is a built-in superuser role that has all privileges on the DBMS and can perform all administrative tasks.
-The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges.
-These include:
+This includes the following tasks and their relevant privileges:
-* Create, delete, and modify databases and aliases.
+* Create, delete, and modify <> and <>.
* Change configuration parameters.
-* Manage transactions.
-* Manage users and roles.
-* Manage sub-graph privileges.
-* Manage procedure security.
-* Load data.
+* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
+* Manage <> and <>.
+* Manage <>.
+* Manage xref:authentication-authorization/privileges-reads.adoc[read] and xref:authentication-authorization/privileges-writes.adoc[write] sub-graph privileges.
+* Manage <>.
+* Manage <>.
+* Manage <>.
To enable a user to perform these tasks, you can grant them the `admin` role, but it is also possible to make a custom role with a subset of these privileges.
All privileges are also assignable using Cypher commands.
-For more details, see the following sections:
-
-* <>
-* <>
-* <>
-* <>
-* <>
-* <>
-* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Transaction management]
-* <>
-* xref:authentication-authorization/load-privileges.adoc[Load privileges]
+
+The following sections describe the privileges that are available for DBMS administration and show some examples of how to use Cypher commands to manage them.
[[access-control-dbms-administration-custom]]
== Using a custom role to manage DBMS privileges
-In order to have an administrator role with a subset of privileges that includes all DBMS privileges, but not all database privileges, you can copy the `admin` role and revoke or deny the unwanted privileges.
-A second option is to build a custom administrator from scratch by granting the wanted privileges instead.
+You can create a custom role to manage DBMS privileges by granting the privileges you want to the role.
+Alternatively, you can copy the `admin` role and revoke or deny the unwanted privileges.
+The following examples show how to create a custom role with a subset of the privileges that the `admin` role using both methods.
+
+=== Create a custom administrator role from scratch
-As an example, an administrator role can be created to only manage users and roles by using the second option:
+Create an administrator role that can only manage users and roles by creating a new role and granting the `USER MANAGEMENT` and `ROLE MANAGEMENT` privileges.
-. First, create the new role:
+. Create the new role:
+
[source, cypher, role=noplay]
----
-CREATE ROLE usermanager
+CREATE ROLE userAndRoleAdministrator;
----
-. Then grant the privilege to manage users:
+. Grant the privilege to manage users:
+
[source, cypher, role=noplay]
----
-GRANT USER MANAGEMENT ON DBMS TO usermanager
+GRANT USER MANAGEMENT ON DBMS TO userAndRoleAdministrator;
----
-. And to manage roles:
+. Grant the privilege to manage roles:
+
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO usermanager
+GRANT ROLE MANAGEMENT ON DBMS TO userAndRoleAdministrator;
----
-
-The resulting role has privileges that only allow user and role management.
-To list all privileges for the role `usermanager` as commands, run this query:
-
++
+As a result, the `userAndRoleAdministrator` role has privileges that only allow user and role management.
+. To list all privileges for the role `userAndRoleAdministrator` as commands, use the following query:
++
[source, cypher, role=noplay]
----
-SHOW ROLE usermanager PRIVILEGES AS COMMANDS
+SHOW ROLE userAndRoleAdministrator PRIVILEGES AS COMMANDS;
----
-
++
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT ROLE MANAGEMENT ON DBMS TO `usermanager`"
-|"GRANT USER MANAGEMENT ON DBMS TO `usermanager`"
+|"GRANT ROLE MANAGEMENT ON DBMS TO `userAndRoleAdministrator`"
+|"GRANT USER MANAGEMENT ON DBMS TO `userAndRoleAdministrator`"
a|Rows: 2
|===
-Note that this role does not allow all DBMS capabilities.
-For example, the role is missing privileges for management, creation and drop of databases as well as execution of `admin` procedures.
+[NOTE]
+====
+This role does not allow all DBMS capabilities.
+For example, the role is missing privileges for managing, creating, and dropping databases, as well as executing `admin` procedures.
To create a more powerful administrator, you can grant a different set of privileges.
+====
+
+=== Create a more powerful custom administrator role from scratch
-In the following example, a new administrator role is created to perform almost all DBMS capabilities, excluding database management.
-However, the role still has some limited database capabilities, such as managing transactions:
+You can also create a custom administrator role with limited capabilities.
+This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting additional privileges you want to include.
+For example, you can create a custom administrator role `customAdministrator` that has all DBMS privileges except for creating, dropping, and modifying databases, and also has the privilege for managing transactions.
-. Again, start by creating a new role:
+. Create a new role:
+
[source, cypher, role=noplay]
----
-CREATE ROLE customAdministrator
+CREATE ROLE customAdministrator;
----
-. Then grant the privilege for all DBMS capabilities:
+. Grant the privilege for all DBMS capabilities:
+
[source, cypher, role=noplay]
----
-GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator
+GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator;
----
-. And explicitly deny the privilege to manage databases:
+. Explicitly deny the privilege to manage databases:
+
[source, cypher, role=noplay]
----
-DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator
+DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator;
----
-. Next, grant the transaction management privilege:
+. Grant the transaction management privilege:
+
[source, cypher, role=noplay]
----
-GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator
+GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator;
----
-
-The resulting role has privileges that include all DBMS privileges except creating, dropping, and modifying databases, as well as managing transactions.
-Use the following query to list all privileges for the role `customAdministrator` as commands:
-
++
+As a result, the `customAdministrator` role has privileges that include managing transactions and all DBMS privileges except creating, dropping, and modifying databases.
+. To list all privileges for the role `customAdministrator` as commands, use the following query:
++
[source, cypher, role=noplay]
----
-SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
+SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS;
----
-
++
.Result
[options="header,footer", width="100%", cols="m"]
|===
@@ -190,16 +207,79 @@ SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
a|Rows: 3
|===
+=== Create a custom administrator role by copying the `admin` role
+
+You can also create a custom administrator role by copying the `admin` role and then revoking or denying the privileges you do not want.
+For example, you can create a new role called `newAdministrator` that has all the privileges of the `admin` role, and then revoke the ability to read/write/load data, manage constraints, indexes, name, and remove ability to access all databases, except the `system` database.
+
+. Create a new role by copying the `admin` role:
++
+[source, cypher, role=noplay]
+----
+CREATE ROLE newAdministrator AS COPY OF admin;
+----
+
+. Revoke the ability to read/write/load data:
++
+[source, cypher, role=noplay]
+----
+REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM newAdministrator;
+REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM newAdministrator;
+REVOKE GRANT WRITE ON GRAPH * FROM newAdministrator;
+REVOKE GRANT LOAD ON ALL DATA FROM newAdministrator;
+----
+
+. Revoke the ability to manage index/constraint/name:
++
+[source, cypher, role=noplay]
+----
+REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT SHOW INDEX ON DATABASE * FROM newAdministrator;
+----
+
+. Revoke the ability to access all databases:
++
+[source, cypher, role=noplay]
+----
+REVOKE GRANT ACCESS ON DATABASE * FROM newAdministrator;
+----
+. Grant the ability to access the `system` database:
++
+[source, cypher, role=noplay]
+----
+GRANT ACCESS ON DATABASE system TO newAdministrator;
+----
+
+. To list all privileges for the role `newAdministrator` as commands, use the following query:
++
+[source, cypher, role=noplay]
+----
+SHOW ROLE newAdministrator PRIVILEGES AS COMMANDS;
+----
++
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+| "GRANT ACCESS ON DATABASE `system` TO `newAdministrator`"
+| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `newAdministrator`"
+| "GRANT START ON DATABASE * TO `newAdministrator`"
+| "GRANT STOP ON DATABASE * TO `newAdministrator`"
+| "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `newAdministrator`"
+a|Rows: 5
+|===
[[access-control-dbms-administration-role-management]]
== The DBMS `ROLE MANAGEMENT` privileges
-The DBMS privileges for role management are assignable using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for role management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Role management privileges command syntax
@@ -251,20 +331,22 @@ GRANT [IMMUTABLE] ROLE MANAGEMENT
|===
-The ability to add roles can be granted via the `CREATE ROLE` privilege.
-See an example:
+=== Grant privilege to create roles
+
+You can grant the privilege to add roles using the `CREATE ROLE` command. +
+For example:
[source, cypher, role=noplay]
----
-GRANT CREATE ROLE ON DBMS TO roleAdder
+GRANT CREATE ROLE ON DBMS TO roleAdder;
----
-The resulting role has privileges that only allow adding roles.
-List all privileges for the role `roleAdder` as commands by using the following query:
+As a result, the `roleAdder` role has privileges that only allow adding roles.
+To list all privileges for the role `roleAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleAdder PRIVILEGES AS COMMANDS
+SHOW ROLE roleAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -275,20 +357,22 @@ SHOW ROLE roleAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to rename roles can be granted via the `RENAME ROLE` privilege.
-See an example:
+=== Grant privilege to rename roles
+
+You can grant the privilege to rename roles using the `RENAME ROLE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT RENAME ROLE ON DBMS TO roleNameModifier
+GRANT RENAME ROLE ON DBMS TO roleNameModifier;
----
-The resulting role has privileges that only allow renaming roles.
-List all privileges for the role `roleNameModifier` using the following query:
+As a result, the `roleNameModifier` role has privileges that only allow renaming roles.
+To list all privileges for the role `roleNameModifier`, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS
+SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -299,20 +383,22 @@ SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete roles can be granted via the `DROP ROLE` privilege.
-See an example:
+=== Grant privilege to delete roles
+
+You can grant the privilege to delete roles using the `DROP ROLE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT DROP ROLE ON DBMS TO roleDropper
+GRANT DROP ROLE ON DBMS TO roleDropper;
----
-The resulting role has privileges that only allow deleting roles.
-List all privileges for the role `roleDropper` by using the following query:
+As a result, the `roleDropper` role has privileges that only allow deleting roles.
+To list all privileges for the role `roleDropper`, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleDropper PRIVILEGES AS COMMANDS
+SHOW ROLE roleDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -323,20 +409,22 @@ SHOW ROLE roleDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to assign roles to users can be granted via the `ASSIGN ROLE` privilege.
-See an example:
+=== Grant privilege to assign roles
+
+You can grant the privilege to assign roles to users using the `ASSIGN ROLE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ASSIGN ROLE ON DBMS TO roleAssigner
+GRANT ASSIGN ROLE ON DBMS TO roleAssigner;
----
-The resulting role has privileges that only allow assigning/granting roles.
-List all privileges for the role `roleAssigner` as commands by using the following query:
+As a result, the `roleAssigner` role has privileges that only allow assigning/granting roles.
+To list all privileges for the role `roleAssigner` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS
+SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS;
----
.Result
@@ -347,20 +435,22 @@ SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to remove roles from users can be granted via the `REMOVE ROLE` privilege.
-See an example:
+=== Grant privilege to remove roles
+
+You can grant the privilege to remove roles from users using the `REMOVE ROLE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT REMOVE ROLE ON DBMS TO roleRemover
+GRANT REMOVE ROLE ON DBMS TO roleRemover;
----
-The resulting role has privileges that only allow removing/revoking roles.
-List all privileges for the role `roleRemover` as commands by using the following query:
+As a result, the `roleRemover` role has privileges that only allow removing/revoking roles.
+To list all privileges for the role `roleRemover` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleRemover PRIVILEGES AS COMMANDS
+SHOW ROLE roleRemover PRIVILEGES AS COMMANDS;
----
.Result
@@ -371,49 +461,55 @@ SHOW ROLE roleRemover PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to show roles can be granted via the `SHOW ROLE` privilege.
+=== Grant privilege to show roles
+
+You can grant the privilege to show roles using the `SHOW ROLE` privilege.
A role with this privilege is allowed to execute the `SHOW ROLES` and `SHOW POPULATED ROLES` administration commands.
-For the `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both this privilege and the `SHOW USER` privilege are required.
-The following query shows an example of how to grant the `SHOW ROLE` privilege:
+[NOTE]
+====
In order to use `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both the `SHOW ROLE` and the `SHOW USER` privileges are required.
-See an example of how to grant the `SHOW ROLE` privilege:
+====
+
+The following query shows an example of how to grant the `SHOW ROLE` privilege:
[source, cypher, role=noplay]
----
-GRANT SHOW ROLE ON DBMS TO roleShower
+GRANT SHOW ROLE ON DBMS TO roleViewer;
----
-The resulting role has privileges that only allow showing roles.
-List all privileges for the role `roleShower` as commands by using the following query:
+As a result, the `roleViewer` role has privileges that only allow showing roles.
+To list all privileges for the role `roleViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleShower PRIVILEGES AS COMMANDS
+SHOW ROLE roleViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW ROLE ON DBMS TO `roleShower`"
+|"GRANT SHOW ROLE ON DBMS TO `roleViewer`"
a|Rows: 1
|===
-The privileges to create, rename, delete, assign, remove, and list roles can be granted via the `ROLE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage roles
+
+You can grant the privilege to create, rename, delete, assign, remove, and list roles using the `ROLE MANAGEMENT` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO roleManager
+GRANT ROLE MANAGEMENT ON DBMS TO roleManager;
----
-The resulting role has all privileges to manage roles.
