From 463a27e9448f7d95be74f73259c7f41313eed579 Mon Sep 17 00:00:00 2001
From: Mark Dixon <1756429+mnd999@users.noreply.github.com>
Date: Tue, 25 Feb 2025 16:31:33 +0000
Subject: [PATCH 01/65] WIP default language docs
---
..._grant_and_deny_syntax_dbms_privileges.svg | 143 +---
.../ROOT/images/privileges_hierarchy_dbms.svg | 751 +-----------------
.../standard-databases/alter-databases.adoc | 5 +
.../standard-databases/create-databases.adoc | 5 +
4 files changed, 12 insertions(+), 892 deletions(-)
diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
index 3d08de6ec..889231a99 100644
--- a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
+++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
@@ -1,142 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/images/privileges_hierarchy_dbms.svg b/modules/ROOT/images/privileges_hierarchy_dbms.svg
index 77c37a377..e4f22ea54 100644
--- a/modules/ROOT/images/privileges_hierarchy_dbms.svg
+++ b/modules/ROOT/images/privileges_hierarchy_dbms.svg
@@ -1,750 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index d5e186a0a..9b2f86a00 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -18,6 +18,7 @@ You can modify standard databases using the Cypher command `ALTER DATABASE`.
ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
+SET DEFAULT LANGUAGE CYPHER {5\|25} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
SET OPTION option value
}
@@ -97,6 +98,10 @@ ALTER DATABASE nonExisting IF EXISTS
SET ACCESS READ WRITE
----
+== Alter database default language
+The `ALTER DATABASE` command can be used to set the default Cypher version for a database.
+For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/##alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
+
== Alter database topology
In a cluster environment, you can use the `ALTER DATABASE` command to change the number of servers hosting a database.
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index 494f4efb4..b9c5246fe 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -53,6 +53,7 @@ See xref:database-internals/store-formats.adoc[Store formats], for more details
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -61,6 +62,7 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -363,6 +365,9 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
+==== Create databases with `DEFAULT LANGUAGE`
+The `CREATE DATABASE` command can be used to set the default Cypher version when creating a database.
+For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#select-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
[[manage-databases-start]]
== Start databases
From 71a45d4afb8aa8f89b1f3c27964c63c7d890b06d Mon Sep 17 00:00:00 2001
From: Mark Dixon <1756429+mnd999@users.noreply.github.com>
Date: Tue, 25 Feb 2025 16:48:46 +0000
Subject: [PATCH 02/65] WIP default language docs
---
.../authentication-authorization/dbms-administration.adoc | 6 ++++++
.../standard-databases/alter-databases.adoc | 2 +-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 0d3b6db31..2c300ee93 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -884,6 +884,12 @@ GRANT [IMMUTABLE] SET DATABASE ACCESS
TO role[, ...]
| Enables the specified roles to modify access to standard databases.
+| [source, syntax, role=noheader]
+GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON DBMS
+ TO role[, ...]
+| Enables the specified roles to set the default query language on a database.
+
| [source, syntax, role=noheader]
GRANT CREATE COMPOSITE DATABASE
ON DBMS
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index 9b2f86a00..615289436 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -100,7 +100,7 @@ SET ACCESS READ WRITE
== Alter database default language
The `ALTER DATABASE` command can be used to set the default Cypher version for a database.
-For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/##alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
+For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
== Alter database topology
From 83bd0dba3446953dca1b56014a1c4289ab3cdb0c Mon Sep 17 00:00:00 2001
From: Mark Dixon <1756429+mnd999@users.noreply.github.com>
Date: Wed, 26 Feb 2025 10:38:30 +0000
Subject: [PATCH 03/65] WIP default language docs
---
.../create-composite-databases.adoc | 12 ++++++++++++
.../standard-databases/alter-databases.adoc | 4 +++-
.../configuration-parameters.adoc | 9 +++++++++
.../standard-databases/listing-databases.adoc | 15 ++++++++++-----
.../pages/database-administration/syntax.adoc | 2 ++
5 files changed, 36 insertions(+), 6 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
index 444ee6614..92526db66 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
@@ -93,6 +93,18 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
+[[composite-databases-default-language]]
+=== Create composite databases with `DEFAULT LANGUAGE`
+The `CREATE COMPOSITE DATABASE` command can be used to set the default Cypher version when creating a composite database.
+
+.Query
+[source, cypher]
+----
+CREATE COMPOSITE DATABASE inventory DEFAULT LANGUAGE CYPHER 5
+----
+
+For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#select-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
+
[[composite-databases-stop]]
== Stop composite databases
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index 615289436..c1972199b 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -1,5 +1,4 @@
:description: how to modify standard databases in Neo4j using the Cypher command `ALTER DATABASE`.
-[role=enterprise-edition not-on-aura]
[[administration-databases-alter-database]]
= Alter databases
@@ -38,6 +37,7 @@ There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different opti
====
|===
+[role=enterprise-edition not-on-aura]
[[manage-databases-alter]]
== Alter database access mode
@@ -102,11 +102,13 @@ SET ACCESS READ WRITE
The `ALTER DATABASE` command can be used to set the default Cypher version for a database.
For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
+[role=enterprise-edition not-on-aura]
== Alter database topology
In a cluster environment, you can use the `ALTER DATABASE` command to change the number of servers hosting a database.
For more information, see xref::clustering/databases.adoc#alter-topology[Managing databases in a cluster].
+[role=enterprise-edition not-on-aura]
[[alter-database-options]]
== `ALTER DATABASE` options
diff --git a/modules/ROOT/pages/database-administration/standard-databases/configuration-parameters.adoc b/modules/ROOT/pages/database-administration/standard-databases/configuration-parameters.adoc
index 402bebffd..8117db141 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/configuration-parameters.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/configuration-parameters.adoc
@@ -93,6 +93,15 @@ Example configuration:
----
server.databases.writable=["foo", "bar"]
----
+| xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`]
+a|
+The default query language version used for newly created databases where not specified as part of `CREATE` or `ALTER` database. This will also be used for `system` and `neo4j` databases when a new DBMS is started.
+
+Example configuration:
+[source, example, role="noheader"]
+----
+db.query.default_language=CYPHER_5
+----
|===
[NOTE]
diff --git a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
index c1670a6ec..f292f3c59 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
@@ -201,6 +201,11 @@ For other database states the value will be `NULL`.
|The names of any constituents the database may have. Applicable only for composite databases. label:default-output[]
| LIST
+|defaultLanguage
+|The default query language for this database.
+Queries that are not prefixed with a query language version will default to executing with theis version of Cypher.
+|STRING
+
|options
|The map of options applied to the database.
@@ -318,11 +323,11 @@ SHOW DATABASE movies YIELD *
.Result
[role="queryresult"]
----
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| name | type | aliases | access | databaseID | serverID | address | role | writer | requestedStatus | currentStatus | statusMessage | default | home | currentPrimariesCount | currentSecondariesCount | requestedPrimariesCount | requestedSecondariesCount | creationTime | lastStartTime | lastStopTime | store | lastCommittedTxn | replicationLag | constituents | options |
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| "movies" | "standard" | ["films", "motion pictures"] | "read-write" | "C066801F54B44EA1520F0FE392B4005AABF42D8DD0A5FD09969B955575D287D5" | "e3063985-e2f4-4728-824b-a7d53779667a" | "localhost:7687" | "primary" | TRUE | "online" | "online" | "" | FALSE | FALSE | 1 | 0 | 1 | 0 | 2023-08-14T10:01:29.074Z | 2023-08-14T10:01:29.074Z | NULL | "record-aligned-1.1" | 3 | 0 | [] | {} |
-+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | type | aliases | access | databaseID | serverID | address | role | writer | requestedStatus | currentStatus | statusMessage | default | home | currentPrimariesCount | currentSecondariesCount | requestedPrimariesCount | requestedSecondariesCount | creationTime | lastStartTime | lastStopTime | store | lastCommittedTxn | replicationLag | constituents | defaultLanguage | options |
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| "movies" | "standard" | ["films", "motion pictures"] | "read-write" | "C066801F54B44EA1520F0FE392B4005AABF42D8DD0A5FD09969B955575D287D5" | "e3063985-e2f4-4728-824b-a7d53779667a" | "localhost:7687" | "primary" | TRUE | "online" | "online" | "" | FALSE | FALSE | 1 | 0 | 1 | 0 | 2023-08-14T10:01:29.074Z | 2023-08-14T10:01:29.074Z | NULL | "record-aligned-1.1" | 3 | 0 | [] | "CYPHER 5" | {} |
++----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
== Show the number of databases
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index 99fc4b4f4..bf573a434 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -118,6 +118,7 @@ YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -197,6 +198,7 @@ CREATE OR REPLACE COMPOSITE DATABASE name
ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
+SET DEFAULT LANGUAGE CYPHER {5\|25} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
SET OPTION option value
}
From cb48c0b4cad611b9b94c320739b213be9ca738c6 Mon Sep 17 00:00:00 2001
From: Mark Dixon <1756429+mnd999@users.noreply.github.com>
Date: Wed, 26 Feb 2025 13:30:10 +0000
Subject: [PATCH 04/65] Update
modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
Co-authored-by: Therese Magnusson
---
.../standard-databases/listing-databases.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
index f292f3c59..5618a15ad 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
@@ -203,7 +203,7 @@ For other database states the value will be `NULL`.
|defaultLanguage
|The default query language for this database.
-Queries that are not prefixed with a query language version will default to executing with theis version of Cypher.
+Queries that are not prefixed with a query language version will default to executing with this version of Cypher.
|STRING
|options
From aa70f15f09808ba21245c2aaa73ea1e627b82c6f Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Wed, 26 Feb 2025 15:22:14 +0100
Subject: [PATCH 05/65] Add some sentences about default language and aliases
---
.../aliases/manage-aliases-composite-databases.adoc | 1 +
.../aliases/manage-aliases-standard-databases.adoc | 10 ++++++++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index 2b190c698..a724bedc0 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -18,6 +18,7 @@ CREATE DATABASE `perennial-flowers`;
----
////
+Aliases in composite databases cannot be assigned default languages, they will always get the default from the composite database.
[[manage-aliases-composite-databases-list]]
== List database aliases in composite databases
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index a3f38143f..8666fac05 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -16,9 +16,9 @@ For more information, see xref:database-administration/aliases/manage-aliases-co
A local database alias can be used in all other Cypher commands in place of the target database.
Please note that the local database alias will be resolved while executing the command.
-Privileges are defined on the database, and not the local database alias.
+Privileges and default language are defined on the database, and not the local database alias.
-A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, `USE` clauses, setting a user's home database, and defining the access privileges to the remote database.
+A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, `USE` clauses, setting a user's home database, and defining the access privileges and default language for queries to the remote database.
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
@@ -290,6 +290,8 @@ SHOW ALIAS `northwind` FOR DATABASE
+---------------------------------------------------------------------------+
----
+Local database aliases cannot be assigned default languages, they will always get the default from their target database.
+
=== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
The `CREATE ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists.
@@ -356,6 +358,10 @@ SHOW ALIAS `northwind-2022` FOR DATABASE YIELD name, properties
A database alias can target a remote database by providing an URL and the credentials of a user on the remote Neo4j DBMS.
See xref:database-administration/aliases/remote-database-alias-configuration.adoc[] for the necessary configurations.
+Since remote database aliases target databases that are not in this DBMS, they do not fetch the default language from their target like the local database aliases.
+Instead, remote database aliases are assigned the default language given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`] on creation.
+There is currently no command to set it explicitly nor change it on existing remote database aliases.
+
As with local database aliases, creating remote database aliases allows `IF NOT EXISTS` and `OR REPLACE` clauses.
Both check for any remote or local database aliases.
From 1a5655de579b1df075bd0826660a07bc883839c3 Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Thu, 13 Mar 2025 15:14:35 +0100
Subject: [PATCH 06/65] Add info about default language clauses for aliases
---
.../manage-aliases-composite-databases.adoc | 16 ++---
.../manage-aliases-standard-databases.adoc | 69 ++++++++++++++++---
.../pages/database-administration/syntax.adoc | 3 +
3 files changed, 69 insertions(+), 19 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index a724bedc0..f8bcfbf16 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -154,14 +154,14 @@ SHOW ALIASES FOR DATABASE YIELD *
.Result
[role="queryresult"]
----
-+-----------------------------------------------------------------------------------------------------------------------------------+
-| name | composite | database | location | url | user | driver | properties |
-+-----------------------------------------------------------------------------------------------------------------------------------+
-| "garden.flowers" | "garden" | "perennial-flowers" | "local" | NULL | NULL | NULL | {perennial: TRUE} |
-| "garden.trees" | "garden" | "updatedtrees" | "remote" | "neo4j+s://location:7687" | "alice" | {} | {treeversion: 2} |
-| "library.romance" | "library" | "romance-books" | "remote" | "neo4j+s://location:7687" | "alice" | {} | {} |
-| "library.sci-fi" | "library" | "sci-fi-books" | "local" | NULL | NULL | NULL | {} |
-+-----------------------------------------------------------------------------------------------------------------------------------+
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | composite | database | location | url | user | driver | defaultLanguage | properties |
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
+| "garden.flowers" | "garden" | "perennial-flowers" | "local" | NULL | NULL | NULL | NULL | {perennial: TRUE} |
+| "garden.trees" | "garden" | "updatedtrees" | "remote" | "neo4j+s://location:7687" | "alice" | {} | NULL | {treeversion: 2} |
+| "library.romance" | "library" | "romance-books" | "remote" | "neo4j+s://location:7687" | "alice" | {} | NULL | {} |
+| "library.sci-fi" | "library" | "sci-fi-books" | "local" | NULL | NULL | NULL | NULL | {} |
++-----------------------------------------------------------------------------------------------------------------------------------------------------+
----
[[delete-composite-database-alias]]
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 8666fac05..c3b073cd2 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -53,7 +53,8 @@ DRIVER {
connection_pool_idle_test: duration({minutes: 2}),
connection_pool_max_size: 10,
logging_level: 'info'
-};
+}
+DEFAULT LANGUAGE CYPHER 25;
----
////
@@ -106,6 +107,11 @@ The driver options for connection to the remote database or `null` if the target
List of xref::database-administration/aliases/manage-aliases-standard-databases.adoc#alias-management-create-remote-database-alias-driver-settings[driver settings] allowed for remote database aliases.
| MAP
+| defaultLanguage
+|
+The default language for non-constituent remote database aliases or `null` if it is a constituent or local database alias.
+| STRING
+
| properties
| Any properties set on the database alias.
| MAP
@@ -169,13 +175,13 @@ SHOW ALIASES FOR DATABASE YIELD *
.Result
[role="queryresult"]
----
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| name | composite | database | location | url | user | driver | properties |
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| "films" | NULL | "movies" | "local" | NULL | NULL | NULL | {} |
-| "motion pictures" | NULL | "movies" | "local" | NULL | NULL | NULL | {namecontainsspace: TRUE} |
-| "movie scripts" | NULL | "scripts" | "remote" | "neo4j+s://location:7687" | "alice" | {connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H} | {} |
-+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| name | composite | database | location | url | user | driver | defaultLanguage | properties |
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| "films" | NULL | "movies" | "local" | NULL | NULL | NULL | NULL | {} |
+| "motion pictures" | NULL | "movies" | "local" | NULL | NULL | NULL | NULL | {namecontainsspace: TRUE} |
+| "movie scripts" | NULL | "scripts" | "remote" | "neo4j+s://location:7687" | "alice" | {connection_pool_idle_test: PT2M, connection_pool_max_size: 10, logging_level: "INFO", ssl_enforced: TRUE, connection_pool_acquisition_timeout: PT1M, connection_timeout: PT5S, connection_max_lifetime: PT1H} | "CYPHER 25" | {} |
++-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
=== Show `count` of aliases for a database
@@ -359,8 +365,7 @@ A database alias can target a remote database by providing an URL and the creden
See xref:database-administration/aliases/remote-database-alias-configuration.adoc[] for the necessary configurations.
Since remote database aliases target databases that are not in this DBMS, they do not fetch the default language from their target like the local database aliases.
-Instead, remote database aliases are assigned the default language given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`] on creation.
-There is currently no command to set it explicitly nor change it on existing remote database aliases.
+Instead, remote database aliases can be given a default language on creation, or they are assigned the default language given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`].
As with local database aliases, creating remote database aliases allows `IF NOT EXISTS` and `OR REPLACE` clauses.
Both check for any remote or local database aliases.
@@ -445,6 +450,37 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD *
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
+==== Set default language for remote database aliases
+The default language for the remote database alias can be set using the `DEFAULT LANGUAGE` clause of `CREATE ALIAS` and `ALTER ALIAS` commands.
+For example, the following query creates a remote database alias with the default language `CYPHER 25`:
+
+.Query
+[source, cypher]
+----
+CREATE ALIAS `remote-with-default-language` FOR DATABASE `northwind-graph-2020`
+AT "neo4j+s://location:7687"
+USER alice
+PASSWORD 'example_secret'
+DEFAULT LANGUAGE CYPHER 25
+----
+
+When a database alias targeting a remote database has been created, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+
+.Query
+[source, cypher]
+----
+SHOW ALIAS `remote-with-default-language` FOR DATABASE YIELD name, defaultLanguage
+----
+
+.Result
+[role="queryresult"]
+----
++--------------------------------------------------+
+| name | defaultLanguage |
++--------------------------------------------------+
+| "remote-with-default-language" | "CYPHER 25" |
++--------------------------------------------------+
+----
==== Set properties for remote database aliases
@@ -482,7 +518,7 @@ SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties
== Alter database aliases
-Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, URL, user credentials, or driver settings.
+Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, URL, user credentials, default language, or driver settings.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
Only the clauses used will be altered.
@@ -566,6 +602,17 @@ ALTER ALIAS `movie scripts` SET DATABASE
DRIVER {}
----
+=== Alter default language for remote database aliases
+
+Example of altering a remote database alias default language.
+
+.Query
+[source, cypher]
+----
+ALTER ALIAS `remote-with-default-language` SET DATABASE
+DEFAULT LANGUAGE CYPHER 5
+----
+
=== Alter properties for local and remote database aliases
Examples of altering local and remote database alias properties.
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index bf573a434..2f40cb6b0 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -321,6 +321,7 @@ CREATE OR REPLACE ALIAS name FOR DATABASE targetName
CREATE ALIAS name [IF NOT EXISTS] FOR DATABASE targetName
AT 'url' USER username PASSWORD 'password'
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
[source, syntax, role=noheader]
@@ -328,6 +329,7 @@ AT 'url' USER username PASSWORD 'password'
CREATE OR REPLACE ALIAS name FOR DATABASE targetName
AT 'url' USER username PASSWORD 'password'
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
|===
@@ -362,6 +364,7 @@ ALTER ALIAS name [IF EXISTS] SET DATABASE
[USER username]
[PASSWORD 'password']
[DRIVER "{" setting: value[, ...] "}"]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
From f213059c13c28fc7a5e082bfbad9359be2dd2073 Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Fri, 28 Mar 2025 10:42:18 +0100
Subject: [PATCH 07/65] Document ALTER COMPOSITE DATABASE privilege
also update to not say we can manage aliases using the database management privileges
---
..._grant_and_deny_syntax_dbms_privileges.svg | 2 +-
.../ROOT/images/privileges_hierarchy_dbms.svg | 2 +-
.../dbms-administration.adoc | 63 +++++++++++++++++--
.../standard-databases/listing-databases.adoc | 2 +-
4 files changed, 62 insertions(+), 7 deletions(-)
diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
index 889231a99..04def26cd 100644
--- a/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
+++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_dbms_privileges.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/modules/ROOT/images/privileges_hierarchy_dbms.svg b/modules/ROOT/images/privileges_hierarchy_dbms.svg
index e4f22ea54..1f7f0057d 100644
--- a/modules/ROOT/images/privileges_hierarchy_dbms.svg
+++ b/modules/ROOT/images/privileges_hierarchy_dbms.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 2c300ee93..1df9fa204 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -26,6 +26,8 @@ CREATE ROLE databaseDropper IF NOT EXISTS;
CREATE ROLE compositeDatabaseDropper IF NOT EXISTS;
CREATE ROLE databaseModifier IF NOT EXISTS;
CREATE ROLE accessModifier IF NOT EXISTS;
+CREATE ROLE languageModifier IF NOT EXISTS;
+CREATE ROLE compositeDatabaseModifier IF NOT EXISTS;
CREATE ROLE compositeDatabaseManager IF NOT EXISTS;
CREATE ROLE databaseManager IF NOT EXISTS;
CREATE ROLE aliasAdder IF NOT EXISTS;
@@ -888,7 +890,7 @@ GRANT [IMMUTABLE] SET DATABASE ACCESS
GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
ON DBMS
TO role[, ...]
-| Enables the specified roles to set the default query language on a database.
+| Enables the specified roles to set the default query language on a standard database.
| [source, syntax, role=noheader]
GRANT CREATE COMPOSITE DATABASE
@@ -902,11 +904,17 @@ GRANT DROP COMPOSITE DATABASE
TO role[, ...]
| Enables the specified roles to delete composite databases.
+| [source, syntax, role=noheader]
+GRANT ALTER COMPOSITE DATABASE
+ ON DBMS
+ TO role[, ...]
+| Enables the specified roles to modify composite databases.
+
| [source, syntax, role=noheader]
GRANT COMPOSITE DATABASE MANAGEMENT
ON DBMS
TO role[, ...]
-| Enables the specified roles to create and delete composite databases.
+| Enables the specified roles to create, delete or modify composite databases.
| [source, syntax, role=noheader]
GRANT [IMMUTABLE] DATABASE MANAGEMENT
@@ -1061,6 +1069,54 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
+The ability to modify the default language to standard databases can be granted via the `SET DATABASE DEFAULT LANGUAGE` privilege.
+See an example:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO languageModifier
+----
+
+The resulting role has privileges that only allow modifying default language to standard databases.
+List all privileges for the role `languageModifier` as commands by using the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE languageModifier PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO `languageModifier`"
+a|Rows: 1
+|===
+
+The ability to modify composite databases can be granted via the `ALTER COMPOSITE DATABASE` privilege.
+See an example:
+
+[source, cypher, role=noplay]
+----
+GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier
+----
+
+The resulting role has privileges that only allow modifying composite databases.
+List all privileges for the role `compositeDatabaseModifier` as commands by using the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT ALTER COMPOSITE DATABASE ON DBMS TO `compositeDatabaseModifier`"
+a|Rows: 1
+|===
+
The ability to create and delete composite databases can be granted via the `COMPOSITE DATABASE MANAGEMENT` privilege.
See an example:
@@ -1093,7 +1149,7 @@ See an example:
GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager
----
-The resulting role has all privileges to manage standard and composite databases as well as aliases.
+The resulting role has all privileges to manage standard and composite databases.
List all privileges for the role `databaseManager` as commands by using the following query:
[source, cypher, role=noplay]
@@ -1114,7 +1170,6 @@ a|Rows: 1
The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases.
They can be granted, denied and revoked like other privileges.
-It is also possible to manage aliases with <>.
[NOTE]
====
diff --git a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
index 5618a15ad..408e85493 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
@@ -218,7 +218,7 @@ The results of the `SHOW DATABASES` command are filtered according to the `ACCES
However, some privileges enable users to see additional databases regardless of their `ACCESS` privileges:
* Users with `CREATE/DROP/ALTER DATABASE` or `SET DATABASE ACCESS` privileges can see all standard databases.
-* Users with `CREATE/DROP COMPOSITE DATABASE` or `COMPOSITE DATABASE MANAGEMENT` privileges can see all composite databases.
+* Users with `CREATE/DROP/ALTER COMPOSITE DATABASE` or `COMPOSITE DATABASE MANAGEMENT` privileges can see all composite databases.
* Users with `DATABASE MANAGEMENT` privilege can see all databases.
If a user has not been granted `ACCESS` privilege to any databases nor any of the above special cases, the command can still be executed but it will only return the `system` database, which is always visible.
From 3c3483e18f7a1dc34d998bd6cc222a162dc868cc Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Fri, 28 Mar 2025 10:57:31 +0100
Subject: [PATCH 08/65] Fixing smaller review comments
---
.../standard-databases/alter-databases.adoc | 6 +++---
.../standard-databases/listing-databases.adoc | 2 ++
modules/ROOT/pages/database-administration/syntax.adoc | 7 +++++--
3 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index c1972199b..76d4bae71 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -17,9 +17,9 @@ You can modify standard databases using the Cypher command `ALTER DATABASE`.
ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
-SET DEFAULT LANGUAGE CYPHER {5\|25} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value
+SET OPTION option value \|
+SET DEFAULT LANGUAGE CYPHER {5\|25}
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -99,7 +99,7 @@ SET ACCESS READ WRITE
----
== Alter database default language
-The `ALTER DATABASE` command can be used to set the default Cypher version for a database.
+The `ALTER DATABASE` command can be used to set the default Cypher version for a database, including the `system` database.
For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
[role=enterprise-edition not-on-aura]
diff --git a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
index 408e85493..5f72f8939 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
@@ -221,6 +221,8 @@ However, some privileges enable users to see additional databases regardless of
* Users with `CREATE/DROP/ALTER COMPOSITE DATABASE` or `COMPOSITE DATABASE MANAGEMENT` privileges can see all composite databases.
* Users with `DATABASE MANAGEMENT` privilege can see all databases.
+The `SET DATABASE DEFAULT LANGUAGE` privilege is intentionally left out and does not affect the returned databases.
+
If a user has not been granted `ACCESS` privilege to any databases nor any of the above special cases, the command can still be executed but it will only return the `system` database, which is always visible.
[[database-states]]
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index 2f40cb6b0..1759b1032 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -127,6 +127,7 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -173,6 +174,7 @@ CREATE OR REPLACE DATABASE name
[source, synatx, role="noheader"]
----
CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[OPTIONS "{" "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -180,6 +182,7 @@ CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE COMPOSITE DATABASE name
+[DEFAULT LANGUAGE CYPHER {5\|25}]
[OPTIONS "{" "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -198,9 +201,9 @@ CREATE OR REPLACE COMPOSITE DATABASE name
ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
-SET DEFAULT LANGUAGE CYPHER {5\|25} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value
+SET OPTION option value \|
+SET DEFAULT LANGUAGE CYPHER {5\|25}
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
From f30c68cb5dc1a017d4cbecd97a6b683784f5648d Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Fri, 28 Mar 2025 11:06:02 +0100
Subject: [PATCH 09/65] See if adding width makes the images visible
---
.../authentication-authorization/dbms-administration.adoc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 1df9fa204..768328a1b 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -69,9 +69,9 @@ All DBMS privileges are relevant system-wide.