-List all privileges for the role `roleManager` as commands by using the following query:
+As a result, the `roleManager` role has all privileges to manage roles.
+To list all privileges for the role `roleManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleManager PRIVILEGES AS COMMANDS
+SHOW ROLE roleManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -428,12 +524,11 @@ a|Rows: 1
[[access-control-dbms-administration-user-management]]
== The DBMS `USER MANAGEMENT` privileges
-The DBMS privileges for user management can be assigned using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for user management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.User management privileges command syntax
@@ -503,20 +598,22 @@ GRANT [IMMUTABLE] USER MANAGEMENT
|===
-The ability to add users can be granted via the `CREATE USER` privilege.
-See an example:
+=== Grant privilege to create users
+
+You can grant the privilege to add users using the `CREATE USER` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE USER ON DBMS TO userAdder
----
-The resulting role has privileges that only allow adding users.
-List all privileges for the role `userAdder` as commands by using this query:
+As a result, the `userAdder` role has privileges that only allow adding users.
+To list all privileges for the role `userAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userAdder PRIVILEGES AS COMMANDS
+SHOW ROLE userAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -527,23 +624,24 @@ SHOW ROLE userAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to rename users can be granted via the `RENAME USER` privilege.
-The following query shows an example of this:
+=== Grant privilege to rename users
+
+You can grant the privilege to rename users using the `RENAME USER` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT RENAME USER ON DBMS TO userNameModifier
----
-The resulting role has privileges that only allow renaming users:
+As a result, the `userNameModifier` role has privileges that only allow renaming users.
+To list all privileges for the role `userNameModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS
+SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS;
----
-Lists all privileges for role `userNameModifier`:
-
.Result
[options="header,footer", width="100%", cols="m"]
|===
@@ -552,20 +650,22 @@ Lists all privileges for role `userNameModifier`:
a|Rows: 1
|===
-The ability to modify users can be granted via the `ALTER USER` privilege.
-See an example:
+=== Grant privilege to modify users
+
+You can grant the privilege to modify users using the `ALTER USER` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT ALTER USER ON DBMS TO userModifier
----
-The resulting role has privileges that only allow modifying users.
-List all privileges for the role `userModifier` as commands by using the following query:
+As a result, the `userModifier` role has privileges that only allow modifying users.
+To list all privileges for the role `userModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userModifier PRIVILEGES AS COMMANDS
+SHOW ROLE userModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -576,27 +676,36 @@ SHOW ROLE userModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts:
+
+The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH`, `SET STATUS`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts. +
+For example:
[source, cypher, role=noplay]
----
ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED
----
-The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the `SET PASSWORDS` privilege.
-See an example:
+[NOTE]
+====
+Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and `SET USER HOME DATABASE` privileges is equivalent to the `ALTER USER` privilege.
+====
+
+=== Grant privilege to modify users' passwords
+
+You can grant the privilege to modify users' passwords and whether those passwords must be changed upon first login using the `SET PASSWORDS` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT SET PASSWORDS ON DBMS TO passwordModifier
----
-The resulting role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login.
-List all privileges for the role `passwordModifier` as commands by using the following query:
+As a result, the `passwordModifier` role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login.
+To list all privileges for the role `passwordModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
+SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -607,35 +716,49 @@ SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts:
+The `SET PASSWORDS` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
[source, cypher, role=noplay]
----
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
----
-A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
+=== Grant privilege to modify users' auth information
+
+You can grant the privilege to modify users' auth information using the `SET AUTH` privilege. +
+For example:
[source, cypher, role=noplay]
----
-ALTER USER jake REMOVE AUTH 'native SET AUTH 'oidc-okta' { SET id 'jakesUniqueOktaUserId' }
+GRANT SET AUTH ON DBMS TO authModifier
----
+As a result, the `authModifier` role has privileges that only allow modifying users' auth information.
+The `SET AUTH` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET
+AUTH` and `REMOVE AUTH` parts. +
+For example:
-The ability to modify the account status of users can be granted via the `SET USER STATUS` privilege.
-See an example:
+[source, cypher, role=noplay]
+----
+ALTER USER jake REMOVE AUTH 'native' SET AUTH 'oidc-okta' { SET id 'jakesUniqueOktaUserId' }
+----
+
+=== Grant privilege to modify the account status of users
+
+You can grant the privilege to modify the account status of users using the `SET USER STATUS` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT SET USER STATUS ON DBMS TO statusModifier
----
-The resulting role has privileges that only allow modifying the account status of users.
-List all privileges for the role `statusModifier` as commands by using the following query:
+As a result, the `statusModifier` role has privileges that only allow modifying the account status of users.
+To list all privileges for the role `statusModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
+SHOW ROLE statusModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -646,39 +769,41 @@ SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `SET USER STATUS` privilege is allowed to run the `ALTER USER` administration command with only the `SET STATUS` part:
+The `SET USER STATUS` privilege allows the user to run the `ALTER USER` administration command with only the `SET STATUS` part:
[source, cypher, role=noplay]
----
ALTER USER jake SET STATUS ACTIVE
----
-In order to be able to modify the home database of users, grant the `SET USER HOME DATABASE` privilege.
-See an example:
+=== Grant privilege to modify the home database of users
+
+You can grant the privilege to modify the home database of users using the `SET USER HOME DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT SET USER HOME DATABASE ON DBMS TO statusModifier
+GRANT SET USER HOME DATABASE ON DBMS TO homeDbModifier
----
-The resulting role has privileges that only allow modifying the home database of users.
-List all privileges for the role `statusModifier` as commands by using the following query:
+As a result, the `homeDbModifier` role has privileges that only allow modifying the home database of users.
+To list all privileges for the role `homeDbModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
+SHOW ROLE homeDbModifier PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SET USER HOME DATABASE ON DBMS TO `statusModifier`"
-|"GRANT SET USER STATUS ON DBMS TO `statusModifier`"
+|"GRANT SET USER HOME DATABASE ON DBMS TO `homeDbModifier`"
+|"GRANT SET USER STATUS ON DBMS TO `homeDbModifier`"
a|Rows: 2
|===
-A user that is granted the `SET USER HOME DATABASE` privilege is allowed to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
+The `SET USER HOME DATABASE` privilege allows the user to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
[source, cypher, role=noplay]
----
@@ -690,25 +815,22 @@ ALTER USER jake SET HOME DATABASE otherDb
ALTER USER jake REMOVE HOME DATABASE
----
-[NOTE]
-====
-Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
-====
+=== Grant privilege to delete users
-The ability to delete users can be granted via the `DROP USER` privilege.
-See an example:
+You can grant the privilege to delete users using the `DROP USER` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT DROP USER ON DBMS TO userDropper
----
-The resulting role has privileges that only allow deleting users.
-List all privileges for the role `userDropper` as commands by using the following query:
+As a result, the `userDropper` role has privileges that only allow deleting users.
+To list all privileges for the role `userDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userDropper PRIVILEGES AS COMMANDS
+SHOW ROLE userDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -719,44 +841,49 @@ SHOW ROLE userDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to show users can be granted via the `SHOW USER` privilege.
-See an example:
+
+=== Grant privilege to show users
+
+You can grant the privilege to show users using the `SHOW USER` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT SHOW USER ON DBMS TO userShower
+GRANT SHOW USER ON DBMS TO userViewer
----
-The resulting role has privileges that only allow showing users.
-List all privileges for the role `userShower` as commands by using the following query:
+As a result, the `userViewer` role has privileges that only allow showing users.
+To list all privileges for the role `userViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userShower PRIVILEGES AS COMMANDS
+SHOW ROLE userViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW USER ON DBMS TO `userShower`"
+|"GRANT SHOW USER ON DBMS TO `userViewer`"
a|Rows: 1
|===
-The privileges to create, rename, modify, delete, and list users can be granted via the `USER MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage users
+
+You can grant the privilege to create, rename, modify, delete, and list users using the `USER MANAGEMENT` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT USER MANAGEMENT ON DBMS TO userManager
----
-The resulting role has all privileges to manage users.
-List all privileges for the role `userManager` as commands by using the following query:
+As a result, the `userManager` role has all privileges to manage users.
+To list all privileges for the role `userManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userManager PRIVILEGES AS COMMANDS
+SHOW ROLE userManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -770,16 +897,15 @@ a|Rows: 1
[[access-control-dbms-administration-impersonation]]
== The DBMS `IMPERSONATE` privileges
-The DBMS privileges for impersonation can be assigned through Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for impersonation can be granted, denied, or revoked like other privileges.
Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands).
-The ability to impersonate users can be granted via the `IMPERSONATE` privilege.
+You can use the `IMPERSONATE` privilege to allow a user to impersonate another user.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Impersonation privileges command syntax
@@ -801,58 +927,80 @@ GRANT [IMMUTABLE] IMPERSONATE (user[, ...])
|===
-The following query shows an example of this.
-Note that `userImpersonator` must be an existing role in order to make this query work:
+=== Grant privilege to impersonate all users
+
+You can grant the privilege to impersonate all users using the `IMPERSONATE (*)` privilege. +
+For example:
.Query
[source, cypher, role=noplay]
----
-GRANT IMPERSONATE (*) ON DBMS TO userImpersonator
+GRANT IMPERSONATE (*) ON DBMS TO allUserImpersonator
----
-The resulting role has privileges that allow impersonating all users:
+As a result, the `allUserImpersonator` role has privileges that allow impersonating all users.
+To list all privileges for the role `allUserImpersonator` as commands, use the following query:
.Query
[source, cypher, role=noplay]
----
-SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS
+SHOW ROLE allUserImpersonator PRIVILEGES AS COMMANDS;
----
-
.Result
[options="header,footer", width="100%", cols="m"]
|===
| command
-| "GRANT IMPERSONATE (*) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (*) ON DBMS TO `allUserImpersonator`"
a|Rows: 1
|===
-It is also possible to deny and revoke that privilege.
-See an example which shows of how the `userImpersonator` user would be able to impersonate all users, except `alice`:
+=== Grant privilege to impersonate specific users
+
+You can also grant the privilege to impersonate specific users or a subset of users. +
+For example:
.Query
[source, cypher, role=noplay]
----
-DENY IMPERSONATE (alice) ON DBMS TO userImpersonator
+GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator;
----
-To grant (or revoke) the permissions to impersonate a specific user or a subset of users, you can first list them with this query:
+As a result, the `userImpersonator` role has privileges that allow impersonating only `alice` and `bob`.
+Then, you deny the privilege to impersonate `alice`:
.Query
[source, cypher, role=noplay]
----
-GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator
+DENY IMPERSONATE (alice) ON DBMS TO userImpersonator;
----
+As a result, the `userImpersonator` user would be able to impersonate only `bob`.
+
+To list all privileges for the role `userImpersonator` as commands, use the following query:
+
+.Query
+[source, cypher, role=noplay]
+----
+SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS;
+----
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+| command
+| "DENY IMPERSONATE (alice) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (alice) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (bob) ON DBMS TO `userImpersonator`"
+a|Rows: 3
+|===
[[access-control-dbms-administration-database-management]]
== The DBMS `DATABASE MANAGEMENT` privileges
-The DBMS privileges for database management can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
+The DBMS privileges for database management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Database management privileges command syntax
@@ -885,22 +1033,34 @@ GRANT [IMMUTABLE] SET DATABASE ACCESS
| Enables the specified roles to modify access to standard databases.
| [source, syntax, role=noheader]
-GRANT CREATE COMPOSITE DATABASE
+GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON DBMS
+ TO role[, ...]
+| Enables the specified roles to set the default query language on a standard database.
+
+| [source, syntax, role=noheader]
+GRANT [IMMUTABLE] CREATE COMPOSITE DATABASE
ON DBMS
TO role[, ...]
| Enables the specified roles to create new composite databases.
| [source, syntax, role=noheader]
-GRANT DROP COMPOSITE DATABASE
+GRANT [IMMUTABLE] DROP COMPOSITE DATABASE
ON DBMS
TO role[, ...]
| Enables the specified roles to delete composite databases.
| [source, syntax, role=noheader]
-GRANT COMPOSITE DATABASE MANAGEMENT
+GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE
ON DBMS
TO role[, ...]
-| Enables the specified roles to create and delete composite databases.
+| Enables the specified roles to modify composite databases.
+
+| [source, syntax, role=noheader]
+GRANT [IMMUTABLE] COMPOSITE DATABASE MANAGEMENT
+ ON DBMS
+ TO role[, ...]
+| Enables the specified roles to create, delete or modify composite databases.
| [source, syntax, role=noheader]
GRANT [IMMUTABLE] DATABASE MANAGEMENT
@@ -910,21 +1070,22 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT
|===
+=== Grant privilege to create standard databases
-The ability to create standard databases can be granted via the `CREATE DATABASE` privilege.
-See an example:
+You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE DATABASE ON DBMS TO databaseAdder
----
-The resulting role has privileges that only allow creating standard databases.