Like user management, they do not belong to one specific database or graph.
For more details on the differences between graphs, databases, and the DBMS, refer to link:{neo4j-docs-base-uri}/cypher-manual/current/introduction/cypher_neo4j/[Cypher Manual -> Cypher and Neo4j].
-image::privileges_grant_and_deny_syntax_dbms_privileges.svg[title="Syntax of GRANT and DENY DBMS Privileges"]
+image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="Syntax of GRANT and DENY DBMS Privileges"]
-image::privileges_hierarchy_dbms.svg[title="DBMS privileges hierarchy"]
+image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarchy"]
The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges.
These include:
From da55463e4b88441e5b75713eaaaf68f765f3232c Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Fri, 4 Apr 2025 14:25:47 +0200
Subject: [PATCH 10/65] Update to handle the different syntaxes depending on
cypher version
needed some updates after the rebase
also added alter composite database as its own section in the syntax chapter
---
.../standard-databases/create-databases.adoc | 2 +
.../pages/database-administration/syntax.adoc | 51 +++++++++++++++++++
2 files changed, 53 insertions(+)
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index b9c5246fe..39d540e83 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -82,6 +82,7 @@ CREATE OR REPLACE DATABASE name
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -90,6 +91,7 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index 1759b1032..21a889075 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -147,6 +147,7 @@ CREATE OR REPLACE DATABASE name
[source, syntax, role="noheader"]
----
CREATE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -155,6 +156,7 @@ CREATE DATABASE name [IF NOT EXISTS]
[source, syntax, role="noheader"]
----
CREATE OR REPLACE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]
[OPTIONS "{" option: value[, ...] "}"]
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
@@ -163,8 +165,13 @@ CREATE OR REPLACE DATABASE name
======
=====
+
=== Create a composite database
+[.tabbed-example]
+=====
+[role=include-with-Cypher-5]
+======
[options="header", width="100%", cols="2m,4a"]
|===
| Command | Syntax
@@ -187,6 +194,34 @@ CREATE OR REPLACE COMPOSITE DATABASE name
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+======
+
+[role=include-with-Cypher-25]
+======
+[options="header", width="100%", cols="2m,4a"]
+|===
+| Command | Syntax
+
+| CREATE COMPOSITE DATABASE
+|
+[source, synatx, role="noheader"]
+----
+CREATE COMPOSITE DATABASE name [IF NOT EXISTS]
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
+[OPTIONS "{" "}"]
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+[source, syntax, role="noheader"]
+----
+CREATE OR REPLACE COMPOSITE DATABASE name
+[[SET] DEFAULT LANGUAGE CYPHER {5\|25}]
+[OPTIONS "{" "}"]
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+|===
+======
+=====
=== Alter a database
@@ -221,6 +256,22 @@ There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different opti
====
|===
+=== Alter a composite database
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| ALTER DATABASE
+|
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+SET DEFAULT LANGUAGE CYPHER {5\|25}
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+|===
+
=== Stop a database
[options="header", width="100%", cols="1m,5a"]
From 5a5d54ee7cf319219d0057044687b66294e94e76 Mon Sep 17 00:00:00 2001
From: Therese Magnusson
Date: Mon, 7 Apr 2025 09:19:57 +0200
Subject: [PATCH 11/65] Add page for altering composite databases
---
modules/ROOT/content-nav.adoc | 1 +
.../alter-composite-databases.adoc | 26 +++++++++++++++++++
2 files changed, 27 insertions(+)
create mode 100644 modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc
index 08dc1518c..d687806c0 100644
--- a/modules/ROOT/content-nav.adoc
+++ b/modules/ROOT/content-nav.adoc
@@ -132,6 +132,7 @@
*** xref:database-administration/composite-databases/concepts.adoc[]
*** xref:database-administration/composite-databases/create-composite-databases.adoc[]
*** xref:database-administration/composite-databases/list-composite-databases.adoc[]
+*** xref:database-administration/composite-databases/alter-composite-databases.adoc[]
*** xref:database-administration/composite-databases/delete-composite-databases.adoc[]
*** xref:database-administration/composite-databases/querying-composite-databases.adoc[]
*** xref:database-administration/composite-databases/sharding-with-copy.adoc[]
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
new file mode 100644
index 000000000..c3d4a524c
--- /dev/null
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -0,0 +1,26 @@
+:description: This page describes how to alter composite databases.
+[role=enterprise-edition not-on-aura]
+[[composite-databases-alter]]
+= Alter composite databases
+
+Composite databases can be altered using `ALTER DATABASE`.
+
+== Syntax
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| ALTER DATABASE
+|
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+SET DEFAULT LANGUAGE CYPHER {5\|25}
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+|===
+
+== Alter database default language
+The `ALTER DATABASE` command can be used to set the default Cypher version for a composite database in addition to standard databases.
+For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
From ff5a4c00cdd9fd43e29c40b4a784869dca1d5d5f Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Thu, 29 May 2025 15:26:26 +0100
Subject: [PATCH 12/65] Default Cypher version
---
modules/ROOT/content-nav.adoc | 3 +
.../dbms-administration.adoc | 714 ++++++++++--------
.../cypher-version-configuration.adoc | 29 +
modules/ROOT/pages/configuration/index.adoc | 1 +
.../manage-aliases-composite-databases.adoc | 3 +-
.../manage-aliases-standard-databases.adoc | 220 +++---
.../alter-composite-databases.adoc | 34 +-
.../create-composite-databases.adoc | 90 +--
.../list-composite-databases.adoc | 3 +-
.../start-stop-composite-databases.adoc | 74 ++
.../standard-databases/alter-databases.adoc | 80 +-
.../configuration-parameters.adoc | 8 +-
.../standard-databases/create-databases.adoc | 192 +----
.../standard-databases/listing-databases.adoc | 20 +-
.../start-stop-databases.adoc | 150 ++++
.../pages/database-administration/syntax.adoc | 64 +-
.../ROOT/partials/view-cypher-version.adoc | 8 +
17 files changed, 1034 insertions(+), 659 deletions(-)
create mode 100644 modules/ROOT/pages/configuration/cypher-version-configuration.adoc
create mode 100644 modules/ROOT/pages/database-administration/composite-databases/start-stop-composite-databases.adoc
create mode 100644 modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
create mode 100644 modules/ROOT/partials/view-cypher-version.adoc
diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc
index d687806c0..6398e5afe 100644
--- a/modules/ROOT/content-nav.adoc
+++ b/modules/ROOT/content-nav.adoc
@@ -78,6 +78,7 @@
** xref:configuration/file-locations.adoc[]
//** xref:configuration/network-architecture.adoc[]
** xref:configuration/ports.adoc[]
+** xref:configuration/cypher-version-configuration.adoc[]
** xref:configuration/connectors.adoc[]
** xref:configuration/set-initial-password.adoc[]
** xref:configuration/neo4j-admin-memrec.adoc[]
@@ -116,6 +117,7 @@
*** xref:database-administration/standard-databases/seed-from-uri.adoc[]
*** xref:database-administration/standard-databases/listing-databases.adoc[]
*** xref:database-administration/standard-databases/alter-databases.adoc[]
+*** xref:database-administration/standard-databases/start-stop-databases.adoc[]
*** xref:database-administration/standard-databases/recreate-database.adoc[]
*** xref:database-administration/standard-databases/delete-databases.adoc[]
*** xref:database-administration/standard-databases/migrate-database.adoc[]
@@ -133,6 +135,7 @@
*** xref:database-administration/composite-databases/create-composite-databases.adoc[]
*** xref:database-administration/composite-databases/list-composite-databases.adoc[]
*** xref:database-administration/composite-databases/alter-composite-databases.adoc[]
+*** xref:database-administration/composite-databases/start-stop-composite-databases.adoc[]
*** xref:database-administration/composite-databases/delete-composite-databases.adoc[]
*** xref:database-administration/composite-databases/querying-composite-databases.adoc[]
*** xref:database-administration/composite-databases/sharding-with-copy.adoc[]
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 768328a1b..7269078c5 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -69,11 +69,14 @@ All DBMS privileges are relevant system-wide.
Like user management, they do not belong to one specific database or graph.
For more details on the differences between graphs, databases, and the DBMS, refer to link:{neo4j-docs-base-uri}/cypher-manual/current/introduction/cypher_neo4j/[Cypher Manual -> Cypher and Neo4j].
-image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="Syntax of GRANT and DENY DBMS Privileges"]
+image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="Syntax of GRANT and DENY DBMS privileges"]
image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarchy"]
-The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] has a number of built-in privileges.
+== The `admin` role privileges
+
+The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] role is a built-in superuser role that has all privileges on the DBMS and can perform all administrative tasks.
+
These include:
* Create, delete, and modify databases and aliases.
@@ -86,53 +89,47 @@ These include:
To enable a user to perform these tasks, you can grant them the `admin` role, but it is also possible to make a custom role with a subset of these privileges.
All privileges are also assignable using Cypher commands.
-For more details, see the following sections:
-
-* <>
-* <>
-* <>
-* <>
-* <>
-* <>
-* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Transaction management]
-* <>
-* xref:authentication-authorization/load-privileges.adoc[Load privileges]
+
+The following sections describe the privileges that are available for DBMS administration and show some examples of how to use Cypher commands to manage them.
[[access-control-dbms-administration-custom]]
== Using a custom role to manage DBMS privileges
-In order to have an administrator role with a subset of privileges that includes all DBMS privileges, but not all database privileges, you can copy the `admin` role and revoke or deny the unwanted privileges.
-A second option is to build a custom administrator from scratch by granting the wanted privileges instead.
+You can create a custom role to manage DBMS privileges by granting the privileges you want to the role.
+Alternatively, you can copy the `admin` role and revoke or deny the unwanted privileges.
+The following exaples show how to create a custom role with a subset of the privileges that the `admin` role using both methods.
-As an example, an administrator role can be created to only manage users and roles by using the second option:
+=== Create a custom administrator role by creating a new role from scratch
-. First, create the new role:
+Create an administrator role that can only manage users and roles by creating a new role and granting the `USER MANAGEMENT` and `ROLE MANAGEMENT` privileges.
+
+. Create the new role:
+
[source, cypher, role=noplay]
----
CREATE ROLE usermanager
----
-. Then grant the privilege to manage users:
+. Grant the privilege to manage users:
+
[source, cypher, role=noplay]
----
GRANT USER MANAGEMENT ON DBMS TO usermanager
----
-. And to manage roles:
+. Grant the privilege to manage roles:
+
[source, cypher, role=noplay]
----
GRANT ROLE MANAGEMENT ON DBMS TO usermanager
----
-
-The resulting role has privileges that only allow user and role management.
-To list all privileges for the role `usermanager` as commands, run this query:
-
++
+As a result, the `usermanager` role has privileges that only allow user and role management.
+. To list all privileges for the role `usermanager` as commands, use the following query:
++
[source, cypher, role=noplay]
----
SHOW ROLE usermanager PRIVILEGES AS COMMANDS
----
-
++
.Result
[options="header,footer", width="100%", cols="m"]
|===
@@ -142,46 +139,52 @@ SHOW ROLE usermanager PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-Note that this role does not allow all DBMS capabilities.
-For example, the role is missing privileges for management, creation and drop of databases as well as execution of `admin` procedures.
+[NOTE]
+====
+This role does not allow all DBMS capabilities.
+For example, the role is missing privileges for managing, creating, and dropping databases, as well as executing `admin` procedures.
To create a more powerful administrator, you can grant a different set of privileges.
+====
+
+=== Create a custom administrator role by copying the `admin` role
-In the following example, a new administrator role is created to perform almost all DBMS capabilities, excluding database management.
+You can also create a custom administrator role that can perform almost all DBMS capabilities, excluding database management.
+This is done by copying the `admin` role and denying the privileges you do not want.
However, the role still has some limited database capabilities, such as managing transactions:
-. Again, start by creating a new role:
+. Create a new role:
+
[source, cypher, role=noplay]
----
CREATE ROLE customAdministrator
----
-. Then grant the privilege for all DBMS capabilities:
+. Grant the privilege for all DBMS capabilities:
+
[source, cypher, role=noplay]
----
GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator
----
-. And explicitly deny the privilege to manage databases:
+. Explicitly deny the privilege to manage databases:
+
[source, cypher, role=noplay]
----
DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator
----
-. Next, grant the transaction management privilege:
+. Grant the transaction management privilege:
+
[source, cypher, role=noplay]
----
GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator
----
-
-The resulting role has privileges that include all DBMS privileges except creating, dropping, and modifying databases, as well as managing transactions.
-Use the following query to list all privileges for the role `customAdministrator` as commands:
-
++
+As a result, the `customAdministrator` role has privileges that include all DBMS privileges except creating, dropping, and modifying databases and aliases, as well as managing transactions.
+. To list all privileges for the role `customAdministrator` as commands, use the following query:
++
[source, cypher, role=noplay]
----
SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
----
-
++
.Result
[options="header,footer", width="100%", cols="m"]
|===
@@ -196,8 +199,7 @@ a|Rows: 3
[[access-control-dbms-administration-role-management]]
== The DBMS `ROLE MANAGEMENT` privileges
-The DBMS privileges for role management are assignable using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for role management can be granted, denied, and revoked like other privileges.
[NOTE]
====
@@ -253,16 +255,18 @@ GRANT [IMMUTABLE] ROLE MANAGEMENT
|===
-The ability to add roles can be granted via the `CREATE ROLE` privilege.
-See an example:
+=== Grant privilege to create roles
+
+You can grant the privilege to add roles using the `CREATE ROLE` command.
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE ROLE ON DBMS TO roleAdder
----
-The resulting role has privileges that only allow adding roles.
-List all privileges for the role `roleAdder` as commands by using the following query:
+As a result, the `roleAdder` role has privileges that only allow adding roles.
+To list all privileges for the role `roleAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -277,16 +281,18 @@ SHOW ROLE roleAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to rename roles can be granted via the `RENAME ROLE` privilege.
-See an example:
+=== Grant privilege to rename roles
+
+You can grant the privilege to rename roles using the `RENAME ROLE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT RENAME ROLE ON DBMS TO roleNameModifier
----
-The resulting role has privileges that only allow renaming roles.
-List all privileges for the role `roleNameModifier` using the following query:
+As a result, the `roleNameModifier` role has privileges that only allow renaming roles.
+To list all privileges for the role `roleNameModifier`, use the following query:
[source, cypher, role=noplay]
----
@@ -301,16 +307,18 @@ SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete roles can be granted via the `DROP ROLE` privilege.
-See an example:
+=== Grant privilege to delete roles
+
+You can grant the privilege to delete roles using the `DROP ROLE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DROP ROLE ON DBMS TO roleDropper
----
-The resulting role has privileges that only allow deleting roles.
-List all privileges for the role `roleDropper` by using the following query:
+As a result, the `roleDropper` role has privileges that only allow deleting roles.
+To list all privileges for the role `roleDropper`, use the following query:
[source, cypher, role=noplay]
----
@@ -325,16 +333,18 @@ SHOW ROLE roleDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to assign roles to users can be granted via the `ASSIGN ROLE` privilege.
-See an example:
+=== Grant privilege to assign roles
+
+You can grant the privilege to assign roles using the `ASSIGN ROLE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ASSIGN ROLE ON DBMS TO roleAssigner
----
-The resulting role has privileges that only allow assigning/granting roles.
-List all privileges for the role `roleAssigner` as commands by using the following query:
+As a result, the `roleAssigner` role has privileges that only allow assigning/granting roles.
+To list all privileges for the role `roleAssigner` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -349,16 +359,18 @@ SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to remove roles from users can be granted via the `REMOVE ROLE` privilege.
-See an example:
+=== Grant privilege to remove roles
+
+You can grant the privilege to remove roles using the `REMOVE ROLE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT REMOVE ROLE ON DBMS TO roleRemover
----
-The resulting role has privileges that only allow removing/revoking roles.
-List all privileges for the role `roleRemover` as commands by using the following query:
+As a result, the `roleRemover` role has privileges that only allow removing/revoking roles.
+To list all privileges for the role `roleRemover` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -373,21 +385,25 @@ SHOW ROLE roleRemover PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to show roles can be granted via the `SHOW ROLE` privilege.
+=== Grant privilege to show roles
+
+You can grant the privilege to show roles using the `SHOW ROLE` privilege.
A role with this privilege is allowed to execute the `SHOW ROLES` and `SHOW POPULATED ROLES` administration commands.
-For the `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both this privilege and the `SHOW USER` privilege are required.
+
The following query shows an example of how to grant the `SHOW ROLE` privilege:
+[NOTE]
+====
In order to use `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both the `SHOW ROLE` and the `SHOW USER` privileges are required.
-See an example of how to grant the `SHOW ROLE` privilege:
+====
[source, cypher, role=noplay]
----
GRANT SHOW ROLE ON DBMS TO roleShower
----
-The resulting role has privileges that only allow showing roles.
-List all privileges for the role `roleShower` as commands by using the following query:
+As a result, the `roleShower` role has privileges that only allow showing roles.
+To list all privileges for the role `roleShower` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -402,16 +418,18 @@ SHOW ROLE roleShower PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The privileges to create, rename, delete, assign, remove, and list roles can be granted via the `ROLE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage roles
+
+You can grant the privilege to create, rename, delete, assign, remove, and list roles using the `ROLE MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ROLE MANAGEMENT ON DBMS TO roleManager
----
-The resulting role has all privileges to manage roles.
-List all privileges for the role `roleManager` as commands by using the following query:
+As a result, the `roleManager` role has all privileges to manage roles.
+To list all privileges for the role `roleManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -430,8 +448,7 @@ a|Rows: 1
[[access-control-dbms-administration-user-management]]
== The DBMS `USER MANAGEMENT` privileges
-The DBMS privileges for user management can be assigned using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for user management can be granted, denied, and revoked like other privileges.
[NOTE]
====
@@ -505,16 +522,18 @@ GRANT [IMMUTABLE] USER MANAGEMENT
|===
-The ability to add users can be granted via the `CREATE USER` privilege.
-See an example:
+=== Grant privilege to create users
+
+You can grant the privilege to add users using the `CREATE USER` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE USER ON DBMS TO userAdder
----
-The resulting role has privileges that only allow adding users.
-List all privileges for the role `userAdder` as commands by using this query:
+As a result, the `userAdder` role has privileges that only allow adding users.
+To list all privileges for the role `userAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -529,23 +548,24 @@ SHOW ROLE userAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to rename users can be granted via the `RENAME USER` privilege.
-The following query shows an example of this:
+=== Grant privilege to rename users
+
+You can grant the privilege to rename users using the `RENAME USER` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT RENAME USER ON DBMS TO userNameModifier
----
-The resulting role has privileges that only allow renaming users:
+As a result, the `userNameModifier` role has privileges that only allow renaming users.
+To list all privileges for the role `userNameModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS
----
-Lists all privileges for role `userNameModifier`:
-
.Result
[options="header,footer", width="100%", cols="m"]
|===
@@ -554,16 +574,18 @@ Lists all privileges for role `userNameModifier`:
a|Rows: 1
|===
-The ability to modify users can be granted via the `ALTER USER` privilege.
-See an example:
+=== Grant privilege to modify users
+
+You can grant the privilege to modify users using the `ALTER USER` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ALTER USER ON DBMS TO userModifier
----
-The resulting role has privileges that only allow modifying users.
-List all privileges for the role `userModifier` as commands by using the following query:
+As a result, the `userModifier` role has privileges that only allow modifying users.
+To list all privileges for the role `userModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -578,23 +600,27 @@ SHOW ROLE userModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `ALTER USER` privilege is allowed to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts:
+
+The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts.
+For example:
[source, cypher, role=noplay]
----
ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED
----
-The ability to modify users' passwords and whether those passwords must be changed upon first login can be granted via the `SET PASSWORDS` privilege.
-See an example:
+=== Grant privilege to modify users' passwords
+
+You can grant the privilege to modify users' passwords and whether those passwords must be changed upon first login using the `SET PASSWORDS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SET PASSWORDS ON DBMS TO passwordModifier
----
-The resulting role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login.
-List all privileges for the role `passwordModifier` as commands by using the following query:
+As a result, the `passwordModifier` role has privileges that only allow modifying users' passwords and whether those passwords must be changed upon first login.
+To list all privileges for the role `passwordModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -609,7 +635,7 @@ SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `SET PASSWORDS` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts:
+The `SET PASSWORDS` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
[source, cypher, role=noplay]
----
@@ -623,17 +649,18 @@ A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USE
ALTER USER jake REMOVE AUTH 'native SET AUTH 'oidc-okta' { SET id 'jakesUniqueOktaUserId' }
----
+=== Grant privilege to modify the account status of users
-The ability to modify the account status of users can be granted via the `SET USER STATUS` privilege.
-See an example:
+You can grant the privilege to modify the account status of users using the `SET USER STATUS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SET USER STATUS ON DBMS TO statusModifier
----
-The resulting role has privileges that only allow modifying the account status of users.
-List all privileges for the role `statusModifier` as commands by using the following query:
+As a result, the `statusModifier` role has privileges that only allow modifying the account status of users.
+To list all privileges for the role `statusModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -655,16 +682,18 @@ A user that is granted the `SET USER STATUS` privilege is allowed to run the `AL
ALTER USER jake SET STATUS ACTIVE
----
-In order to be able to modify the home database of users, grant the `SET USER HOME DATABASE` privilege.
-See an example:
+=== Grant privilege to modify the home database of users
+
+You can grant the privilege to modify the home database of users using the `SET USER HOME DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SET USER HOME DATABASE ON DBMS TO statusModifier
----
-The resulting role has privileges that only allow modifying the home database of users.
-List all privileges for the role `statusModifier` as commands by using the following query:
+As a result, the `statusModifier` role has privileges that only allow modifying the home database of users.
+To list all privileges for the role `statusModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -697,16 +726,18 @@ ALTER USER jake REMOVE HOME DATABASE
Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
====
-The ability to delete users can be granted via the `DROP USER` privilege.
-See an example:
+=== Grant privilege to delete users
+
+You can grant the privilege to delete users using the `DROP USER` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DROP USER ON DBMS TO userDropper
----
-The resulting role has privileges that only allow deleting users.
-List all privileges for the role `userDropper` as commands by using the following query:
+As a result, the `userDropper` role has privileges that only allow deleting users.
+To list all privileges for the role `userDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -721,16 +752,19 @@ SHOW ROLE userDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to show users can be granted via the `SHOW USER` privilege.
-See an example:
+
+=== Grant privilege to show users
+
+You can grant the privilege to show users using the `SHOW USER` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SHOW USER ON DBMS TO userShower
----
-The resulting role has privileges that only allow showing users.
-List all privileges for the role `userShower` as commands by using the following query:
+As a result, the `userShower` role has privileges that only allow showing users.
+To list all privileges for the role `userShower` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -745,16 +779,18 @@ SHOW ROLE userShower PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The privileges to create, rename, modify, delete, and list users can be granted via the `USER MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage users
+
+You can grant the privilege to create, rename, modify, delete, and list users using the `USER MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT USER MANAGEMENT ON DBMS TO userManager
----
-The resulting role has all privileges to manage users.
-List all privileges for the role `userManager` as commands by using the following query:
+As a result, the `userManager` role has all privileges to manage users.
+To list all privileges for the role `userManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -772,17 +808,11 @@ a|Rows: 1
[[access-control-dbms-administration-impersonation]]
== The DBMS `IMPERSONATE` privileges
-The DBMS privileges for impersonation can be assigned through Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
+The DBMS privileges for impersonation can be granted, denied, and revoked like other privileges.
Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands).
-The ability to impersonate users can be granted via the `IMPERSONATE` privilege.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+You can use the `IMPERSONATE` privilege to allow a user to impersonate another user.
.Impersonation privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -803,8 +833,15 @@ GRANT [IMMUTABLE] IMPERSONATE (user[, ...])
|===
-The following query shows an example of this.
-Note that `userImpersonator` must be an existing role in order to make this query work:
+=== Grant privilege to impersonate all users
+
+You can grant the privilege to impersonate all users using the `IMPERSONATE (*)` privilege.
+For example:
+
+[NOTE]
+====
+`userImpersonator` must be an existing role in order to grant the privilege.
+====
.Query
[source, cypher, role=noplay]
@@ -812,7 +849,8 @@ Note that `userImpersonator` must be an existing role in order to make this quer
GRANT IMPERSONATE (*) ON DBMS TO userImpersonator
----
-The resulting role has privileges that allow impersonating all users:
+As a result, the `userImpersonator` role has privileges that allow impersonating all users.
+To list all privileges for the role `userImpersonator` as commands, use the following query:
.Query
[source, cypher, role=noplay]
@@ -828,34 +866,32 @@ SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-It is also possible to deny and revoke that privilege.
-See an example which shows of how the `userImpersonator` user would be able to impersonate all users, except `alice`:
+=== Grant privilege to impersonate specific users
+
+You can grant (or revoke) the privilege to impersonate specific users or a subset of users using the following query:
+For example:
.Query
[source, cypher, role=noplay]
----
-DENY IMPERSONATE (alice) ON DBMS TO userImpersonator
+GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator
----
-To grant (or revoke) the permissions to impersonate a specific user or a subset of users, you can first list them with this query:
+As a result, the `userImpersonator` role has privileges that allow impersonating only `alice` and `bob`.
+Then, you deny the privilege to impersonate `alice`:
.Query
[source, cypher, role=noplay]
----
-GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator
+DENY IMPERSONATE (alice) ON DBMS TO userImpersonator
----
+As a result, the `userImpersonator` user would be able to impersonate all users, except `alice`.
[[access-control-dbms-administration-database-management]]
== The DBMS `DATABASE MANAGEMENT` privileges
-The DBMS privileges for database management can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+The DBMS privileges for database management can be granted, denied and revoked like other privileges.
.Database management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -924,17 +960,18 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT
|===
+=== Grant privilege to create standard databases
-The ability to create standard databases can be granted via the `CREATE DATABASE` privilege.