-List all privileges for the role `databaseAdder` as commands by using the following query:
+As a result, the `databaseAdder` role has privileges that only allow creating standard databases.
+To list all privileges for the role `databaseAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS
+SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -935,20 +1096,22 @@ SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create composite databases can be granted via the `CREATE COMPOSITE DATABASE` privilege.
-See an example:
+=== Grant privilege to create composite databases
+
+You can grant the privilege to create composite databases using the `CREATE COMPOSITE DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE COMPOSITE DATABASE ON DBMS TO compositeDatabaseAdder
----
-The resulting role has privileges that only allow creating composite databases.
-List all privileges for the role `compositeDatabaseAdder` as commands by using the following query:
+As a result, the `compositeDatabaseAdder` role has privileges that only allow creating composite databases.
+To list all privileges for the role `compositeDatabaseAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -959,20 +1122,22 @@ SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete standard databases can be granted via the `DROP DATABASE` privilege.
-See an example:
+=== Grant privilege to delete standard databases
+
+You can grant the privilege to delete standard databases using the `DROP DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT DROP DATABASE ON DBMS TO databaseDropper
----
-The resulting role has privileges that only allow deleting standard databases.
-List all privileges for the role `databaseDropper` as commands by using the following query:
+As a result, the `databaseDropper` role has privileges that only allow deleting standard databases.
+To list all privileges for the role `databaseDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS
+SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -983,20 +1148,22 @@ SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete composite databases can be granted via the `DROP COMPOSITE DATABASE` privilege.
-See an example:
+=== Grant privilege to delete composite databases
+
+You can grant the privilege to delete composite databases using the `DROP COMPOSITE DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT DROP COMPOSITE DATABASE ON DBMS TO compositeDatabaseDropper
----
-The resulting role has privileges that only allow deleting composite databases.
-List all privileges for the role `compositeDatabaseDropper` as commands by using the following query:
+As a result, the `compositeDatabaseDropper` role has privileges that only allow deleting composite databases.
+To list all privileges for the role `compositeDatabaseDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -1007,20 +1174,22 @@ SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify standard databases can be granted via the `ALTER DATABASE` privilege.
-See an example:
+=== Grant privilege to modify standard databases
+
+You can grant the privilege to modify standard databases using the `ALTER DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ALTER DATABASE ON DBMS TO databaseModifier
+GRANT ALTER DATABASE ON DBMS TO databaseModifier;
----
-The resulting role has privileges that only allow modifying standard databases.
-List all privileges for the role `databaseModifier` as commands by using the following query:
+As a result, the `databaseModifier` role has privileges that only allow modifying standard databases.
+To list all privileges for the role `databaseModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS
+SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1031,20 +1200,22 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify access to standard databases can be granted via the `SET DATABASE ACCESS` privilege.
-See an example:
+=== Grant privilege to modify access to standard databases
+
+You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. +
+For example:
[source, cypher, role=noplay]
----
GRANT SET DATABASE ACCESS ON DBMS TO accessModifier
----
-The resulting role has privileges that only allow modifying access to standard databases.
-List all privileges for the role `accessModifier` as commands by using the following query:
+As a result, the `accessModifier` role has privileges that only allow modifying access to standard databases.
+To list all privileges for the role `accessModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
+SHOW ROLE accessModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1055,20 +1226,77 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create and delete composite databases can be granted via the `COMPOSITE DATABASE MANAGEMENT` privilege.
-See an example:
+[rol=label--new-2025.06]
+=== Grant privilege to modify the default language of standard databases
+
+You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. +
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO languageModifier
+----
+
+As a result, the `languageModifier` role has privileges that only allow modifying default language to standard databases.
+To list all privileges for the role `languageModifier` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE languageModifier PRIVILEGES AS COMMANDS;
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO `languageModifier`"
+a|Rows: 1
+|===
+
+[rol=label--new-2025.06]
+[[grant-privilege-alter-composite-database]]
+=== Grant privilege to modify composite databases
+
+You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager
+GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier;
----
-The resulting role has all privileges to manage composite databases.
-List all privileges for the role `compositeDatabaseManager` as commands by using the following query:
+As a result, the `compositeDatabaseModifier` role has privileges that only allow modifying composite databases.
+To list all privileges for the role `compositeDatabaseModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS;
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT ALTER COMPOSITE DATABASE ON DBMS TO `compositeDatabaseModifier`"
+a|Rows: 1
+|===
+
+=== Grant privilege to manage composite databases
+
+You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager;
+----
+
+As a result, the `compositeDatabaseManager` role has all privileges to manage composite databases.
+To list all privileges for the role `compositeDatabaseManager` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1079,20 +1307,22 @@ SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create, delete, and modify databases can be granted via the `DATABASE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage standard and composite databases
+
+You can grant the privilege to create, delete, and modify standard and composite databases using the `DATABASE MANAGEMENT` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager
+GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager;
----
-The resulting role has all privileges to manage standard and composite databases as well as aliases.
-List all privileges for the role `databaseManager` as commands by using the following query:
+As a result, the `databaseManager` role has all privileges to manage standard and composite databases.
+To list all privileges for the role `databaseManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE databaseManager PRIVILEGES AS COMMANDS
+SHOW ROLE databaseManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1106,13 +1336,12 @@ a|Rows: 1
[[access-control-dbms-administration-alias-management]]
== The DBMS `ALIAS MANAGEMENT` privileges
-The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases.
-They can be granted, denied and revoked like other privileges.
-It is also possible to manage aliases with <>.
+The DBMS privileges for alias management can be granted, denied, or revoked like other privileges.
+This applies to both local and remote aliases.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Alias management privileges command syntax
@@ -1152,20 +1381,22 @@ TO role[, ...]
|===
-The ability to create aliases can be granted via the `CREATE ALIAS` privilege.
-See an example:
+=== Grant privilege to create aliases
+
+You can grant the privilege to create aliases using the `CREATE ALIAS` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT CREATE ALIAS ON DBMS TO aliasAdder
+GRANT CREATE ALIAS ON DBMS TO aliasAdder;
----
-The resulting role has privileges that only allow creating aliases.
-List all privileges for the role `aliasAdder` as commands by using the following query:
+As a result, the `aliasAdder` role has privileges that only allow creating aliases.
+To list all privileges for the role `aliasAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS
+SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -1176,20 +1407,22 @@ SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete aliases can be granted via the `DROP ALIAS` privilege.
-See an example:
+=== Grant privilege to delete aliases
+
+You can grant the privilege to delete aliases using the `DROP ALIAS` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT DROP ALIAS ON DBMS TO aliasDropper
+GRANT DROP ALIAS ON DBMS TO aliasDropper;
----
-The resulting role has privileges that only allow deleting aliases.
-See all privileges for the role `aliasDropper` as commands by using the following query:
+As a result, the `aliasDropper` role has privileges that only allow deleting aliases.
+See all privileges for the role `aliasDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS
+SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -1200,20 +1433,22 @@ SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify aliases can be granted via the `ALTER ALIAS` privilege.
-See an example:
+=== Grant privilege to modify aliases
+
+You can grant the privilege to modify aliases using the `ALTER ALIAS` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ALTER ALIAS ON DBMS TO aliasModifier
+GRANT ALTER ALIAS ON DBMS TO aliasModifier;
----
-The resulting role has privileges that only allow modifying aliases.
-List all privileges for the role `aliasModifier` as commands by using the following query:
+As a result, the `aliasModifier` role has privileges that only allow modifying aliases.
+To list all privileges for the role `aliasModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS
+SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1224,44 +1459,49 @@ SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to list aliases can be granted via the `SHOW ALIAS` privilege.
-See an example:
+
+=== Grant privilege to list aliases
+
+You can grant the privilege to list aliases using the `SHOW ALIAS` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT SHOW ALIAS ON DBMS TO aliasLister
+GRANT SHOW ALIAS ON DBMS TO aliasViewer;
----
-The resulting role has privileges that only allow modifying aliases.
-List all privileges for the role `aliasLister` as commands by using the following query:
+As a result, the `aliasViewer` role has privileges that only allow modifying aliases.
+To list all privileges for the role `aliasViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasLister PRIVILEGES AS COMMANDS
+SHOW ROLE aliasViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW ALIAS ON DBMS TO `aliasLister`"
+|"GRANT SHOW ALIAS ON DBMS TO `aliasViewer`"
a|Rows: 1
|===
-The privileges to list, create, delete, and modify aliases can be granted via the `ALIAS MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage aliases
+
+You can grant the privilege to create, delete, modify, and list aliases using the `ALIAS MANAGEMENT` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager
+GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager;
----
-The resulting role has all privileges to manage aliases.
-List all privileges for the role `aliasManager` as commands by using the following query:
+As a result, the `aliasManager` role has all privileges to manage aliases.
+To list all privileges for the role `aliasManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasManager PRIVILEGES AS COMMANDS
+SHOW ROLE aliasManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1275,12 +1515,11 @@ a|Rows: 1
[[access-control-dbms-administration-server-management]]
== The DBMS `SERVER MANAGEMENT` privileges
-The DBMS privileges for server management can be assigned using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for server management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Server management privileges command syntax
@@ -1301,16 +1540,67 @@ GRANT [IMMUTABLE] SHOW SERVERS
| Enables the specified roles to show servers.
|===
+=== Grant privilege to manage servers
+
+You can grant the privilege to show, enable, rename, alter, reallocate, deallocate, and drop servers using the `SERVER MANAGEMENT` privilege. +
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SERVER MANAGEMENT ON DBMS TO serverManager;
+----
+
+As a result, the `serverManager` role has all privileges to manage servers.
+To list all privileges for the role `serverManager` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE serverManager PRIVILEGES AS COMMANDS;
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SERVER MANAGEMENT ON DBMS TO `serverManager`"
+a|Rows: 1
+|===
+
+
+=== Grant privilege to show servers
+
+You can grant the privilege to show servers using the `SHOW SERVERS` privilege. +
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SHOW SERVERS ON DBMS TO serverViewer;
+----
+
+As a result, the `serverViewer` role has privileges that only allow showing servers.
+To list all privileges for the role `serverViewer` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE serverViewer PRIVILEGES AS COMMANDS;
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SHOW SERVERS ON DBMS TO `serverViewer`"
+a|Rows: 1
+|===
[[access-control-dbms-administration-privilege-management]]
== The DBMS `PRIVILEGE MANAGEMENT` privileges
-The DBMS privileges for privilege management can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
+The DBMS privileges for privilege management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Privilege management privileges command syntax
@@ -1343,56 +1633,59 @@ GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT
| Enables the specified roles to list, assign, and remove privileges.
|===
-The ability to list privileges can be granted via the `SHOW PRIVILEGE` privilege.
+=== Grant privilege to list privileges
+
+You can grant the `SHOW PRIVILEGE` privilege to allow a user to list privileges using the `SHOW PRIVILEGE`, `SHOW ROLE roleName PRIVILEGES`, and `SHOW USER username PRIVILEGES` administration commands.
+The `SHOW USER username PRIVILEGES` command also requires the `SHOW USER` privilege.
-A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands.
-To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required.
-The following query shows an example of how to grant the `SHOW PRIVILEGE` privilege:
+For example:
[source, cypher, role=noplay]
----
-GRANT SHOW PRIVILEGE ON DBMS TO privilegeShower
+GRANT SHOW PRIVILEGE ON DBMS TO privilegeViewer;
----
-The resulting role has privileges that only allow showing privileges.
-List all privileges for the role `privilegeShower` as commands by using the following query:
+As a result, the `privilegeViewer` role has privileges that only allow showing privileges.
+To list all privileges for the role `privilegeViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeShower PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeShower`"
+|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeViewer`"
a|Rows: 1
|===
[NOTE]
====
-Note that no specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands.
+No specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands.
-In addition, note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges.
+If a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges.
Other users' privileges cannot be listed when using a non-native auth provider.
====
-The ability to assign privileges to roles can be granted via the `ASSIGN PRIVILEGE` privilege.
-A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands.
-See an example of how to grant this privilege:
+=== Grant privilege to assign privileges
+
+You can grant the privilege to assign privileges using the `ASSIGN PRIVILEGE` privilege. +
+A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands. +
+For example:
[source, cypher, role=noplay]
----
-GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner
+GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner;
----
-The resulting role has privileges that only allow assigning privileges.
-List all privileges for the role `privilegeAssigner` as commands by using the following query:
+As a result, the `privilegeAssigner` role has privileges that only allow assigning privileges.
+To list all privileges for the role `privilegeAssigner` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS;
----
.Result
@@ -1403,22 +1696,23 @@ SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to remove privileges from roles can be granted via the `REMOVE PRIVILEGE` privilege.
+=== Grant privilege to remove privileges
-A user with this privilege is allowed to execute `REVOKE` administration commands.
-See an example of how to grant this privilege:
+You can grant the privilege to remove privileges from roles using the `REMOVE PRIVILEGE` privilege. +
+A user with this privilege is allowed to execute `REVOKE` administration commands. +
+For example:
[source, cypher, role=noplay]
----
-GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover
+GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover;
----
-The resulting role has privileges that only allow removing privileges.