-See an example:
+You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE DATABASE ON DBMS TO databaseAdder
----
-The resulting role has privileges that only allow creating standard databases.
-List all privileges for the role `databaseAdder` as commands by using the following query:
+As a result, the `databaseAdder` role has privileges that only allow creating standard databases.
+To list all privileges for the role `databaseAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -949,16 +986,18 @@ SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create composite databases can be granted via the `CREATE COMPOSITE DATABASE` privilege.
-See an example:
+=== Grant privilege to create composite databases
+
+You can grant the privilege to create composite databases using the `CREATE COMPOSITE DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE COMPOSITE DATABASE ON DBMS TO compositeDatabaseAdder
----
-The resulting role has privileges that only allow creating composite databases.
-List all privileges for the role `compositeDatabaseAdder` as commands by using the following query:
+As a result, the `compositeDatabaseAdder` role has privileges that only allow creating composite databases.
+To list all privileges for the role `compositeDatabaseAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -973,16 +1012,18 @@ SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete standard databases can be granted via the `DROP DATABASE` privilege.
-See an example:
+=== Grant privilege to delete standard databases
+
+You can grant the privilege to delete standard databases using the `DROP DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DROP DATABASE ON DBMS TO databaseDropper
----
-The resulting role has privileges that only allow deleting standard databases.
-List all privileges for the role `databaseDropper` as commands by using the following query:
+As a result, the `databaseDropper` role has privileges that only allow deleting standard databases.
+To list all privileges for the role `databaseDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -997,16 +1038,18 @@ SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete composite databases can be granted via the `DROP COMPOSITE DATABASE` privilege.
-See an example:
+=== Grant privilege to delete composite databases
+
+You can grant the privilege to delete composite databases using the `DROP COMPOSITE DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DROP COMPOSITE DATABASE ON DBMS TO compositeDatabaseDropper
----
-The resulting role has privileges that only allow deleting composite databases.
-List all privileges for the role `compositeDatabaseDropper` as commands by using the following query:
+As a result, the `compositeDatabaseDropper` role has privileges that only allow deleting composite databases.
+To list all privileges for the role `compositeDatabaseDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1021,16 +1064,18 @@ SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify standard databases can be granted via the `ALTER DATABASE` privilege.
-See an example:
+=== Grant privilege to modify standard databases
+
+You can grant the privilege to modify standard databases using the `ALTER DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ALTER DATABASE ON DBMS TO databaseModifier
----
-The resulting role has privileges that only allow modifying standard databases.
-List all privileges for the role `databaseModifier` as commands by using the following query:
+As a result, the `databaseModifier` role has privileges that only allow modifying standard databases.
+To list all privileges for the role `databaseModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1045,16 +1090,18 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify access to standard databases can be granted via the `SET DATABASE ACCESS` privilege.
-See an example:
+=== Grant privilege to modify access to composite databases
+
+You can grant the privilege to modify access to composite databases using the `ALTER COMPOSITE DATABASE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SET DATABASE ACCESS ON DBMS TO accessModifier
----
-The resulting role has privileges that only allow modifying access to standard databases.
-List all privileges for the role `accessModifier` as commands by using the following query:
+As a result, the `accessModifier` role has privileges that only allow modifying access to standard databases.
+To list all privileges for the role `accessModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1069,16 +1116,18 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify the default language to standard databases can be granted via the `SET DATABASE DEFAULT LANGUAGE` privilege.
-See an example:
+=== Grant privilege to modify the default language of standard databases
+
+You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO languageModifier
----
-The resulting role has privileges that only allow modifying default language to standard databases.
-List all privileges for the role `languageModifier` as commands by using the following query:
+As a result, the `languageModifier` role has privileges that only allow modifying default language to standard databases.
+To list all privileges for the role `languageModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1093,16 +1142,18 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify composite databases can be granted via the `ALTER COMPOSITE DATABASE` privilege.
-See an example:
+=== Grant privilege to modify the default language of composite databases
+
+You can grant the privilege to modify the default language of composite databases using the `SET COMPOSITE DATABASE DEFAULT LANGUAGE` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier
----
-The resulting role has privileges that only allow modifying composite databases.
-List all privileges for the role `compositeDatabaseModifier` as commands by using the following query:
+As a result, the `compositeDatabaseModifier` role has privileges that only allow modifying composite databases.
+To list all privileges for the role `compositeDatabaseModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1117,16 +1168,18 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create and delete composite databases can be granted via the `COMPOSITE DATABASE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage composite databases
+
+You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager
----
-The resulting role has all privileges to manage composite databases.
-List all privileges for the role `compositeDatabaseManager` as commands by using the following query:
+As a result, the `compositeDatabaseManager` role has all privileges to manage composite databases.
+To list all privileges for the role `compositeDatabaseManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1141,16 +1194,18 @@ SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to create, delete, and modify databases can be granted via the `DATABASE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage standard and composite databases
+
+You can grant the privilege to create, delete, and modify standard and composite databases using the `DATABASE MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager
----
-The resulting role has all privileges to manage standard and composite databases.
-List all privileges for the role `databaseManager` as commands by using the following query:
+As a result, the `databaseManager` role has all privileges to manage standard and composite databases.
+To list all privileges for the role `databaseManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1168,13 +1223,7 @@ a|Rows: 1
[[access-control-dbms-administration-alias-management]]
== The DBMS `ALIAS MANAGEMENT` privileges
-The DBMS privileges for alias management can be assigned by using Cypher administrative commands and can be applied to both local and remote aliases.
-They can be granted, denied and revoked like other privileges.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+The DBMS privileges for alias management can be granted, denied and revoked like other privileges and can be applied to both local and remote aliases.
.Alias management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1213,16 +1262,18 @@ TO role[, ...]
|===
-The ability to create aliases can be granted via the `CREATE ALIAS` privilege.
-See an example:
+=== Grant privilege to create aliases
+
+You can grant the privilege to create aliases using the `CREATE ALIAS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT CREATE ALIAS ON DBMS TO aliasAdder
----
-The resulting role has privileges that only allow creating aliases.
-List all privileges for the role `aliasAdder` as commands by using the following query:
+As a result, the `aliasAdder` role has privileges that only allow creating aliases.
+To list all privileges for the role `aliasAdder` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1237,16 +1288,18 @@ SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to delete aliases can be granted via the `DROP ALIAS` privilege.
-See an example:
+=== Grant privilege to delete aliases
+
+You can grant the privilege to delete aliases using the `DROP ALIAS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT DROP ALIAS ON DBMS TO aliasDropper
----
-The resulting role has privileges that only allow deleting aliases.
-See all privileges for the role `aliasDropper` as commands by using the following query:
+As a result, the `aliasDropper` role has privileges that only allow deleting aliases.
+See all privileges for the role `aliasDropper` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1261,16 +1314,18 @@ SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to modify aliases can be granted via the `ALTER ALIAS` privilege.
-See an example:
+=== Grant privilege to modify aliases
+
+You can grant the privilege to modify aliases using the `ALTER ALIAS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ALTER ALIAS ON DBMS TO aliasModifier
----
-The resulting role has privileges that only allow modifying aliases.
-List all privileges for the role `aliasModifier` as commands by using the following query:
+As a result, the `aliasModifier` role has privileges that only allow modifying aliases.
+To list all privileges for the role `aliasModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1285,16 +1340,19 @@ SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to list aliases can be granted via the `SHOW ALIAS` privilege.
-See an example:
+
+=== Grant privilege to list aliases
+
+You can grant the privilege to list aliases using the `SHOW ALIAS` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT SHOW ALIAS ON DBMS TO aliasLister
----
-The resulting role has privileges that only allow modifying aliases.
-List all privileges for the role `aliasLister` as commands by using the following query:
+As a result, the `aliasLister` role has privileges that only allow modifying aliases.
+To list all privileges for the role `aliasLister` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1309,16 +1367,18 @@ SHOW ROLE aliasLister PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The privileges to list, create, delete, and modify aliases can be granted via the `ALIAS MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage aliases
+
+You can grant the privilege to create, delete, modify, and list aliases using the `ALIAS MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager
----
-The resulting role has all privileges to manage aliases.
-List all privileges for the role `aliasManager` as commands by using the following query:
+As a result, the `aliasManager` role has all privileges to manage aliases.
+To list all privileges for the role `aliasManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1336,13 +1396,7 @@ a|Rows: 1
[[access-control-dbms-administration-server-management]]
== The DBMS `SERVER MANAGEMENT` privileges
-The DBMS privileges for server management can be assigned using Cypher administrative commands.
-They can be granted, denied, and revoked like other privileges.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+The DBMS privileges for server management can be granted, denied, and revoked like other privileges.
.Server management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1362,17 +1416,63 @@ GRANT [IMMUTABLE] SHOW SERVERS
| Enables the specified roles to show servers.
|===
+=== Grant privilege to manage servers
+
+You can grant the privilege to show, enable, rename, alter, reallocate, deallocate, and drop servers using the `SERVER MANAGEMENT` privilege.
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SERVER MANAGEMENT ON DBMS TO serverManager
+----
+
+As a result, the `serverManager` role has all privileges to manage servers.
+To list all privileges for the role `serverManager` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE serverManager PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SERVER MANAGEMENT ON DBMS TO `serverManager`"
+a|Rows: 1
+|===
+
+
+=== Grant privilege to show servers
+
+You can grant the privilege to show servers using the `SHOW SERVERS` privilege.
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SHOW SERVERS ON DBMS TO serverLister
+----
+
+As a result, the `serverLister` role has privileges that only allow showing servers.
+To list all privileges for the role `serverLister` as commands, use the following query:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE serverLister PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"GRANT SHOW SERVERS ON DBMS TO `serverLister`"
+a|Rows: 1
+|===
[[access-control-dbms-administration-privilege-management]]
== The DBMS `PRIVILEGE MANAGEMENT` privileges
-The DBMS privileges for privilege management can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+The DBMS privileges for privilege management can be granted, denied and revoked like other privileges.
.Privilege management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1404,19 +1504,20 @@ GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT
| Enables the specified roles to list, assign, and remove privileges.
|===
-The ability to list privileges can be granted via the `SHOW PRIVILEGE` privilege.
+=== Grant privilege to list privileges
+You can grant the privilege to list privileges using the `SHOW PRIVILEGE` privilege. +
A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands.
To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required.
-The following query shows an example of how to grant the `SHOW PRIVILEGE` privilege:
+For example:
[source, cypher, role=noplay]
----
GRANT SHOW PRIVILEGE ON DBMS TO privilegeShower
----
-The resulting role has privileges that only allow showing privileges.
-List all privileges for the role `privilegeShower` as commands by using the following query:
+As a result, the `privilegeShower` role has privileges that only allow showing privileges.
+To list all privileges for the role `privilegeShower` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1433,23 +1534,25 @@ a|Rows: 1
[NOTE]
====
-Note that no specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands.
+No specific privileges are required for showing the current user's privileges through the `SHOW USER _username_ PRIVILEGES` or `SHOW USER PRIVILEGES` commands.
-In addition, note that if a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges.
+If a non-native auth provider like LDAP is in use, `SHOW USER PRIVILEGES` will only work with a limited capacity by making it only possible for a user to show their own privileges.
Other users' privileges cannot be listed when using a non-native auth provider.
====
-The ability to assign privileges to roles can be granted via the `ASSIGN PRIVILEGE` privilege.
+=== Grant privilege to assign privileges
+
+You can grant the privilege to assign privileges using the `ASSIGN PRIVILEGE` privilege. +
A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands.
-See an example of how to grant this privilege:
+For example:
[source, cypher, role=noplay]
----
GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner
----
-The resulting role has privileges that only allow assigning privileges.
-List all privileges for the role `privilegeAssigner` as commands by using the following query:
+As a result, the `privilegeAssigner` role has privileges that only allow assigning privileges.
+To list all privileges for the role `privilegeAssigner` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1464,18 +1567,19 @@ SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The ability to remove privileges from roles can be granted via the `REMOVE PRIVILEGE` privilege.
+=== Grant privilege to remove privileges
+You can grant the privilege to remove privileges from roles using the `REMOVE PRIVILEGE` privilege. +
A user with this privilege is allowed to execute `REVOKE` administration commands.
-See an example of how to grant this privilege:
+For example:
[source, cypher, role=noplay]
----
GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover
----
-The resulting role has privileges that only allow removing privileges.
-List all privileges for the role `privilegeRemover` as commands by using the following query:
+As a result, the `privilegeRemover` role has privileges that only allow removing privileges.
+To list all privileges for the role `privilegeRemover` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1490,16 +1594,18 @@ SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The privileges to list, assign, and remove privileges can be granted via the `PRIVILEGE MANAGEMENT` privilege.
-See an example:
+=== Grant privilege to manage privileges
+
+You can grant the privilege to list, assign, and remove privileges using the `PRIVILEGE MANAGEMENT` privilege.
+For example:
[source, cypher, role=noplay]
----
GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager
----
-The resulting role has all privileges to manage privileges.
-List all privileges for the role `privilegeManager` as commands by using the following query:
+As a result, the `privilegeManager` role has all privileges to manage privileges.
+To list all privileges for the role `privilegeManager` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1518,13 +1624,7 @@ a|Rows: 1
[[access-control-dbms-administration-execute]]
== The DBMS `EXECUTE` privileges
-The DBMS privileges for procedure and user-defined function execution can be assigned by using Cypher administrative commands.
-They can be granted, denied and revoked like other privileges.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
+The DBMS privileges for procedure and user-defined function execution can be granted, denied and revoked like other privileges.
.Execute privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1566,20 +1666,20 @@ GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, .
[[access-control-execute-procedure]]
=== The `EXECUTE PROCEDURE` privilege
-The ability to execute a procedure can be granted via the `EXECUTE PROCEDURE` privilege.
+You can grant the privilege to execute procedures using the `EXECUTE PROCEDURE` privilege. +
A role with this privilege is allowed to execute the procedures matched by the <>.
-The following query shows an example of how to grant this privilege:
+For example:
[source, cypher, role=noplay]
----
GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor
----
-Users with the role `procedureExecutor` can then run any procedure in the `db.schema` namespace.
+Users with the role `procedureExecutor` can run any procedure in the `db.schema` namespace.
The procedure is run using the user's own privileges.
-The resulting role has privileges that only allow executing procedures in the `db.schema` namespace.
-List all privileges for the role `procedureExecutor` as commands by using the following query:
+As a result, the `procedureExecutor` role has privileges that only allow executing procedures in the `db.schema` namespace.
+To list all privileges for the role `procedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1594,7 +1694,9 @@ SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-In order to allow the execution of all but only a few procedures, you can grant `EXECUTE PROCEDURES *` and deny the unwanted procedures.
+=== Grant privilege to execute specific procedures
+
+You can grant the privilege to execute specific procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
For example, the following queries allow the execution of all procedures, except those starting with `dbms.cluster`:
[source, cypher, role=noplay]
@@ -1607,8 +1709,8 @@ GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor
DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor
----
-The resulting role has privileges that only allow executing all procedures except those starting with `dbms.cluster`.
-List all privileges for the role `deniedProcedureExecutor` as commands by using the following query:
+As a result, the `deniedProcedureExecutor` role has privileges that only allow executing all procedures except those starting with `dbms.cluster`.
+To list all privileges for the role `deniedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1631,12 +1733,15 @@ The `dbms.cluster.checkConnectivity`, `dbms.cluster.cordonServer`, `dbms.cluster
[[access-control-execute-boosted-procedure]]
=== The `EXECUTE BOOSTED PROCEDURE` privilege
-The ability to use elevated privileges when executing a procedure can be granted via the `EXECUTE BOOSTED PROCEDURE` privilege.
+You can grant the privilege to execute procedures with elevated privileges using the `EXECUTE BOOSTED PROCEDURE` privilege. +
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <>.
The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not the execution of the procedure.
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
+=== Grant privilege to execute boosted procedures
+For example:
+
[source, cypher, role=noplay]
----
GRANT EXECUTE PROCEDURE * ON DBMS TO boostedProcedureExecutor;
@@ -1646,7 +1751,8 @@ GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boost
Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges, seeing everything in the graph and not just the labels and types that the user has `TRAVERSE` privilege on.
Without the `EXECUTE PROCEDURE`, no procedures could be executed at all.
-The resulting role has privileges that allow executing the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
+As a result, the `boostedProcedureExecutor` role has privileges that allow executing the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges.
+To list all privileges for the role `boostedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1663,12 +1769,11 @@ SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 3
|===
+=== Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
+
As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
-This can be seen in the following examples:
+For example:
-.Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
-[example]
-====
[source, cypher, role=noplay]
----
GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1
@@ -1679,7 +1784,7 @@ GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1
DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1
----
-The resulting role has privileges that allow the execution of all procedures using the user's own privileges.
+As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user's own privileges.
It also prevents the `db.labels` procedure from being elevated.
Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`.
@@ -1698,11 +1803,10 @@ SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor1`"
a|Rows: 2
|===
-====
-.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE`
-[example]
-====
+=== Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE`
+
+
[source, cypher, role=noplay]
----
GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2
@@ -1713,8 +1817,8 @@ GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2
DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2
----
-The resulting role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
-List all privileges for the role `deniedBoostedProcedureExecutor2` as commands by using the following query:
+As a result, the `deniedBoostedProcedureExecutor2` role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
+To list all privileges for the role `deniedBoostedProcedureExecutor2` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1729,11 +1833,9 @@ SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor2`"
a|Rows: 2
|===
-====
-.Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
-[example]
-====
+=== Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
+
[source, cypher, role=noplay]
----
GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3
@@ -1744,8 +1846,8 @@ GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3
DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3
----
-The resulting role has privileges that allow elevating the privileges for all procedures except `db.labels`, however no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
-List all privileges for the role `deniedBoostedProcedureExecutor3` as commands by using the following query:
+As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`, however no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
+To list all privileges for the role `deniedBoostedProcedureExecutor3` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1760,7 +1862,6 @@ SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO `deniedBoostedProcedureExecutor3`"
a|Rows: 2
|===
-====
.How would the privileges from examples 1 to 3 affect the output of a procedure?
[example]
@@ -1787,10 +1888,10 @@ For comparison, when granted:
[[access-control-admin-procedure]]
=== The `EXECUTE ADMIN PROCEDURE` privilege
-The ability to execute admin procedures (annotated with `@Admin`) can be granted via the `EXECUTE ADMIN PROCEDURES` privilege.
+You can grant the privilege to execute admin procedures (annotated with `@Admin`) using the `EXECUTE ADMIN PROCEDURE` privilege. +
This privilege is equivalent with granting the <> and <> privileges on each of the admin procedures.
Any newly added `admin` procedure is automatically included in this privilege.
-The following query shows an example of how to grant this privilege:
+For example:
[source, cypher, role=noplay]
----
@@ -1798,9 +1899,8 @@ GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor
----
Users with the role `adminProcedureExecutor` can then run any `admin` procedure with elevated privileges.
-The resulting role has privileges that allow the execution of all admin procedures.
-
-List all privileges for the role `adminProcedureExecutor` as commands by using the following query:
+As a result, the `adminProcedureExecutor` role has privileges that allow the execution of all admin procedures.
+To list all privileges for the role `adminProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -1828,7 +1928,7 @@ In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED P
=== The `EXECUTE USER DEFINED FUNCTION` privilege
//EXECUTE [USER [DEFINED]] FUNCTION[S]
-The ability to execute a user-defined function (UDF) can be granted via the `EXECUTE USER DEFINED FUNCTION` privilege.
+You can grant the privilege to execute user-defined functions (UDFs) using the `EXECUTE USER DEFINED FUNCTION` privilege.
A role with this privilege is allowed to execute the UDFs matched by the <>.
[IMPORTANT]
@@ -1836,8 +1936,8 @@ A role with this privilege is allowed to execute the UDFs matched by the <>.
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the functions as well.
@@ -1935,8 +2034,8 @@ Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION`
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
====
-.Execute boosted user-defined function
-======
+=== Execute boosted user-defined function
+
The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege:
[source,cypher,role=noplay]
@@ -1954,10 +2053,10 @@ GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExe
----
Users with the role `boostedFunctionExecutor` can thus run `apoc.any.properties` with full privileges and see every property on the node/relationship, not just the properties that the user has `READ` privilege on.
-Without the `EXECUTE USER DEFINED FUNCTION` no UDFs could be executed at all.
+Without the `EXECUTE USER DEFINED FUNCTION`, you cannot execute any UDFs at all.
-The resulting role has privileges that allow executing the UDF `apoc.any.properties` with elevated privileges, and all other UDFs with the users' own privileges.
-List all privileges for the role `boostedFunctionExecutor` as commands by using the following query:
+As a result, the `boostedFunctionExecutor` role has privileges that allow executing the UDF `apoc.any.properties` with elevated privileges, and all other UDFs with the users' own privileges.
+To list all privileges for the role `boostedFunctionExecutor` as commands, use the following query:
[source,cypher,role=noplay]
----
@@ -1972,22 +2071,14 @@ SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS
|"GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO `boostedFunctionExecutor`"
a|Rows: 2
|===
-======
-
[[access-control-dbms-administration-setting]]
== The DBMS `SETTING` privileges
-The ability to show configuration settings can be granted via the `SHOW SETTING` privilege.
+You can grant the privilege to show configuration settings using the `SHOW SETTING` privilege.
A role with this privilege is allowed to query the configuration settings matched by the <>.
-
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
-
.Setting privileges command syntax
[options="header", width="100%", cols="3a,2"]
|===
@@ -2001,7 +2092,10 @@ GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...]
| Enables the specified roles to query given configuration settings.
|===
-The following query shows an example of how to grant this privilege:
+=== Grant privilege to show all settings
+
+You can grant the privilege to show all settings using `SHOW SETTING *` or all settings in a namespace using `SHOW SETTING namespace.*`.
+The following query shows an example of how to grant `SHOW SETTING` privilege to view all settings in the `server.bolt` namespace:
[source, cypher, role=noplay]
----
@@ -2010,8 +2104,8 @@ GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer
Users with the role `configurationViewer` can then query any setting in the `server.bolt` namespace.
-The updated role `configurationViewer` has privileges that only allow querying settings in the `server.bolt` namespace.
-List all privileges for the role `configurationViewer` as commands by using the following query:
+As a result, the `configurationViewer` role has privileges that only allow querying settings in the `server.bolt` namespace.
+To list all privileges for the role `configurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -2026,7 +2120,9 @@ SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-To deny a specific setting from a role, first grant `SHOW SETTINGS *`, and then deny the unwanted setting.
+=== Grant privilege to show specific settings
+
+You can grant the privilege to show all settings using `SHOW SETTINGS *` and deny the unwanted settings. +
For example, the following queries allow the querying of all settings, except those starting with `dbms.security`:
[source, cypher, role=noplay]
@@ -2039,8 +2135,8 @@ GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer
DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer
----
-The resulting role has privileges that allow querying all settings except those starting with `dbms.security`.
-List all privileges for the role `deniedConfigurationViewer` as commands by using the following query:
+As a result, the `deniedConfigurationViewer` role has privileges that allow querying all settings except those starting with `dbms.security`.
+To list all privileges for the role `deniedConfigurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
@@ -2062,7 +2158,8 @@ As the query result shows, access to any setting starting with `dbms.security` a
[[access-control-dbms-administration-all]]
== Granting `ALL DBMS PRIVILEGES`
-The right to perform the following privileges can be achieved with a single command:
+You can grant the `ALL DBMS PRIVILEGES` privilege to a role. +
+The `ALL DBMS PRIVILEGES` privilege is equivalent to granting the following privileges:
* Create, drop, assign, remove, and show roles.
* Create, alter, drop, show, and impersonate users.
@@ -2073,11 +2170,6 @@ The right to perform the following privileges can be achieved with a single comm
* Execute all user-defined functions with elevated privileges.
* Show all configuration settings.
-[NOTE]
-====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
-====
-
[source, syntax, role=noheader]
----
GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES]
@@ -2085,14 +2177,14 @@ GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES]
TO role[, ...]
----
-For example, to grant the role `dbmsManager` the abilities above, use the following query:
+For example, to grant the role `dbmsManager` all DBMS abilities, use the following query:
[source, cypher, role=noplay]
----
GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager
----
-The privileges granted can be seen using the `SHOW PRIVILEGES` command:
+To list all privileges for the role `dbmsManager` as commands, use the following query:
[source, cypher, role=noplay]
----
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
new file mode 100644
index 000000000..480f3fca3
--- /dev/null
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -0,0 +1,29 @@
+[[cypher-version-configuration]]
+= Configure the Cypher default version
+:page-role: new-2025.06
+:description: How to configure the Cypher default version.
+
+You can specify the version of Cypher in which you want to run your administrative commands, choosing between Cypher 5 and Cypher 25.
+Cypher 5 is the default version for all newly-created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
+
+For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
+
+To specify the Cypher version, use one of the following options:
+
+Configure a default Cypher version for the whole DBMS::
+The default language version for the whole DBMS can be configured in the _neo4j.conf_ file using the setting xref:configuration/configuration-settings.adoc#config_db.query.default_language[db.query.default_language] (default value: CYPHER_5). +
+Changing this setting in an existing DBMS, *does not* affect existing databases.
+It only applies to newly-created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
+
+Configure a a default Cypher version per database::
+The default language for a specific database can be set using a Cypher admin command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
+This setting determines the default language for the specified database, overriding the default language set in the configuration file.
+For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER_25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER_5`.
+For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
+If not specified, the default language for the database is set to the default language of the DBMS.
+Setting the default language requires the `SET DATABASE DEFAULT LANGUAGE` privilege.
+
+Set the Cypher version on a per-query basis::
+The default language for a specific query can be set by prepending the query with the `CYPHER 5` or `CYPHER 25` keyword. +
+For example, `CYPHER 25 MATCH (n) RETURN n` or `CYPHER 5 MATCH (n) RETURN n`.
+This setting determines the language for the specified query, overriding the default language set in the configuration file and the database.
diff --git a/modules/ROOT/pages/configuration/index.adoc b/modules/ROOT/pages/configuration/index.adoc
index 3cd4c696b..14a0db448 100644
--- a/modules/ROOT/pages/configuration/index.adoc
+++ b/modules/ROOT/pages/configuration/index.adoc
@@ -8,6 +8,7 @@ The topics described are:
* xref:configuration/file-locations.adoc[Default file locations] -- An overview of where files are stored in the different Neo4j distributions and the necessary file permissions for running Neo4j.