-List all privileges for the role `privilegeRemover` as commands by using the following query:
+As a result, the `privilegeRemover` role has privileges that only allow removing privileges.
+To list all privileges for the role `privilegeRemover` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS;
----
.Result
@@ -1429,20 +1723,22 @@ SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The privileges to list, assign, and remove privileges can be granted via the `PRIVILEGE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage privileges
+
+You can grant the privilege to list, assign, and remove privileges using the `PRIVILEGE MANAGEMENT` privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager
+GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager;
----
-The resulting role has all privileges to manage privileges.
-List all privileges for the role `privilegeManager` as commands by using the following query:
+As a result, the `privilegeManager` role has all privileges to manage privileges.
+To list all privileges for the role `privilegeManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1457,12 +1753,11 @@ a|Rows: 1
[[access-control-dbms-administration-execute]]
== The DBMS `EXECUTE` privileges
-The DBMS privileges for procedure and user-defined function execution can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
+The DBMS privileges for procedure and user-defined function execution can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Execute privileges command syntax
@@ -1503,26 +1798,28 @@ GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, .
|===
[[access-control-execute-procedure]]
-=== The `EXECUTE PROCEDURE` privilege
+=== Grant privilege to execute procedures
-The ability to execute a procedure can be granted via the `EXECUTE PROCEDURE` privilege.
+You can grant the privilege to execute procedures using the `EXECUTE PROCEDURE` privilege. +
A role with this privilege is allowed to execute the procedures matched by the <>.
-The following query shows an example of how to grant this privilege:
+
+==== Grant privilege to execute some procedures
+
+The following query allow the execution of procedures starting with `db.schema`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor
+GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor;
----
-Users with the role `procedureExecutor` can then run any procedure in the `db.schema` namespace.
-The procedure is run using the user's own privileges.
+Users with the role `procedureExecutor` can run any procedure in the `db.schema` namespace.
+The procedures are executed using the user's own privileges.
-The resulting role has privileges that only allow executing procedures in the `db.schema` namespace.
-List all privileges for the role `procedureExecutor` as commands by using the following query:
+To list all privileges for the role `procedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1533,25 +1830,29 @@ SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-In order to allow the execution of all but only a few procedures, you can grant `EXECUTE PROCEDURES *` and deny the unwanted procedures.
+==== Grant privilege to execute all but some procedures
+
+You can grant the privilege to execute all except a few procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
For example, the following queries allow the execution of all procedures, except those starting with `dbms.cluster`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor
+GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor
+DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor;
----
-The resulting role has privileges that only allow executing all procedures except those starting with `dbms.cluster`.
-List all privileges for the role `deniedProcedureExecutor` as commands by using the following query:
+Users with the role `deniedProcedureExecutor` can run any procedure except those starting with `dbms.cluster`.
+The procedures are executed using the user's own privileges.
+
+To list all privileges for the role `deniedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1568,14 +1869,20 @@ The `dbms.cluster.checkConnectivity`, `dbms.cluster.cordonServer`, `dbms.cluster
[[access-control-execute-boosted-procedure]]
-=== The `EXECUTE BOOSTED PROCEDURE` privilege
+=== Grant privilege to execute procedures with elevated privileges
-The ability to use elevated privileges when executing a procedure can be granted via the `EXECUTE BOOSTED PROCEDURE` privilege.
+You can grant the privilege to execute procedures with elevated privileges using the `EXECUTE BOOSTED PROCEDURE` privilege. +
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <>.
The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not the execution of the procedure.
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
+==== Grant privilege to execute some procedures with elevated privileges
+
+You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
+
+For example, the following query allow the execution of the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
+
[source, cypher, role=noplay]
----
GRANT EXECUTE PROCEDURE * ON DBMS TO boostedProcedureExecutor;
@@ -1585,11 +1892,11 @@ GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boost
Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges, seeing everything in the graph and not just the labels and types that the user has `TRAVERSE` privilege on.
Without the `EXECUTE PROCEDURE`, no procedures could be executed at all.
-The resulting role has privileges that allow executing the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
+To list all privileges for the role `boostedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1602,31 +1909,28 @@ SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 3
|===
+[[grant-execute-procedure-deny-elevation]]
+==== Combination of granting execution and denying privilege elevation
+
As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
-This can be seen in the following examples:
-.Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
-[example]
-====
-[source, cypher, role=noplay]
-----
-GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1
-----
+For example:
[source, cypher, role=noplay]
----
-DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1
+GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1;
+DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1;
----
-The resulting role has privileges that allow the execution of all procedures using the user's own privileges.
-It also prevents the `db.labels` procedure from being elevated.
+As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user’s own privileges.
+They also prevent the `db.labels` procedure from being elevated.
Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`.
To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1637,27 +1941,31 @@ SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor1`"
a|Rows: 2
|===
-====
-.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE`
-[example]
-====
+[[grant-privilege-elevation-deny-execution]]
+==== Combination of granting privilege elevation and denying execution
+
+You can also grant the privilege to execute procedures with elevated privileges and deny the execution of specific procedures.
+
+For example:
+
[source, cypher, role=noplay]
----
-GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2
+GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2
+DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2;
----
-The resulting role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
-List all privileges for the role `deniedBoostedProcedureExecutor2` as commands by using the following query:
+As a result, the `deniedBoostedProcedureExecutor2` role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
+
+To list all privileges for the role `deniedBoostedProcedureExecutor2` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1668,27 +1976,33 @@ SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor2`"
a|Rows: 2
|===
-====
-.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
-[example]
-====
+[[grant-deny-privilege-elevation]]
+==== Combination of granting and denying privilege elevation
+
+You can also grant the privilege to execute procedures with elevated privileges and deny the elevation for specific procedures.
+
+For example, the following queries allow has privileges that allow elevating the privileges for all procedures except `db.labels`.
+However, no procedures can be executed due to a missing `EXECUTE PROCEDURE` privilege.
+
[source, cypher, role=noplay]
----
-GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3
+GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3
+DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3;
----
-The resulting role has privileges that allow elevating the privileges for all procedures except `db.labels`, however no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
-List all privileges for the role `deniedBoostedProcedureExecutor3` as commands by using the following query:
+As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`.
+However, no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
+
+To list all privileges for the role `deniedBoostedProcedureExecutor3` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1699,16 +2013,16 @@ SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor3`"
a|Rows: 2
|===
-====
-.How would the privileges from examples 1 to 3 affect the output of a procedure?
-[example]
-====
-Assume there is a procedure called `myProc`.
+==== Control procedure output with privileges
+
+You can control the output of procedures based on the privileges granted or denied to a role using the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
+For example, assume there is a procedure called `myProc`.
-This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege.
+This procedure gives the result `A` and `B` for a user with only the `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with both the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
+
+Now, adapt the privileges from sections <> (example 1), <> (example 2), and <> (example 3) to be applied to this procedure and show what is returned.
-Now, adapt the privileges from examples 1 to 3 to be applied to this procedure and show what is returned.
With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`.
With the privileges from example 2, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE PROCEDURE myProc`, execution of the `myProc` procedure is not allowed.
@@ -1720,30 +2034,32 @@ For comparison, when granted:
* `EXECUTE PROCEDURE myProc`: the `myProc` procedure returns the result `A` and `B`.
* `EXECUTE BOOSTED PROCEDURE myProc`: execution of the `myProc` procedure is not allowed.
* `EXECUTE PROCEDURE myProc` and `EXECUTE BOOSTED PROCEDURE myProc`: the `myProc` procedure returns the result `A`, `B`, and `C`.
-====
[[access-control-admin-procedure]]
-=== The `EXECUTE ADMIN PROCEDURE` privilege
+=== Grant privilege to execute admin procedures
+
+Admin procedures (annotated with `@Admin`) are special in that they require elevated privileges to be executed at all.
+This means that to execute an admin procedure you need both the <> and <> privileges for that procedure.
+
+For a user to be allowed to execute all admin procedures, they can either be granted the two privileges for each of the admin procedures (which would need to be updated each time a new admin procedure is added), all procedures (which would then affect all non-admin procedures as well) or the `EXECUTE ADMIN PROCEDURES` privilege.
-The ability to execute admin procedures (annotated with `@Admin`) can be granted via the `EXECUTE ADMIN PROCEDURES` privilege.
-This privilege is equivalent with granting the <> and <> privileges on each of the admin procedures.
-Any newly added `admin` procedure is automatically included in this privilege.
-The following query shows an example of how to grant this privilege:
+The `EXECUTE ADMIN PROCEDURES` privilege is equivalent to granting the <> and <> privileges on each of the admin procedures.
+This also have the additional advantage that any newly added `admin` procedure is automatically included in this privilege. +
+For example:
[source, cypher, role=noplay]
----
-GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor
+GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor;
----
-Users with the role `adminProcedureExecutor` can then run any `admin` procedure with elevated privileges.
-The resulting role has privileges that allow the execution of all admin procedures.
-
-List all privileges for the role `adminProcedureExecutor` as commands by using the following query:
+Users with the role `adminProcedureExecutor` can run any `admin` procedure with elevated privileges.
+As a result, the `adminProcedureExecutor` role has privileges that allow the execution of all admin procedures.
+To list all privileges for the role `adminProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1764,10 +2080,10 @@ Any denied `EXECUTE` privilege results in the procedure not being allowed to be
In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED PROCEDURE` or `EXECUTE ADMIN PROCEDURES` is being denied.
[[access-control-execute-user-defined-function]]
-=== The `EXECUTE USER DEFINED FUNCTION` privilege
+=== Grant privilege to execute user-defined functions
//EXECUTE [USER [DEFINED]] FUNCTION[S]
-The ability to execute a user-defined function (UDF) can be granted via the `EXECUTE USER DEFINED FUNCTION` privilege.
+You can grant the privilege to execute user-defined functions (UDFs) using the `EXECUTE USER DEFINED FUNCTION` privilege.
A role with this privilege is allowed to execute the UDFs matched by the <>.
[IMPORTANT]
@@ -1775,31 +2091,31 @@ A role with this privilege is allowed to execute the UDFs matched by the <>.
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
-Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the functions as well.
+Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the UDFs as well.
Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
[IMPORTANT]
@@ -1874,33 +2188,33 @@ Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION`
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
====
-.Execute boosted user-defined function
-======
+==== Grant privilege to execute some user-defined functions with elevated privileges
+
The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege:
[source,cypher,role=noplay]
----
-GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor
-GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor
+GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor;
+GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor;
----
Or in short form:
[source,cypher,role=noplay]
----
-GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor
-GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor
+GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor;
+GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor;
----
Users with the role `boostedFunctionExecutor` can thus run `apoc.any.properties` with full privileges and see every property on the node/relationship, not just the properties that the user has `READ` privilege on.
-Without the `EXECUTE USER DEFINED FUNCTION` no UDFs could be executed at all.
+Without the `EXECUTE USER DEFINED FUNCTION`, you cannot execute any UDFs at all.
-The resulting role has privileges that allow executing the UDF `apoc.any.properties` with elevated privileges, and all other UDFs with the users' own privileges.
-List all privileges for the role `boostedFunctionExecutor` as commands by using the following query:
+As a result, the `boostedFunctionExecutor` role has privileges that allow executing the UDF `apoc.any.properties` with elevated privileges, and all other UDFs with the users' own privileges.
+To list all privileges for the role `boostedFunctionExecutor` as commands, use the following query:
[source,cypher,role=noplay]
----
-SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1911,20 +2225,17 @@ SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO `boostedFunctionExecutor`"
a|Rows: 2
|===
-======
-
[[access-control-dbms-administration-setting]]
== The DBMS `SETTING` privileges
-The ability to show configuration settings can be granted via the `SHOW SETTING` privilege.
-A role with this privilege is allowed to query the configuration settings matched by the <>.
-
+You can grant the privilege to show configuration settings using the `SHOW SETTING` privilege.
+A role with this privilege is allowed to list the configuration settings matched by the <>.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Setting privileges command syntax
@@ -1937,24 +2248,27 @@ For more details about the syntax descriptions, see xref:database-administration
GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...]
ON DBMS
TO role[, ...]
-| Enables the specified roles to query given configuration settings.
+| Enables the specified roles to list given configuration settings.
|===
-The following query shows an example of how to grant this privilege:
+=== Grant privilege to show all settings
+
+You can grant the privilege to show all settings using `SHOW SETTING \*` or all settings in a namespace using `SHOW SETTING namespace.*`.
+The following query shows an example of how to grant `SHOW SETTING` privilege to view all settings in the `server.bolt` namespace:
[source, cypher, role=noplay]
----
-GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer
+GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer;
----
-Users with the role `configurationViewer` can then query any setting in the `server.bolt` namespace.
+Users with the role `configurationViewer` can then view any setting in the `server.bolt` namespace.
-The updated role `configurationViewer` has privileges that only allow querying settings in the `server.bolt` namespace.
-List all privileges for the role `configurationViewer` as commands by using the following query:
+As a result, the `configurationViewer` role has privileges that only allow listing settings in the `server.bolt` namespace.
+To list all privileges for the role `configurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS
+SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS;
----
.Result
@@ -1965,25 +2279,27 @@ SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-To deny a specific setting from a role, first grant `SHOW SETTINGS *`, and then deny the unwanted setting.
-For example, the following queries allow the querying of all settings, except those starting with `dbms.security`:
+=== Grant privilege to show all but some settings
+
+You can grant the privilege to show all but a few settings using `SHOW SETTINGS *` and deny the unwanted settings. +
+For example, the following queries allow you to view all settings, except those starting with `dbms.security`:
[source, cypher, role=noplay]
----
-GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer
+GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer;
----
[source, cypher, role=noplay]
----
-DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer
+DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer;
----
-The resulting role has privileges that allow querying all settings except those starting with `dbms.security`.
-List all privileges for the role `deniedConfigurationViewer` as commands by using the following query:
+As a result, the `deniedConfigurationViewer` role has privileges that allow listing all settings except those starting with `dbms.security`.
+To list all privileges for the role `deniedConfigurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS
+SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS;
----
.Result
@@ -1995,18 +2311,19 @@ SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-As the query result shows, access to any setting starting with `dbms.security` are blocked, but the rest can still be queried.
+As the query result shows, viewing settings starting with `dbms.security` is blocked, but the rest can still be listed.
[[access-control-dbms-administration-all]]
== Granting `ALL DBMS PRIVILEGES`
-The right to perform the following privileges can be achieved with a single command:
+You can grant the `ALL DBMS PRIVILEGES` privilege to a role. +
+The `ALL DBMS PRIVILEGES` privilege is equivalent to granting the following privileges:
* Create, drop, assign, remove, and show roles.
* Create, alter, drop, show, and impersonate users.
-* Create, alter, and drop databases and aliases.
-* Enable, alter, rename, reallocate, deallocate, and drop servers
+* Create, alter, drop, and show databases and aliases.
+* Enable, alter, rename, reallocate, deallocate, drop, and show servers.
* Show, assign, and remove privileges.
* Execute all procedures with elevated privileges.
* Execute all user-defined functions with elevated privileges.
@@ -2014,7 +2331,7 @@ The right to perform the following privileges can be achieved with a single comm
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
[source, syntax, role=noheader]
@@ -2024,18 +2341,18 @@ GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES]
TO role[, ...]
----
-For example, to grant the role `dbmsManager` the abilities above, use the following query:
+For example, to grant the role `dbmsManager` all DBMS abilities, use the following query:
[source, cypher, role=noplay]
----
-GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager
+GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager;
----
-The privileges granted can be seen using the `SHOW PRIVILEGES` command:
+To list all privileges for the role `dbmsManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS
+SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -2080,42 +2397,42 @@ Note that the same rules apply to user-defined functions and settings.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1
+GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1;
----
Users with the role `globbing1` can run all the procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2
+GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2;
----
Users with the role `globbing2` can run procedures `mine.public.exampleProcedure` and `mine.private.exampleProcedure`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3
+GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3;
----
Users with the role `globbing3` can run procedures `mine.public.exampleProcedure1`, `mine.private.exampleProcedure1`, and `mine.private.exampleProcedure2`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4
+GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4;
----
Users with the role `globbing4` can run procedures `your.exampleProcedure`, `mine.public.exampleProcedure`, and `mine.private.exampleProcedure`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5
+GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5;
----
Users with the role `globbing5` can run procedures `mine.public.exampleProcedure`, `mine.public.exampleProcedure1` and `mine.public.exampleProcedure42`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6
+GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6;
----
Users with the role `globbing6` can run procedures `mine.public.with#Special§Characters`, and `mine.private.with#Special§Characters`, but no other procedures.
diff --git a/modules/ROOT/pages/backup-restore/copy-database.adoc b/modules/ROOT/pages/backup-restore/copy-database.adoc
index 6998b5127..3d17183db 100644
--- a/modules/ROOT/pages/backup-restore/copy-database.adoc
+++ b/modules/ROOT/pages/backup-restore/copy-database.adoc
@@ -206,7 +206,7 @@ If you go from `high_limit` to `standard` or `aligned`, there is no validation t
[role=label--enterprise-edition]
[NOTE]
====
-The block format is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
+The block format is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
For more information on the block format, see xref:database-internals/store-formats.adoc[Store formats].
====
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
new file mode 100644
index 000000000..ac0c87001
--- /dev/null
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -0,0 +1,38 @@
+[[cypher-version-configuration]]
+= Configure the Cypher default version
+:page-role: new-2025.06
+:description: How to configure the Cypher default version.
+
+You can specify the version of Cypher® in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
+Cypher 5 is the default version for all newly created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
+For more information, see xref:introduction.adoc#_cypher_versions[Cypher® versions].
+
+To specify the Cypher version, use one of the following options:
+
+Configure a default Cypher version for the whole DBMS::
+The default language version for the whole DBMS can be configured in the _neo4j.conf_ file using the setting xref:configuration/configuration-settings.adoc#config_db.query.default_language[db.query.default_language] (default value: CYPHER_5). +
+Changing this setting in an existing DBMS *does not* affect existing databases.
+It only applies to newly created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
+
+Configure a default Cypher version per database::
+The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
+This clause determines the default Cypher version for the specified database, overriding the version set in the configuration file.
+For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
+For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
+If not specified, the default language for the database is set to the default language of the DBMS.
+Setting the default language on creation only require the correct `CREATE` privilege.
+Modifying the default language for an existing standard database requires the `SET DATABASE DEFAULT LANGUAGE` privilege and for an existing composite database the `ALTER COMPOSITE DATABASE` privilege.
++
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+
+Setting the default language to `CYPHER 5` ensures that all queries run on that database will use the version of `Cypher 5` as it existed at the time of the Neo4j 2025.06 release (unless you prepend your queries with `CYPHER 25`, which overrides this default).
+Any changes introduced after the 2025.06 release will not affect the semantics of the query.
+====
+
+Set the Cypher version on a per-query basis::
+The default language for a specific query can be set by prepending the query with the `CYPHER 5` or `CYPHER 25` keyword. +
+For example, `CYPHER 25 MATCH (n) RETURN n` or `CYPHER 5 MATCH (n) RETURN n`.
+This setting determines the language for the specified query, overriding the default language set in the configuration file and the database.
diff --git a/modules/ROOT/pages/configuration/index.adoc b/modules/ROOT/pages/configuration/index.adoc
index 3cd4c696b..14a0db448 100644
--- a/modules/ROOT/pages/configuration/index.adoc
+++ b/modules/ROOT/pages/configuration/index.adoc
@@ -8,6 +8,7 @@ The topics described are:
* xref:configuration/file-locations.adoc[Default file locations] -- An overview of where files are stored in the different Neo4j distributions and the necessary file permissions for running Neo4j.
//* <> -- A visual representation of the Neo4j network architecture.
* xref:configuration/ports.adoc[Ports] -- An overview of the ports relevant to a Neo4j installation.
+* xref:configuration/cypher-version-configuration.adoc[Configure the Cypher default version] -- How to configure the Cypher version.
* xref:configuration/connectors.adoc[Configure network connectors] -- How to configure network connectors for Neo4j.
* xref:configuration/set-initial-password.adoc[Set initial password] -- How to set an initial password.
* xref:configuration/neo4j-admin-memrec.adoc[Get initial memory recommendations] -- How to get initial memory recommendations for Neo4j.
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index 2b190c698..3b16cbb8b 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -4,7 +4,6 @@
= Managing database aliases in composite databases
Both local and remote database aliases can be created as part of a composite database.
-Starting with Neo4j 2025.04, a database alias can also be set as the default database for a composite database.
////
[source, cypher, role=test-setup]
@@ -18,6 +17,12 @@ CREATE DATABASE `perennial-flowers`;
----
////
+[NOTE]
+====
+Starting with Neo4j 2025.06, a database or remote alias can be assigned a default Cypher version.
+However, local aliases and aliases in composite databases cannot be assigned a default Cypher version.
+Local aliases always get the Cypher version of their target database and aliases in composite databases always get the Cypher version of the composite database.
+====
[[manage-aliases-composite-databases-list]]
== List database aliases in composite databases
@@ -153,14 +158,14 @@ SHOW ALIASES FOR DATABASE YIELD *
.Result
[role="queryresult"]
----
-+-----------------------------------------------------------------------------------------------------------------------------------+
-| name | composite | database | location | url | user | driver | properties |
-+-----------------------------------------------------------------------------------------------------------------------------------+
-| "garden.flowers" | "garden" | "perennial-flowers" | "local" | NULL | NULL | NULL | {perennial: TRUE} |
-| "garden.trees" | "garden" | "updatedtrees" | "remote" | "neo4j+s://location:7687" | "alice" | {} | {treeversion: 2} |
-| "library.romance" | "library" | "romance-books" | "remote" | "neo4j+s://location:7687" | "alice" | {} | {} |
-| "library.sci-fi" | "library" | "sci-fi-books" | "local" | NULL | NULL | NULL | {} |
-+-----------------------------------------------------------------------------------------------------------------------------------+
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | composite | database | location | url | user | driver | defaultLanguage | properties |
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
+| "garden.flowers" | "garden" | "perennial-flowers" | "local" | NULL | NULL | NULL | NULL | {perennial: TRUE} |
+| "garden.trees" | "garden" | "updatedtrees" | "remote" | "neo4j+s://location:7687" | "alice" | {} | NULL | {treeversion: 2} |
+| "library.romance" | "library" | "romance-books" | "remote" | "neo4j+s://location:7687" | "alice" | {} | NULL | {} |
+| "library.sci-fi" | "library" | "sci-fi-books" | "local" | NULL | NULL | NULL | NULL | {} |
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
----
[[delete-composite-database-alias]]
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index a3f38143f..2e18e1c67 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -3,35 +3,49 @@
[[manage-aliases-standard-databases]]
= Managing database aliases for standard databases
-There are two kinds of database aliases: local and remote.
-A local database alias can only target a database within the same DBMS.
-A remote database alias may target a database from another Neo4j DBMS.
-When a query is run against a database alias, it will be redirected to the target database.
-The home database for users can be set to an alias, which will be resolved to the target database on use.
-Starting with Neo4j 2025.04, a database alias can also be set as the default database.
+Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database.
+The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
+When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database.
-This page describes managing database aliases for standard databases.
-Local and remote database aliases can also be created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database].
-For more information, see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
+[NOTE]
+====
+If a transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety.
+This prevents issues such as a transaction executing against multiple target databases for the same alias.
+====
+
+There are two kinds of database aliases - local and remote:
-A local database alias can be used in all other Cypher commands in place of the target database.
+Local database aliases::
+A local database alias can only target a database within the same DBMS.
+It can be used in all Cypher commands in place of the target database.
Please note that the local database alias will be resolved while executing the command.
-Privileges are defined on the database, and not the local database alias.
+Privileges are defined on the target database, and not the local database alias.
+
-A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, `USE` clauses, setting a user's home database, and defining the access privileges to the remote database.
+Remote database aliases::
+A remote database alias may target a database from another Neo4j DBMS.
+It can be used for:
+* Connecting to a database of a remote Neo4j DBMS. +
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
-
-Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database.
-The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
-When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database.
+* `USE` clauses.
+* Defining the access privileges to the remote database.
+* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
[NOTE]
====
-If a transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety.
-This prevents issues such as a transaction executing against multiple target databases for the same alias.
+Starting with Neo4j 2025.06, a database or remote alias can be assigned a default Cypher version.
+However, local database aliases cannot be assigned a default Cypher version.
+They always get the Cypher version of their target database.
====
+When a query is run against a database alias, it will be redirected to the target database.
+The home database for users can be set to an alias, which will be resolved to the target database on use.
+Starting with Neo4j 2025.04, a database alias can also be set as the DBMS default database.
+
+This page describes managing database aliases for standard databases.
+For aliases created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database], see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
+
[[manage-aliases-list]]
== List database aliases
@@ -53,15 +67,18 @@ DRIVER {
connection_pool_idle_test: duration({minutes: 2}),
connection_pool_max_size: 10,
logging_level: 'info'
-};
+}
+DEFAULT LANGUAGE CYPHER 25;
----
////
-Available database aliases can be seen using `SHOW ALIASES FOR DATABASE`.
+You can list all available database aliases using the `SHOW ALIASES FOR DATABASE` command.
+The command returns a table of all database aliases, whether they belong to a composite database or not. +
+If you need more details, you can append the command with `YIELD *`.
+The `YIELD *` clause returns the full set of columns.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
-`SHOW ALIASES FOR DATABASE` will produce a table of database aliases with the following columns:
-
+.Available columns
[options="header" cols="2m,4a,2m"]
|===
| Column | Description | Type
@@ -106,19 +123,21 @@ The driver options for connection to the remote database or `null` if the target
List of xref::database-administration/aliases/manage-aliases-standard-databases.adoc#alias-management-create-remote-database-alias-driver-settings[driver settings] allowed for remote database aliases.
| MAP
+| defaultLanguage label:new[Introduced in 2025.06]
+|
+The default language for non-constituent remote database aliases or `null` if it is a constituent or local database alias.