//* <> -- A visual representation of the Neo4j network architecture.
* xref:configuration/ports.adoc[Ports] -- An overview of the ports relevant to a Neo4j installation.
+* xref:configuration/cypher-version-configuration.adoc[Configure the Cypher default version] -- How to configure the Cypher version.
* xref:configuration/connectors.adoc[Configure network connectors] -- How to configure network connectors for Neo4j.
* xref:configuration/set-initial-password.adoc[Set initial password] -- How to set an initial password.
* xref:configuration/neo4j-admin-memrec.adoc[Get initial memory recommendations] -- How to get initial memory recommendations for Neo4j.
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index f8bcfbf16..e2c1d0af3 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -18,7 +18,8 @@ CREATE DATABASE `perennial-flowers`;
----
////
-Aliases in composite databases cannot be assigned default languages, they will always get the default from the composite database.
+Aliases in composite databases cannot be assigned a default Cypher version.
+They always get the default from the composite database.
[[manage-aliases-composite-databases-list]]
== List database aliases in composite databases
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index c3b073cd2..eb1aa8b5a 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -3,35 +3,50 @@
[[manage-aliases-standard-databases]]
= Managing database aliases for standard databases
-There are two kinds of database aliases: local and remote.
-A local database alias can only target a database within the same DBMS.
-A remote database alias may target a database from another Neo4j DBMS.
+Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database.
+The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
+When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database.
+
+[NOTE]
+====
+If a transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety.
+This prevents issues such as a transaction executing against multiple target databases for the same alias.
+====
+
When a query is run against a database alias, it will be redirected to the target database.
The home database for users can be set to an alias, which will be resolved to the target database on use.
Starting with Neo4j 2025.04, a database alias can also be set as the default database.
This page describes managing database aliases for standard databases.
-Local and remote database aliases can also be created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database].
-For more information, see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
-
-A local database alias can be used in all other Cypher commands in place of the target database.
-Please note that the local database alias will be resolved while executing the command.
-Privileges and default language are defined on the database, and not the local database alias.
+For aliases created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database], see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
-A remote database alias can be used for connecting to a database of a remote Neo4j DBMS, `USE` clauses, setting a user's home database, and defining the access privileges and default language for queries to the remote database.
-Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
-It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
-
-Database aliases can be created and managed using a set of Cypher administration commands executed against the `system` database.
-The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
-When connected to the DBMS over Bolt, administration commands are automatically routed to the `system` database.
+There are two kinds of database aliases - local and remote:
+Local database aliases::
+A local database alias can only target a database within the same DBMS.
+It can be used in all Cypher commands in place of the target database.
+Please note that the local database alias will be resolved while executing the command.
+Privileges are defined on the target database, and not the local database alias.
++
[NOTE]
====
-If a transaction modifies a database alias, other transactions concurrently executing against that alias may be aborted and rolled back for safety.
-This prevents issues such as a transaction executing against multiple target databases for the same alias.
+Starting with Neo4j 2025.06, a database can be assigned a default Cypher version.
+However, local database aliases cannot be assigned a default Cypher version.
+They always get the Cypher version of their target database.
====
+Remote database aliases::
+A remote database alias may target a database from another Neo4j DBMS.
+It can be used for:
+* Connecting to a database of a remote Neo4j DBMS
+* `USE` clauses
+* Setting a user's home database and defining the access privileges
+* Setting a default Cypher version for queries to the remote database.
++
+Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
+It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
+Starting with Neo4j 2025.06, a remote database alias can be assigned a default Cypher version.
+
[[manage-aliases-list]]
== List database aliases
@@ -58,11 +73,13 @@ DEFAULT LANGUAGE CYPHER 25;
----
////
-Available database aliases can be seen using `SHOW ALIASES FOR DATABASE`.
+You can list all available database aliases using the `SHOW ALIASES FOR DATABASE` command.
+The command returns a table of all standard and composite database aliases. +
+If you need more details, you can append the command with `YIELD *`.
+The `YIELD *` clause returns the full set of columns.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
-`SHOW ALIASES FOR DATABASE` will produce a table of database aliases with the following columns:
-
+.Available columns
[options="header" cols="2m,4a,2m"]
|===
| Column | Description | Type
@@ -118,13 +135,10 @@ The default language for non-constituent remote database aliases or `null` if it
|===
-The detailed information for a particular database alias can be displayed using the command `SHOW ALIASES FOR DATABASE YIELD *`.
-When a `YIELD *` clause is provided, the full set of columns is returned.
-
-=== Show all aliases for a database
+=== Show all database aliases
-A summary of all available database aliases can be displayed using the command `SHOW ALIASES FOR DATABASE`.
-This command will show database aliases for both standard and composite databases.
+To list all database aliases, use the `SHOW ALIASES FOR DATABASE` command without any additional parameters.
+This command returns all database aliases, including local and remote aliases, for all databases in the DBMS.
.Query
[source, cypher]
@@ -144,9 +158,9 @@ SHOW ALIASES FOR DATABASE
+--------------------------------------------------------------------------------------------+
----
-=== Show specific aliases for databases
+=== Show a specific database alias
-To list just one database alias, the `SHOW ALIASES` command takes an alias name;
+To list just one database alias, the `SHOW ALIASES` command takes an alias name:
.Query
[source, cypher]
@@ -164,7 +178,9 @@ SHOW ALIAS films FOR DATABASES
+---------------------------------------------------------+
----
-=== Show detailed aliases information for a database
+=== Show detailed information about all database aliases
+
+To see all columns for all database aliases, use the `YIELD *` clause with the `SHOW ALIASES FOR DATABASE` command:
.Query
[source, cypher]
@@ -184,9 +200,9 @@ SHOW ALIASES FOR DATABASE YIELD *
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
-=== Show `count` of aliases for a database
+=== Show the number of database aliases
-The number of database aliases can be seen using a `count()` aggregation with `YIELD` and `RETURN`.
+To see the number of database aliases, use a `count()` aggregation with `YIELD` and `RETURN`.
.Query
[source, cypher]
@@ -205,9 +221,11 @@ RETURN count(*) as count
+-------+
----
-=== Show filtered aliases information for a database
+=== Filter and sort database aliases
-It is possible to filter and sort the results by using `YIELD`, `ORDER BY`, and `WHERE`.
+You can filter and sort the results of the `SHOW ALIASES FOR DATABASE` command using the `YIELD`, `ORDER BY`, and `WHERE` clauses.
+The `YIELD` clause allows you to specify which columns to return, while the `ORDER BY` clause sorts the results based on a specified column.
+The `WHERE` clause filters the results based on a condition.
.Query
[source, cypher]
@@ -240,8 +258,7 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results.
[[alias-management-create-database-alias]]
== Create database aliases
-Database aliases can be created using `CREATE ALIAS`.
-The command supports the creation of both local and remote database aliases.
+You can create both local and remote database aliases using the command `CREATE ALIAS`.
For more information on local and remote database aliases as part of a composite database, see xref::database-administration/aliases/manage-aliases-composite-databases.adoc#create-composite-database-alias[Create database aliases in composite databases].
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
@@ -296,40 +313,41 @@ SHOW ALIAS `northwind` FOR DATABASE
+---------------------------------------------------------------------------+
----
-Local database aliases cannot be assigned default languages, they will always get the default from their target database.
-
-=== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
+==== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
The `CREATE ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists.
-There are two ways to circumvent this behavior.
-
-First, appending `IF NOT EXISTS` to the command ensures that no error is returned and nothing happens should the database alias already exist.
+There are two ways to circumvent this behavior:
+* Appending `IF NOT EXISTS` to the command.
+This ensures that no error is returned and nothing happens should the database alias already exist.
++
.Query
[source, cypher]
----
CREATE ALIAS `northwind` IF NOT EXISTS FOR DATABASE `northwind-graph-2021`
----
-Second, adding `OR REPLACE` to the command results in any existing database being deleted and a new one being created.
-
+* Appending `OR REPLACE` to the command.
+This means that if the database alias already exists, it will be replaced with the new one.
++
.Query
[source, cypher]
----
CREATE OR REPLACE ALIAS `northwind` FOR DATABASE `northwind-graph-2021`
----
-
-This is equivalent to running `DROP ALIAS `northwind++` IF EXISTS FOR DATABASE` followed by `CREATE ALIAS `northwind++` FOR DATABASE `northwind-graph-2021`++`.
-
++
+This is equivalent to running ```DROP ALIAS `northwind++` IF EXISTS FOR DATABASE++``` followed by ```CREATE ALIAS `northwind++` FOR DATABASE `northwind-graph-2021++````.
++
[NOTE]
====
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
-=== Set properties for local database aliases
+==== Set properties for local database aliases
-Local database aliases can also be given properties.
-These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()` function].
+You can set properties for local database aliases using the `PROPERTIES` clause of the `CREATE ALIAS` command.
+These properties can later be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()`] function.
+For example:
.Query
[source, cypher]
@@ -339,7 +357,7 @@ FOR DATABASE `northwind-graph-2022`
PROPERTIES { newestNorthwind: true, index: 3 }
----
-The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command.
+To verify that the properties have been set, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
.Query
[source, cypher]
@@ -364,11 +382,8 @@ SHOW ALIAS `northwind-2022` FOR DATABASE YIELD name, properties
A database alias can target a remote database by providing an URL and the credentials of a user on the remote Neo4j DBMS.
See xref:database-administration/aliases/remote-database-alias-configuration.adoc[] for the necessary configurations.
-Since remote database aliases target databases that are not in this DBMS, they do not fetch the default language from their target like the local database aliases.
-Instead, remote database aliases can be given a default language on creation, or they are assigned the default language given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`].
-
-As with local database aliases, creating remote database aliases allows `IF NOT EXISTS` and `OR REPLACE` clauses.
-Both check for any remote or local database aliases.
+Since remote database aliases target databases that are not in this DBMS, they do not fetch the default Cypher version from their target like the local database aliases.
+Instead, they are assigned the version given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`], which is set in the `neo4j.conf` file.
.Query
[source, cypher]
@@ -379,7 +394,7 @@ USER alice
PASSWORD 'example_secret'
----
-When you create a database alias targeting a remote database, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+To view the remote database alias details, use the `SHOW ALIASES FOR DATABASE` command:
.Query
[source, cypher]
@@ -398,6 +413,10 @@ FOR DATABASE
+----------------------------------------------------------------------------------------------------------+
----
+You can also use `IF EXISTS` or `OR REPLACE` when creating remote database aliases.
+It works the same way as described in the <<_use_if_exists_or_or_replace_when_creating_database_aliases, Use `IF EXISTS` or `OR REPLACE` when creating database aliases>> section.
+
+
[[alias-management-create-remote-database-alias-driver-settings]]
==== Create remote database aliases with driver settings
@@ -405,17 +424,17 @@ It is possible to override the default driver settings per database alias, which
This is the list of the allowed driver settings for remote database aliases:
-* ssl_enforced (Default: `true`) -- SSL for remote database alias drivers is configured through the target URL scheme.
+* `ssl_enforced` (Default: `true`) -- SSL for remote database alias drivers is configured through the target URL scheme.
If `ssl_enforced` is set to true, a secure URL scheme is enforced.
-This will be validated when the command is executed.
-* connection_timeout -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout]
-* connection_max_lifetime -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].
-* connection_pool_acquisition_timeout -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout].
-* connection_pool_idle_test -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.idle_test[dbms.routing.driver.connection.pool.idle_test].
-* connection_pool_max_size -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].
-* logging_level (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level])
-
-The driver settings are set in the `DRIVER` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
+It is be validated when the command is executed.
+* `connection_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout].)
+* `connection_max_lifetime` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].)
+* `connection_pool_acquisition_timeout` (Foror details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_acquisition_timeout[dbms.routing.driver.connection_pool_acquisition_timeout].)
+* `connection_pool_idle_test` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_idle_test[dbms.routing.driver.connection_pool_idle_test].)
+* `connection_pool_max_size` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].)
+* `logging_level` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level].)
+
+You can set these driver settings when creating a remote database alias using the `DRIVER` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
For example, the following query creates a remote database alias using driver settings `connection_timeout` and
`connection_pool_max_size` for connecting to the remote database `northwind-graph-2020`:
@@ -432,7 +451,7 @@ DRIVER {
}
----
-When a database alias targeting a remote database has been created, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+To view the remote database alias details, including the driver settings, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD *` clause:
.Query
[source, cypher]
@@ -450,8 +469,9 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD *
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
-==== Set default language for remote database aliases
-The default language for the remote database alias can be set using the `DEFAULT LANGUAGE` clause of `CREATE ALIAS` and `ALTER ALIAS` commands.
+==== Set a default Cypher version for remote database aliases
+
+You can set a default Cypher version for remote database aliases using the `DEFAULT LANGUAGE` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
For example, the following query creates a remote database alias with the default language `CYPHER 25`:
.Query
@@ -464,7 +484,7 @@ PASSWORD 'example_secret'
DEFAULT LANGUAGE CYPHER 25
----
-When a database alias targeting a remote database has been created, its details can be shown with the `SHOW ALIASES FOR DATABASE` command.