+| STRING
+
| properties
| Any properties set on the database alias.
| MAP
|===
-The detailed information for a particular database alias can be displayed using the command `SHOW ALIASES FOR DATABASE YIELD *`.
-When a `YIELD *` clause is provided, the full set of columns is returned.
-
-=== Show all aliases for a database
+=== Show all database aliases
-A summary of all available database aliases can be displayed using the command `SHOW ALIASES FOR DATABASE`.
-This command will show database aliases for both standard and composite databases.
+To list all database aliases, use the `SHOW ALIASES FOR DATABASE` command without any additional parameters.
+This command returns all database aliases, including local and remote aliases, for all databases in the DBMS.
.Query
[source, cypher]
@@ -138,9 +157,9 @@ SHOW ALIASES FOR DATABASE
+--------------------------------------------------------------------------------------------+
----
-=== Show specific aliases for databases
+=== Show a specific database alias
-To list just one database alias, the `SHOW ALIASES` command takes an alias name;
+To list just one database alias, the `SHOW ALIASES` command takes an alias name:
.Query
[source, cypher]
@@ -158,7 +177,9 @@ SHOW ALIAS films FOR DATABASES
+---------------------------------------------------------+
----
-=== Show detailed aliases information for a database
+=== Show detailed information about all database aliases
+
+To see all columns for all database aliases, use the `YIELD *` clause with the `SHOW ALIASES FOR DATABASE` command:
.Query
[source, cypher]
@@ -169,18 +190,18 @@ SHOW ALIASES FOR DATABASE YIELD *
.Result
[role="queryresult"]
----
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| name | composite | database | location | url | user | driver | properties |
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| "films" | NULL | "movies" | "local" | NULL | NULL | NULL | {} |
-| "motion pictures" | NULL | "movies" | "local" | NULL | NULL | NULL | {namecontainsspace: TRUE} |
-| "movie scripts" | NULL | "scripts" | "remote" | "neo4j+s://location:7687" | "alice" | {connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H} | {} |
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | composite | database | location | url | user | driver | defaultLanguage | properties |
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| "films" | NULL | "movies" | "local" | NULL | NULL | NULL | NULL | {} |
+| "motion pictures" | NULL | "movies" | "local" | NULL | NULL | NULL | NULL | {namecontainsspace: TRUE} |
+| "movie scripts" | NULL | "scripts" | "remote" | "neo4j+s://location:7687" | "alice" | {connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H} | "CYPHER 25" | {} |
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
-=== Show `count` of aliases for a database
+=== Show the number of database aliases
-The number of database aliases can be seen using a `count()` aggregation with `YIELD` and `RETURN`.
+To see the number of database aliases, use a `count()` aggregation with `YIELD` and `RETURN`.
.Query
[source, cypher]
@@ -199,9 +220,11 @@ RETURN count(*) as count
+-------+
----
-=== Show filtered aliases information for a database
+=== Filter and sort database aliases
-It is possible to filter and sort the results by using `YIELD`, `ORDER BY`, and `WHERE`.
+You can filter and sort the results of the `SHOW ALIASES FOR DATABASE` command using the `YIELD`, `ORDER BY`, and `WHERE` clauses.
+The `YIELD` clause allows you to specify which columns to return, while the `ORDER BY` clause sorts the results based on a specified column.
+The `WHERE` clause filters the results based on a condition.
.Query
[source, cypher]
@@ -234,8 +257,7 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results.
[[alias-management-create-database-alias]]
== Create database aliases
-Database aliases can be created using `CREATE ALIAS`.
-The command supports the creation of both local and remote database aliases.
+You can create both local and remote database aliases using the command `CREATE ALIAS`.
For more information on local and remote database aliases as part of a composite database, see xref::database-administration/aliases/manage-aliases-composite-databases.adoc#create-composite-database-alias[Create database aliases in composite databases].
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
@@ -290,38 +312,42 @@ SHOW ALIAS `northwind` FOR DATABASE
+---------------------------------------------------------------------------+
----
-=== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
+==== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
The `CREATE ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists.
-There are two ways to circumvent this behavior.
-
-First, appending `IF NOT EXISTS` to the command ensures that no error is returned and nothing happens should the database alias already exist.
+To work around this, you can append `IF EXISTS` or `OR REPLACE` to the command.
+Both check for any remote or local database aliases.
+* Appending `IF NOT EXISTS` to the command.
+This ensures that no error is returned and nothing happens should the database alias already exist.
++
.Query
[source, cypher]
----
CREATE ALIAS `northwind` IF NOT EXISTS FOR DATABASE `northwind-graph-2021`
----
-Second, adding `OR REPLACE` to the command results in any existing database being deleted and a new one being created.
-
+* Appending `OR REPLACE` to the command.
+This means that if the database alias already exists, it will be replaced with the new one.
++
.Query
[source, cypher]
----
CREATE OR REPLACE ALIAS `northwind` FOR DATABASE `northwind-graph-2021`
----
-
-This is equivalent to running `DROP ALIAS `northwind++` IF EXISTS FOR DATABASE` followed by `CREATE ALIAS `northwind++` FOR DATABASE `northwind-graph-2021`++`.
++
+This is equivalent to running ```DROP ALIAS `northwind++` IF EXISTS FOR DATABASE++``` followed by ```CREATE ALIAS `northwind++` FOR DATABASE `northwind-graph-2021++````.
[NOTE]
====
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
-=== Set properties for local database aliases
+==== Set properties for local database aliases
-Local database aliases can also be given properties.
-These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()` function].
+You can set properties for local database aliases using the `PROPERTIES` clause of the `CREATE ALIAS` command.
+These properties can later be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()`] function.
+For example:
.Query
[source, cypher]
@@ -331,7 +357,7 @@ FOR DATABASE `northwind-graph-2022`
PROPERTIES { newestNorthwind: true, index: 3 }
----
-The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command.
+To verify that the properties have been set, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
.Query
[source, cypher]
@@ -356,8 +382,10 @@ SHOW ALIAS `northwind-2022` FOR DATABASE YIELD name, properties
A database alias can target a remote database by providing an URL and the credentials of a user on the remote Neo4j DBMS.
See xref:database-administration/aliases/remote-database-alias-configuration.adoc[] for the necessary configurations.
-As with local database aliases, creating remote database aliases allows `IF NOT EXISTS` and `OR REPLACE` clauses.
-Both check for any remote or local database aliases.
+Since remote database aliases target databases that are not in this DBMS, they do not fetch the default Cypher version from their target like the local database aliases.
+Instead, they are assigned the version given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`], which is set in the `neo4j.conf` file.
+Alternatively, you can specify the version in the `CREATE ALIAS` or `ALTER ALIAS` commands.
+See xref:database-administration/aliases/manage-aliases-standard-databases.adoc#set-default-language-for-remote-database-aliases[] and xref:database-administration/aliases/manage-aliases-standard-databases.adoc#alter-default-language-remote-database-alias[] for more information.
.Query
[source, cypher]
@@ -368,7 +396,7 @@ USER alice
PASSWORD 'example_secret'
----
-When you create a database alias targeting a remote database, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+To view the remote database alias details, use the `SHOW ALIASES FOR DATABASE` command:
.Query
[source, cypher]
@@ -387,6 +415,11 @@ FOR DATABASE
+----------------------------------------------------------------------------------------------------------+
----
+You can also use `IF EXISTS` or `OR REPLACE` when creating remote database aliases.
+It works the same way as described in the <<_use_if_exists_or_or_replace_when_creating_database_aliases, Use `IF EXISTS` or `OR REPLACE` when creating database aliases>> section.
+Both check for any remote or local database aliases.
+
+
[[alias-management-create-remote-database-alias-driver-settings]]
==== Create remote database aliases with driver settings
@@ -394,17 +427,17 @@ It is possible to override the default driver settings per database alias, which
This is the list of the allowed driver settings for remote database aliases:
-* ssl_enforced (Default: `true`) -- SSL for remote database alias drivers is configured through the target URL scheme.
+* `ssl_enforced` (Default: `true`) -- SSL for remote database alias drivers is configured through the target URL scheme.
If `ssl_enforced` is set to true, a secure URL scheme is enforced.
-This will be validated when the command is executed.
-* connection_timeout -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout]
-* connection_max_lifetime -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].
+It is be validated when the command is executed.
+* `connection_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout].)
+* `connection_max_lifetime` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].)
* connection_pool_acquisition_timeout -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout].
* connection_pool_idle_test -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.idle_test[dbms.routing.driver.connection.pool.idle_test].
-* connection_pool_max_size -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].
-* logging_level (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level])
+* `connection_pool_max_size` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].)
+* `logging_level` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level].)
-The driver settings are set in the `DRIVER` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
+You can set these driver settings when creating a remote database alias using the `DRIVER` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
For example, the following query creates a remote database alias using driver settings `connection_timeout` and
`connection_pool_max_size` for connecting to the remote database `northwind-graph-2020`:
@@ -421,7 +454,7 @@ DRIVER {
}
----
-When a database alias targeting a remote database has been created, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+To view the remote database alias details, including the driver settings, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD *` clause:
.Query
[source, cypher]
@@ -439,11 +472,52 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD *
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
+[role=label--new-2025.06]
+[[set-default-language-for-remote-database-aliases]]
+==== Set a default Cypher version for remote database aliases
+
+You can set a default Cypher version for remote database aliases using the `DEFAULT LANGUAGE` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
+For example, the following query creates a remote database alias with the default language `CYPHER 25`:
+
+.Query
+[source, cypher]
+----
+CREATE ALIAS `remote-with-default-language`
+FOR DATABASE `northwind-graph-2020`
+ AT "neo4j+s://location:7687"
+ USER alice
+ PASSWORD 'example_secret'
+ DEFAULT LANGUAGE CYPHER 25
+----
+
+To view the remote database alias details, including the default language, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
+
+.Query
+[source, cypher]
+----
+SHOW ALIAS `remote-with-default-language` FOR DATABASE YIELD name, defaultLanguage
+----
+
+.Result
+[role="queryresult"]
+----
++--------------------------------------------------+
+| name | defaultLanguage |
++--------------------------------------------------+
+| "remote-with-default-language" | "CYPHER 25" |
++--------------------------------------------------+
+----
+
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+====
==== Set properties for remote database aliases
-Just as the local database aliases, the remote database aliases can be given properties.
-These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()` function].
+You can set properties for remote database aliases using the `PROPERTIES` clause of the `CREATE ALIAS` command.
+These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()`] function.
.Query
[source, cypher]
@@ -453,7 +527,7 @@ USER alice PASSWORD 'password'
PROPERTIES { newestNorthwind: false, index: 6 }
----
-The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command.
+To view the remote database alias properties, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
.Query
[source, cypher]
@@ -475,8 +549,9 @@ SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties
[[alias-management-alter-database-alias]]
== Alter database aliases
-
-Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, URL, user credentials, or driver settings.
+You can alter both local and remote database aliases using the `ALTER ALIAS` command.
+For all aliases, the command allows you to change the target database and properties of the database alias.
+For remote aliases, the command also allows you to change the URL, user credentials, default language, or driver settings of the database alias.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
Only the clauses used will be altered.
@@ -485,10 +560,10 @@ Only the clauses used will be altered.
Local database aliases cannot be altered to remote aliases, or vice versa.
====
-=== Alter local database aliases
-
-Example of altering a local database alias target.
+=== Alter a local database alias target
+You can alter a local database alias to target a different database using the `SET DATABASE TARGET` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -497,8 +572,8 @@ ALTER ALIAS `northwind`
SET DATABASE TARGET `northwind-graph-2021`
----
-When a local database alias has been altered, it will show up in the `aliases` column for the target database provided by the command `SHOW DATABASES`.
-
+To verify that the local database alias has a new target database, you can use the `SHOW DATABASE` command.
+It shows up in the `aliases` column for the target database.
.Query
[source, cypher]
----
@@ -516,42 +591,45 @@ SHOW DATABASE `northwind-graph-2021`
----
-=== Alter remote database aliases
+=== Alter a remote database alias target
-Example of altering a remote database alias target.
+You can alter a remote database alias to target a different remote database using the `SET DATABASE TARGET` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
----
-ALTER ALIAS `remote-northwind` SET DATABASE
-TARGET `northwind-graph-2020` AT "neo4j+s://other-location:7687"
+ALTER ALIAS `remote-northwind`
+SET DATABASE TARGET `northwind-graph-2020` AT "neo4j+s://other-location:7687"
----
-=== Alter remote credentials and driver settings for remote database aliases
+=== Alter a remote database alias credentials and driver settings
-Example of altering a remote database alias credentials and driver settings.
+You can change the user credentials and driver settings of a remote database alias using the `USER`, `PASSWORD`, and `DRIVER` subclauses of the `SET DATABASE` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
----
-ALTER ALIAS `remote-with-driver-settings` SET DATABASE
-USER bob
-PASSWORD 'new_example_secret'
-DRIVER {
- connection_timeout: duration({ minutes: 1}),
- logging_level: 'debug'
-}
+ALTER ALIAS `remote-with-driver-settings`
+SET DATABASE
+ USER bob
+ PASSWORD 'new_example_secret'
+ DRIVER {
+ connection_timeout: duration({ minutes: 1}),
+ logging_level: 'debug'
+ }
----
[IMPORTANT]
====
All driver settings are replaced by the new ones.
-In this case, by not repeating the driver setting `connection_pool_max_size` the value will be deleted and fall back to the default value.
+In this case, by not repeating the driver setting `connection_pool_max_size`, the value will be deleted and fall back to the default value.
====
-=== Remove custom driver settings from remote database aliases
+=== Remove all custom driver settings from a remote database alias
-Example of altering a remote database alias to remove all custom driver settings.
+You can remove all custom driver settings from a remote database alias by setting the `DRIVER` clause to an empty map `{}`.
.Query
[source, cypher]
@@ -560,9 +638,30 @@ ALTER ALIAS `movie scripts` SET DATABASE
DRIVER {}
----
-=== Alter properties for local and remote database aliases
+[role=label--new-2025.06]
+[[alter-default-language-remote-database-alias]]
+=== Alter the default Cypher version of a remote database alias
+
+You can alter the default Cypher version of a remote database alias using the `SET DATABASE DEFAULT LANGUAGE` clause of the `ALTER ALIAS` command.
+For example:
+
+.Query
+[source, cypher]
+----
+ALTER ALIAS `remote-with-default-language`
+SET DATABASE DEFAULT LANGUAGE CYPHER 5
+----
+
+[NOTE]
+====
+Setting the default language to `CYPHER 5` ensures that all queries run on that database will use the version of `Cypher 5` as it existed at the time of the Neo4j 2025.06 release (unless you prepend your queries with `CYPHER 25`, which overrides this default).
+Any changes introduced after the 2025.06 release will not affect the semantics of the query.
+====
-Examples of altering local and remote database alias properties.
+=== Alter properties of local and remote database aliases
+
+You can alter the properties of a local or remote database alias using the `SET DATABASE PROPERTIES` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -597,13 +696,14 @@ ALTER ALIAS `no-alias` IF EXISTS SET DATABASE TARGET `northwind-graph-2021`
[[alias-management-drop-database-alias]]
== Delete database aliases
-Both local and remote database aliases can be deleted using the `DROP ALIAS` command.
+You can delete both local and remote database aliases using the `DROP ALIAS` command.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
=== Delete local database aliases
-Delete a local database alias.
+You can delete a local database alias using the `DROP ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -611,7 +711,8 @@ Delete a local database alias.
DROP ALIAS `northwind` FOR DATABASE
----
-When a database alias has been deleted, it will no longer show up in the `aliases` column provided by the command `SHOW DATABASES`.
+To verify that the local database alias has been deleted, you can use the `SHOW DATABASES` command.
+The deleted alias will no longer appear in the `aliases` column.
.Query
[source, cypher]
@@ -631,7 +732,8 @@ SHOW DATABASE `northwind-graph-2021`
=== Delete remote database aliases
-Delete a remote database alias.
+You can delete a remote database alias using the `DROP ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -639,7 +741,7 @@ Delete a remote database alias.
DROP ALIAS `remote-northwind` FOR DATABASE
----
-When a database alias has been deleted, it will no longer show up in the `SHOW ALIASES FOR DATABASE` command.
+To verify that the remote database alias has been deleted, you can use the `SHOW ALIASES FOR DATABASE` command.
.Query
[source, cypher]
@@ -658,7 +760,6 @@ SHOW ALIASES `remote-northwind` FOR DATABASE
=== Use `IF EXISTS` when deleting database aliases
-
The `DROP ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist.
Inserting `IF EXISTS` after the alias name ensures that no error is returned and nothing happens should the alias not exist.
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
new file mode 100644
index 000000000..bb753254e
--- /dev/null
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -0,0 +1,58 @@
+:description: This page describes how to alter composite databases.
+:page-role: new-2025.06 enterprise-edition not-on-aura
+[[composite-databases-alter]]
+= Alter composite databases
+
+You can modify composite databases using the Cypher command `ALTER DATABASE`.
+
+== Syntax
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| ALTER DATABASE
+|
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+SET DEFAULT LANGUAGE CYPHER {5\|25}
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+|===
+
+[role=label--new-2025.06]
+[[alter-default-language-composite-database]]
+== Alter the default Cypher version of a composite database
+
+You can change the default Cypher version of an existing composite database using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
+For example:
+
+[source, cypher]
+----
+ALTER DATABASE inventory SET DEFAULT LANGUAGE CYPHER 25
+----
+
+This command will change the default Cypher version of the composite database `inventory` to Cypher 25.
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2* Upgrade to a Neo4j 2025 release -> Clusters].
+====
== Standard databases
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index d5e186a0a..4764774ed 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -1,5 +1,4 @@
:description: how to modify standard databases in Neo4j using the Cypher command `ALTER DATABASE`.
-[role=enterprise-edition not-on-aura]
[[administration-databases-alter-database]]
= Alter databases
@@ -19,7 +18,8 @@ ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value
+SET OPTION option value \|
+SET DEFAULT LANGUAGE CYPHER {5\|25}
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -30,13 +30,16 @@ ALTER DATABASE name [IF EXISTS]
REMOVE OPTION option
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
+|===
[NOTE]
====
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
+
+`SET DEFAULT LANGUAGE CYPHER {5|25}` is available from Neo4j 2025.06 onwards.
====
-|===
+[role=label--enterprise-edition label--not-on-aura]
[[manage-databases-alter]]
== Alter database access mode
@@ -59,11 +62,11 @@ Modifying access mode is only available to standard databases and not composite
=== Alter database access mode to read-only
-To modify the database access mode, use the following command where `customers` is the database name:
+To modify the database access mode, use the following command where `actors` is the database name:
[source, cypher]
----
-ALTER DATABASE customers SET ACCESS READ ONLY
+ALTER DATABASE actors SET ACCESS READ ONLY
----
The database access mode can be seen in the `access` output column of the command `SHOW DATABASES`:
@@ -79,7 +82,7 @@ SHOW DATABASES yield name, access
+----------------------------+
| name | access |
+----------------------------+
-| "customers" | "read-only" |
+| "actors" | "read-only" |
| "movies" | "read-write" |
| "neo4j" | "read-write" |
| "system" | "read-write" |
@@ -97,13 +100,49 @@ ALTER DATABASE nonExisting IF EXISTS
SET ACCESS READ WRITE
----
+[role=label--new-2025.06]
+[[alter-database-default-language]]
+== Alter the default Cypher version of an existing database
+
+You can change the default Cypher version of an existing database, including the `system` database, using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
+For example:
+
+[source, cypher]
+----
+ALTER DATABASE movies SET DEFAULT LANGUAGE CYPHER 25
+----
+This command will change the default Cypher version of the database `movies` to Cypher 25.
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2* Upgrade a cluster].
-====
-
-[[create-neo4j-database]]
-== Create databases
-
You can create a database using the Cypher command `CREATE DATABASE`.
The initial contents of the database depend on the state of the server and the options provided to the command.
-When no additional options are provided, `CREATE DATABASE` will attempt to mount any pre-existing store files in place (e.g., as the result of restoring a backup).
+When no additional options are provided, `CREATE DATABASE` will attempt to mount any pre-existing store files in place (e.g., as the result of restoring a backup).
If no pre-existing store files are available, it will create an empty database.
[NOTE]
@@ -30,19 +21,19 @@ Having dots (`.`) in the database names is not recommended.
This is due to the difficulty of determining if a dot is part of the database name or a delimiter for a database alias in a composite database.
====
-`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
+`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
Alternatively, you can set the store format of new databases using the `CREATE DATABASE databasename OPTIONS {storeFormat: 'the-new-format'}` command.
However, if the store is seeded with `seedURI`, `existingDataSeedServer` or `existingDataSeedInstance`, or if the command is being used to mount pre-existing store files already present on the disk, they will use their current store format without any alterations.
See xref:database-internals/store-formats.adoc[Store formats], for more details about available database store formats in Neo4j.
-=== Syntax
+== Syntax
[options="header", width="100%", cols="1m,5a"]
[.tabbed-example]
=====
-[role=include-with-Cypher-5]
+[role=include-with-cypher-5]
======
[options="header", width="100%", cols="1m,5a"]
|===
@@ -53,6 +44,7 @@ See xref:database-internals/store-formats.adoc[Store formats], for more details
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -61,15 +53,20 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available in Cypher 5 starting from Neo4j 2025.06 onwards.
+====
======
-[role=include-with-Cypher-25]
+[role=include-with-cypher-25]
======
[options="header", width="100%", cols="1m,5a"]
@@ -80,6 +77,7 @@ CREATE OR REPLACE DATABASE name
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -88,22 +86,28 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards. +
+`[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` is replaced by `[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` in Cypher 25.
+====
======
=====
[[manage-databases-create-database-options]]
-=== Options
+== Options
[.tabbed-example]
=====
-[.include-with-cypher-5]
+[role=include-with-cypher-5]
======
The `CREATE DATABASE` command can have a map of options, e.g. `OPTIONS {key: 'value'}`.
@@ -171,7 +175,7 @@ The `existingDataSeedInstance` and `existingDataSeedServer` are still not suppor
More details about seeding options can be found in xref::clustering/databases.adoc#cluster-seed[Seed a cluster].
====
======
-[.include-with-cypher-25]
+[role=include-with-cypher-25]
======
The `CREATE DATABASE [OR REPLACE]` command can have a map of options, e.g., `OPTIONS {key: 'value'}`.
@@ -214,36 +218,41 @@ If the store is seeded with `seedURI` or `existingDataSeedServer`, or if the com
| `seedRestoreUntil`
| Datetime or transaction id. E.g. `datetime("2025-01-01T12:15:00.000+0100")` or `123456`
-|
+|
If you are passing a `seedURI` that leads to a backup chain, including differential backups, you can choose to not apply all the transactions in the differential backups.
To seed up to a specific date, specify a `datetime`.
This will seed the database with transactions committed before the provided timestamp.
To seed up to a specific transaction ID, specify a transaction ID.
This will seed the database with transactions up to, but not including the specified transaction.
-| `seedSourceDatabase`
+| `seedSourceDatabase` label:new[Introduced in 2025.06]
| A source database name
|
If the `seedURI` points to a folder containing backups for multiple databases, you can specify the database name to filter the artifacts.
-| `existingData` label:deprecated[Deprecated]
+| `existingData` label:deprecated[Deprecated in 2025.06]
| `use`
|
Included for backward compatibility only, has no effect and will be removed in a future version.
|===
+
+[NOTE]
+====
+In Cypher 25, the options `seedCredentials` and `existingDataSeedInstance` have been removed, while the `existingData` option is now deprecated and has no effect.
+====
======
=====
-=== Examples
+The following examples show how to create a database using the `CREATE DATABASE` command with various options.
-==== Create a database
+== Create a database
-To create a database named `customers`, use the command `CREATE DATABASE` followed by the name of this database.
+To create a database named `actors`, use the command `CREATE DATABASE` followed by the name of this database.
[source, cypher]
----
-CREATE DATABASE customers
+CREATE DATABASE actors
----
When you create a database, it shows up in the listing provided by the command `SHOW DATABASES`:
@@ -259,7 +268,7 @@ SHOW DATABASES YIELD name
+-------------+
| name |
+-------------+
-| "customers" |
+| "actors" |
| "movies" |
| "neo4j" |
| "system" |
@@ -267,11 +276,11 @@ SHOW DATABASES YIELD name
----
-==== Create a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
+== Create a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
[.tabbed-example]
=====
-[.include-with-cypher-5]
+[role=include-with-cypher-5]
======
Sub-clause `WAIT` allows you to specify a time limit for the command to complete and return.
@@ -293,7 +302,7 @@ CREATE DATABASE slow WAIT 5 SECONDS
The `success` column provides an aggregate status of whether or not the command is considered successful.
Thus, every row has the same value, determined on a successful completion without a timeout.
======
-[.include-with-cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
Sub-clause `WAIT` allows you to specify a time limit for the command to complete and return.
@@ -316,11 +325,11 @@ info: Server `ServerId{0f7cb48e}` at address `server3:7687` has caught up.
----
The command returns a notification for each server in the cluster to indicate the status of that command on that server.
-In this example, all three cluster members have returned `Neo.ClientNotification.Cluster.ServerCaughtUp`, which indicates that the server has applied the command successfully and is up to date.
+In this example, all three cluster members have returned `03N85 (Neo.ClientNotification.Cluster.ServerCaughtUp)`, which indicates that the server has applied the command successfully and is up to date.
======
=====
-==== Create databases with `IF NOT EXISTS` or `OR REPLACE`
+== Create a database with `IF NOT EXISTS` or `OR REPLACE`
The `CREATE DATABASE` command is optionally idempotent, with the default behavior to fail with an error if the database already exists.
There are two ways to circumvent this behavior.
@@ -329,17 +338,17 @@ First, appending `IF NOT EXISTS` to the command ensures that no error is returne
[source, cypher]
----
-CREATE DATABASE customers IF NOT EXISTS
+CREATE DATABASE actors IF NOT EXISTS
----
Second, adding `OR REPLACE` to the command deletes any existing database and creates a new one.
[source, cypher]
----
-CREATE OR REPLACE DATABASE customers
+CREATE OR REPLACE DATABASE actors
----
-This is equivalent to running `DROP DATABASE customers IF EXISTS` followed by `CREATE DATABASE customers`.
+This is equivalent to running `DROP DATABASE actors IF EXISTS` followed by `CREATE DATABASE actors`.
Keep in mind that using `CREATE OR REPLACE DATABASE` also removes indexes and constraints.
To preserve them, run the following Cypher commands before the `CREATE OR REPLACE DATABASE` and save their outputs:
@@ -363,141 +372,38 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
+[role=label--new-2025.06]
+== Set a default Cypher version for a standard database
-[[manage-databases-start]]
-== Start databases
-
-Databases can be started using the command `START DATABASE`.
-
-[NOTE]
-====
-Both standard databases and composite databases can be started using this command.
-====
-
-
-=== Syntax
-
-[options="header", width="100%", cols="1m,5a"]
-|===
-| Command | Syntax
-
-| START DATABASE
-|
-[source, syntax, role="noheader"]
-----
-START DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
-
-|===
-
-=== Examples
-
-==== Start a database
-
-Starting a database is a straightforward operation.
-Suppose you have a database named `customers`.
-To start it, use the following command:
+You can set the default Cypher version for a database when creating it.
+If not specified, the version for that database will be set to the default Cypher version of the DBMS.
+For example:
[source, cypher]
----
-START DATABASE customers
+CREATE DATABASE actors DEFAULT LANGUAGE CYPHER 25
----
+This command creates a database named `actors` with the default Cypher version set to 25.
-You can see the status of the started database by running the command `SHOW DATABASE name`.
-
-[source, cypher]
-----
-SHOW DATABASE customers YIELD name, requestedStatus, currentStatus
-----
+include::partial$/view-cypher-version.adoc[]
.Result
-[role="queryresult"]
-----
-+-----------------------------------------------+
-| name | requestedStatus | currentStatus |
-+-----------------------------------------------+
-| "customers" | "online" | "online" |
-+-----------------------------------------------+
-----
-
-
-==== Start a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
-
-You can start your database using `WAIT` sub-clause to ensure that the command waits for a specified amount of time until the database is started.
-
-[source, cypher]
-----
-START DATABASE customers WAIT 5 SECONDS
-----
-
-
-[[manage-databases-stop]]
-== Stop databases
-
-Databases can be stopped using the command `STOP DATABASE`.
-
-=== Syntax
-
-[options="header", width="100%", cols="1m,5a"]
+[role="queryresult",options="header,footer",cols="2*
+|defaultLanguage
+|The default Cypher version for this database.
+Queries that are not prefixed with a Cypher version will be executed with the Cypher version of the database. label:new[Introduced in Neo4j 2026.06]
+|STRING
+
|options
|The map of options applied to the database.
@@ -213,9 +218,11 @@ The results of the `SHOW DATABASES` command are filtered according to the `ACCES
However, some privileges enable users to see additional databases regardless of their `ACCESS` privileges:
* Users with `CREATE/DROP/ALTER DATABASE` or `SET DATABASE ACCESS` privileges can see all standard databases.
-* Users with `CREATE/DROP COMPOSITE DATABASE` or `COMPOSITE DATABASE MANAGEMENT` privileges can see all composite databases.
+* Users with `CREATE/DROP/ALTER COMPOSITE DATABASE` or `COMPOSITE DATABASE MANAGEMENT` privileges can see all composite databases.
* Users with `DATABASE MANAGEMENT` privilege can see all databases.
+The `SET DATABASE DEFAULT LANGUAGE` privilege is intentionally left out and does not affect the returned databases.
+
If a user has not been granted `ACCESS` privilege to any databases nor any of the above special cases, the command can still be executed but it will only return the `system` database, which is always visible.
[[database-states]]
@@ -318,11 +325,11 @@ SHOW DATABASE movies YIELD *
.Result
[role="queryresult"]
----
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| name | type | aliases | access | databaseID | serverID | address | role | writer | requestedStatus | currentStatus | statusMessage | default | home | currentPrimariesCount | currentSecondariesCount | requestedPrimariesCount | requestedSecondariesCount | creationTime | lastStartTime | lastStopTime | store | lastCommittedTxn | replicationLag | constituents | options |
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| "movies" | "standard" | ["films", "motion pictures"] | "read-write" | "C066801F54B44EA1520F0FE392B4005AABF42D8DD0A5FD09969B955575D287D5" | "e3063985-e2f4-4728-824b-a7d53779667a" | "localhost:7687" | "primary" | TRUE | "online" | "online" | "" | FALSE | FALSE | 1 | 0 | 1 | 0 | 2023-08-14T10:01:29.074Z | 2023-08-14T10:01:29.074Z | NULL | "record-aligned-1.1" | 3 | 0 | [] | {} |
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | type | aliases | access | databaseID | serverID | address | role | writer | requestedStatus | currentStatus | statusMessage | default | home | currentPrimariesCount | currentSecondariesCount | requestedPrimariesCount | requestedSecondariesCount | creationTime | lastStartTime | lastStopTime | store | lastCommittedTxn | replicationLag | constituents | defaultLanguage | options |
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| "movies" | "standard" | ["films", "motion pictures"] | "read-write" | "C066801F54B44EA1520F0FE392B4005AABF42D8DD0A5FD09969B955575D287D5" | "e3063985-e2f4-4728-824b-a7d53779667a" | "localhost:7687" | "primary" | TRUE | "online" | "online" | "" | FALSE | FALSE | 1 | 0 | 1 | 0 | 2023-08-14T10:01:29.074Z | 2023-08-14T10:01:29.074Z | NULL | "record-aligned-1.1" | 3 | 0 | [] | "CYPHER 5" | {} |
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
== Show the number of databases
@@ -421,3 +428,20 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results.
| "neo4j" | "online" | "online" |
+--------------------------------------------+
----
+
+[role=label--new-2025.06]
+== Show the default Cypher version of a database
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2*> for details.
+
+This page summarizes the various command syntax options.
+It also includes examples for both Cypher 5 and Cypher 25 when available.
+
+include::partial$/cypher-versions.adoc[]
-See below a summary of the syntax used to describe all versions of a command.
-These summaries use some special characters to indicate such variations.
[[administration-syntax-reading]]
== Reading the administration commands syntax
@@ -107,17 +112,17 @@ YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[.tabbed-example]
=====
-[role=include-with-Cypher-5]
+[role=include-with-cypher-5]
======
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
-
| CREATE DATABASE
|
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -126,15 +131,20 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
======
-[role=include-with-Cypher-25]
+[role=include-with-cypher-25]
======
[options="header", width="100%", cols="1m,5a"]
@@ -145,6 +155,7 @@ CREATE OR REPLACE DATABASE name
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -153,16 +164,27 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards. +
+`[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` is replaced by `[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` in Cypher 25.
+====
======
=====
+
=== Create a composite database
+[.tabbed-example]
+=====
+[role=include-with-cypher-5]
+======
[options="header", width="100%", cols="2m,4a"]
|===
| Command | Syntax
@@ -172,6 +194,7 @@ CREATE OR REPLACE DATABASE name
[source, synatx, role="noheader"]
----
CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[OPTIONS "{" "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -179,11 +202,51 @@ CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE COMPOSITE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[OPTIONS "{" "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+======
+
+[role=include-with-cypher-25]
+======
+[options="header", width="100%", cols="2m,4a"]
+|===
+| Command | Syntax
+
+| CREATE COMPOSITE DATABASE
+|
+[source, synatx, role="noheader"]
+----
+CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
+[OPTIONS "{" "}"]
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+[source, syntax, role="noheader"]
+----
+CREATE OR REPLACE COMPOSITE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
+[OPTIONS "{" "}"]
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+|===
+
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+======
+=====
+
+
=== Alter a database
[options="header", width="100%", cols="1m,5a"]
@@ -198,22 +261,43 @@ ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value
+SET OPTION option value \|
+SET DEFAULT LANGUAGE CYPHER {5\|25}
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
-[source, syntax]
+[source, syntax, role="noheader"]
----
ALTER DATABASE name [IF EXISTS]
REMOVE OPTION option
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
+|===
+
[NOTE]
====
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
+
+`SET DEFAULT LANGUAGE CYPHER {5|25}` is available from Neo4j 2025.06 onwards.
====
+
+[role=label--new-2025.06]
+=== Alter a composite database
+
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+| ALTER DATABASE
+|
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+SET DEFAULT LANGUAGE CYPHER {5\|25}
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
|===
=== Stop a database
@@ -319,6 +403,7 @@ CREATE OR REPLACE ALIAS name FOR DATABASE targetName
CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName
AT 'url' USER username PASSWORD 'password'
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
[source, syntax, role=noheader]
@@ -326,10 +411,16 @@ AT 'url' USER username PASSWORD 'password'
CREATE OR REPLACE ALIAS name FOR DATABASE targetName
AT 'url' USER username PASSWORD 'password'
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+
=== Alter a local alias
[options="header", width="100%", cols="1m,5a"]
@@ -360,11 +451,16 @@ ALTER ALIAS name [IF EXISTS] SET DATABASE
[USER username]
[PASSWORD 'password']
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
-
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+
=== Delete an alias
[options="header", width="100%", cols="1m,5a"]
diff --git a/modules/ROOT/pages/database-internals/store-formats.adoc b/modules/ROOT/pages/database-internals/store-formats.adoc
index 1491a2c4f..6f4f89185 100644
--- a/modules/ROOT/pages/database-internals/store-formats.adoc
+++ b/modules/ROOT/pages/database-internals/store-formats.adoc
@@ -92,7 +92,7 @@ You can either set the store format when creating a new database or change the s
[[create-new-databases]]
=== Creating new databases
-`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
+`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
You can also create a new database on a specific store format by passing the new format as an argument to the command creating the database, for example, xref:import.adoc#import-tool-full[`neo4j-admin database import full`] or xref:backup-restore/copy-database.adoc[`neo4j-admin database copy`] commands, or by using `storeFormat:` option in the Cypher command `CREATE DATABASE`.
diff --git a/modules/ROOT/pages/introduction.adoc b/modules/ROOT/pages/introduction.adoc
index 328b1b346..8bf2ef587 100644
--- a/modules/ROOT/pages/introduction.adoc
+++ b/modules/ROOT/pages/introduction.adoc
@@ -283,7 +283,7 @@ For more information about what data is collected, see link:https://neo4j.com/do
====
[[versioning]]
-== Versioning
+== Neo4j server versions
2025.01.0 introduces a new calendar versioning (CalVer) for the Neo4j server instead of the previously used semantic versioning (SemVer).
The new versioning format, *YYYY.MM.Patch*, is based on the year and month of the release, for example, 2025.01.0, 2025.02.0, and so on.
@@ -293,6 +293,8 @@ Some of the releases will be designated as long-term support (LTS) releases.
link:{aura-uri}[Neo4j Aura] always uses the latest version of the Neo4j server.
+include::partial$/cypher-versions.adoc[]
+
== Operations Manual versioning
The Operations Manual is versioned according to the calendar version of the Neo4j server.
diff --git a/modules/ROOT/partials/cypher-versions.adoc b/modules/ROOT/partials/cypher-versions.adoc
new file mode 100644
index 000000000..6b58018c1
--- /dev/null
+++ b/modules/ROOT/partials/cypher-versions.adoc
@@ -0,0 +1,17 @@
+[role=label--new-2025.06]
+== Cypher® versions
+
+The Cypher language has been decoupled from the Neo4j server versioning and now has its own versioning system.
+You can choose between Cypher 5 and Cypher 25:
+
+* Cypher 5 is the language version with which all queries written for Neo4j 2025.05 and earlier versions are compatible.
+It remains the default version for all newly created databases; however, as of Neo4j 2025.06, it is frozen and will only receive performance enhancements and bug fixes in future server releases.
+
+* Cypher 25 is the new version of the Cypher language.
+It builds upon Cypher 5 and includes new and improved features, as well as some removals.
+Any new Cypher features introduced in Neo4j 2025.06 or later will be added only to Cypher 25.
+
+For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
+
+You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, for a database, or by setting it on a per-query basis.
+For details, see the xref:configuration/cypher-version-configuration.adoc[].
diff --git a/modules/ROOT/partials/view-cypher-version.adoc b/modules/ROOT/partials/view-cypher-version.adoc
new file mode 100644
index 000000000..1392520f2
--- /dev/null
+++ b/modules/ROOT/partials/view-cypher-version.adoc
@@ -0,0 +1,8 @@
+To view the default Cypher version of each database in the DBMS, run the command `SHOW DATABASES` with the `YIELD` clause and specify the `defaultLanguage` column.
+For example:
+
+.Query
+[source, cypher]
+----
+SHOW DATABASES YIELD name, defaultLanguage
+----
\ No newline at end of file