+To view the remote database alias details, including the default language, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
.Query
[source, cypher]
@@ -484,8 +504,8 @@ SHOW ALIAS `remote-with-default-language` FOR DATABASE YIELD name, defaultLangua
==== Set properties for remote database aliases
-Just as the local database aliases, the remote database aliases can be given properties.
-These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()` function].
+You can set properties for remote database aliases using the `PROPERTIES` clause of the `CREATE ALIAS` command.
+These properties can then be used in queries with the link:{neo4j-docs-base-uri}/cypher-manual/current/functions/graph/#functions-graph-propertiesByName[`graph.propertiesByName()`] function.
.Query
[source, cypher]
@@ -495,7 +515,7 @@ USER alice PASSWORD 'password'
PROPERTIES { newestNorthwind: false, index: 6 }
----
-The properties are then shown in the `SHOW ALIASES FOR DATABASE YIELD ...` command.
+To view the remote database alias properties, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
.Query
[source, cypher]
@@ -517,8 +537,8 @@ SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties
[[alias-management-alter-database-alias]]
== Alter database aliases
-
-Database aliases can be altered using `ALTER ALIAS` to change its database target, properties, URL, user credentials, default language, or driver settings.
+You can alter both local and remote database aliases using the `ALTER ALIAS` command.
+The command allows you to change the target database, properties, URL, user credentials, default language, or driver settings of the database alias.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
Only the clauses used will be altered.
@@ -527,10 +547,10 @@ Only the clauses used will be altered.
Local database aliases cannot be altered to remote aliases, or vice versa.
====
-=== Alter local database aliases
-
-Example of altering a local database alias target.
+=== Alter a local database alias target
+You can alter a local database alias to target a different database using the `SET DATABASE TARGET` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -539,7 +559,7 @@ ALTER ALIAS `northwind`
SET DATABASE TARGET `northwind-graph-2021`
----
-When a local database alias has been altered, it will show up in the `aliases` column for the target database provided by the command `SHOW DATABASES`.
+To verify that the local database alias has a new target database, you can use the `SHOW DATABASE` command.
.Query
[source, cypher]
@@ -558,9 +578,10 @@ SHOW DATABASE `northwind-graph-2021`
----
-=== Alter remote database aliases
+=== Alter a remote database alias target
-Example of altering a remote database alias target.
+You can alter a remote database alias to target a different remote database using the `SET DATABASE TARGET` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -569,9 +590,10 @@ ALTER ALIAS `remote-northwind` SET DATABASE
TARGET `northwind-graph-2020` AT "neo4j+s://other-location:7687"
----
-=== Alter remote credentials and driver settings for remote database aliases
+=== Alter a remote database alias credentials and driver settings
-Example of altering a remote database alias credentials and driver settings.
+You can change the user credentials and driver settings of a remote database alias using the `USER`, `PASSWORD`, and `DRIVER` clauses of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -588,12 +610,12 @@ DRIVER {
[IMPORTANT]
====
All driver settings are replaced by the new ones.
-In this case, by not repeating the driver setting `connection_pool_max_size` the value will be deleted and fall back to the default value.
+In this case, by not repeating the driver setting `connection_pool_max_size`, the value will be deleted and fall back to the default value.
====
-=== Remove custom driver settings from remote database aliases
+=== Remove all custom driver settings from a remote database alias
-Example of altering a remote database alias to remove all custom driver settings.
+You can remove all custom driver settings from a remote database alias by setting the `DRIVER` clause to an empty map `{}`.
.Query
[source, cypher]
@@ -602,9 +624,10 @@ ALTER ALIAS `movie scripts` SET DATABASE
DRIVER {}
----
-=== Alter default language for remote database aliases
+=== Alter the default Cypher version of a remote database alias
-Example of altering a remote database alias default language.
+You can alter the default Cypher version of a remote database alias using the `DEFAULT LANGUAGE` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -613,9 +636,10 @@ ALTER ALIAS `remote-with-default-language` SET DATABASE
DEFAULT LANGUAGE CYPHER 5
----
-=== Alter properties for local and remote database aliases
+=== Alter properties of local and remote database aliases
-Examples of altering local and remote database alias properties.
+You can alter the properties of a local or remote database alias using the `SET DATABASE PROPERTIES` clause of the `ALTER ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -650,13 +674,14 @@ ALTER ALIAS `no-alias` IF EXISTS SET DATABASE TARGET `northwind-graph-2021`
[[alias-management-drop-database-alias]]
== Delete database aliases
-Both local and remote database aliases can be deleted using the `DROP ALIAS` command.
+You can delete both local and remote database aliases using the `DROP ALIAS` command.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
=== Delete local database aliases
-Delete a local database alias.
+You can delete a local database alias using the `DROP ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -664,7 +689,8 @@ Delete a local database alias.
DROP ALIAS `northwind` FOR DATABASE
----
-When a database alias has been deleted, it will no longer show up in the `aliases` column provided by the command `SHOW DATABASES`.
+To verify that the local database alias has been deleted, you can use the `SHOW ALIASES FOR DATABASE` command.
+The deleted alias will no longer appear in the `aliases` column.
.Query
[source, cypher]
@@ -684,7 +710,8 @@ SHOW DATABASE `northwind-graph-2021`
=== Delete remote database aliases
-Delete a remote database alias.
+You can delete a remote database alias using the `DROP ALIAS` command.
+For example:
.Query
[source, cypher]
@@ -692,7 +719,7 @@ Delete a remote database alias.
DROP ALIAS `remote-northwind` FOR DATABASE
----
-When a database alias has been deleted, it will no longer show up in the `SHOW ALIASES FOR DATABASE` command.
+To verify that the remote database alias has been deleted, you can use the `SHOW ALIASES FOR DATABASE` command.
.Query
[source, cypher]
@@ -711,7 +738,6 @@ SHOW ALIASES `remote-northwind` FOR DATABASE
=== Use `IF EXISTS` when deleting database aliases
-
The `DROP ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias does not exist.
Inserting `IF EXISTS` after the alias name ensures that no error is returned and nothing happens should the alias not exist.
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
index c3d4a524c..7bd8f811e 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -1,9 +1,9 @@
:description: This page describes how to alter composite databases.
-[role=enterprise-edition not-on-aura]
+:page-role: new-2025.06 enterprise-edition not-on-aura
[[composite-databases-alter]]
= Alter composite databases
-Composite databases can be altered using `ALTER DATABASE`.
+You can modify composite databases using the Cypher command `ALTER DATABASE`.
== Syntax
@@ -21,6 +21,30 @@ SET DEFAULT LANGUAGE CYPHER {5\|25}
----
|===
-== Alter database default language
-The `ALTER DATABASE` command can be used to set the default Cypher version for a composite database in addition to standard databases.
-For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#alter-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
+== Change the default Cypher version of a composite database
+
+You can change the default Cypher version of an existing composite database using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
+For example:
+
+[source, cypher]
+----
+ALTER DATABASE inventory SET DEFAULT LANGUAGE CYPHER 25
+----
+
+This command will change the default Cypher version of the composite database `inventory` to Cypher 25.
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2* Queries -> Select Cypher version].
-
-[[composite-databases-stop]]
-== Stop composite databases
-
-Databases can be stopped using the command `STOP DATABASE`.
+This command creates a composite database named `inventory` with the default language set to Cypher 5.
-.Query
-[source, cypher]
-----
-STOP DATABASE inventory
-----
-
-[NOTE]
-====
-Both standard databases and composite databases can be stopped using this command.
-====
-
-The status of the stopped database can be seen using the command `SHOW DATABASE name`.
-
-.Query
-[source, cypher]
-----
-SHOW DATABASE inventory YIELD name, requestedStatus, currentStatus
-----
+include::partial$/view-cypher-version.adoc[]
.Result
-[role="queryresult"]
-----
-+-----------------------------------------------+
-| name | requestedStatus | currentStatus |
-+-----------------------------------------------+
-| "inventory" | "offline" | "offline" |
-+-----------------------------------------------+
-----
-
-[[composite-databases-start]]
-== Start composite databases
-
-Databases can be started using the command `START DATABASE`.
+[role="queryresult",options="header,footer",cols="2* Queries -> Select Cypher version].
-[role=enterprise-edition not-on-aura]
+You can change the default Cypher version of an existing database, including the `system` database, using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
+For example:
+
+[source, cypher]
+----
+ALTER DATABASE movies SET DEFAULT LANGUAGE CYPHER 25
+----
+This command will change the default Cypher version of the database `movies` to Cypher 25.
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2* Upgrade a cluster].
====
-[[create-neo4j-database]]
-== Create databases
You can create a database using the Cypher command `CREATE DATABASE`.
The initial contents of the database depend on the state of the server and the options provided to the command.
-When no additional options are provided, `CREATE DATABASE` will attempt to mount any pre-existing store files in place (e.g., as the result of restoring a backup).
+When no additional options are provided, `CREATE DATABASE` will attempt to mount any pre-existing store files in place (e.g., as the result of restoring a backup).
If no pre-existing store files are available, it will create an empty database.
[NOTE]
@@ -37,12 +35,12 @@ However, if the store is seeded with `seedURI`, `existingDataSeedServer` or `exi
See xref:database-internals/store-formats.adoc[Store formats], for more details about available database store formats in Neo4j.
-=== Syntax
+== Syntax
[options="header", width="100%", cols="1m,5a"]
[.tabbed-example]
=====
-[role=include-with-Cypher-5]
+[role=include-with-cypher-5]
======
[options="header", width="100%", cols="1m,5a"]
|===
@@ -71,7 +69,7 @@ CREATE OR REPLACE DATABASE name
======
-[role=include-with-Cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
[options="header", width="100%", cols="1m,5a"]
@@ -103,11 +101,11 @@ CREATE OR REPLACE DATABASE name
[[manage-databases-create-database-options]]
-=== Options
+== Options
[.tabbed-example]
=====
-[.include-with-cypher-5]
+[role=include-with-cypher-5]
======
The `CREATE DATABASE` command can have a map of options, e.g. `OPTIONS {key: 'value'}`.
@@ -175,7 +173,7 @@ The `existingDataSeedInstance` and `existingDataSeedServer` are still not suppor
More details about seeding options can be found in xref::clustering/databases.adoc#cluster-seed[Seed a cluster].
====
======
-[.include-with-cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
The `CREATE DATABASE [OR REPLACE]` command can have a map of options, e.g., `OPTIONS {key: 'value'}`.
@@ -218,7 +216,7 @@ If the store is seeded with `seedURI` or `existingDataSeedServer`, or if the com
| `seedRestoreUntil`
| Datetime or transaction id. E.g. `datetime("2025-01-01T12:15:00.000+0100")` or `123456`
-|
+|
If you are passing a `seedURI` that leads to a backup chain, including differential backups, you can choose to not apply all the transactions in the differential backups.
To seed up to a specific date, specify a `datetime`.
This will seed the database with transactions committed before the provided timestamp.
@@ -239,15 +237,15 @@ Included for backward compatibility only, has no effect and will be removed in a
======
=====
-=== Examples
+The following examples show how to create a database using the `CREATE DATABASE` command with various options.
-==== Create a database
+== Create a database
-To create a database named `customers`, use the command `CREATE DATABASE` followed by the name of this database.
+To create a database named `actors`, use the command `CREATE DATABASE` followed by the name of this database.
[source, cypher]
----
-CREATE DATABASE customers
+CREATE DATABASE actors
----
When you create a database, it shows up in the listing provided by the command `SHOW DATABASES`:
@@ -263,7 +261,7 @@ SHOW DATABASES YIELD name
+-------------+
| name |
+-------------+
-| "customers" |
+| "actors" |
| "movies" |
| "neo4j" |
| "system" |
@@ -271,11 +269,11 @@ SHOW DATABASES YIELD name
----
-==== Create a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
+== Create a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
[.tabbed-example]
=====
-[.include-with-cypher-5]
+[role=include-with-cypher-5]
======
Sub-clause `WAIT` allows you to specify a time limit for the command to complete and return.
@@ -297,7 +295,7 @@ CREATE DATABASE slow WAIT 5 SECONDS
The `success` column provides an aggregate status of whether or not the command is considered successful.
Thus, every row has the same value, determined on a successful completion without a timeout.
======
-[.include-with-cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
Sub-clause `WAIT` allows you to specify a time limit for the command to complete and return.
@@ -320,11 +318,11 @@ info: Server `ServerId{0f7cb48e}` at address `server3:7687` has caught up.
----
The command returns a notification for each server in the cluster to indicate the status of that command on that server.
-In this example, all three cluster members have returned `Neo.ClientNotification.Cluster.ServerCaughtUp`, which indicates that the server has applied the command successfully and is up to date.
+In this example, all three cluster members have returned `03N85 (Neo.ClientNotification.Cluster.ServerCaughtUp)`, which indicates that the server has applied the command successfully and is up to date.
======
=====
-==== Create databases with `IF NOT EXISTS` or `OR REPLACE`
+== Create a database with `IF NOT EXISTS` or `OR REPLACE`
The `CREATE DATABASE` command is optionally idempotent, with the default behavior to fail with an error if the database already exists.
There are two ways to circumvent this behavior.
@@ -333,17 +331,17 @@ First, appending `IF NOT EXISTS` to the command ensures that no error is returne
[source, cypher]
----
-CREATE DATABASE customers IF NOT EXISTS
+CREATE DATABASE actors IF NOT EXISTS
----
Second, adding `OR REPLACE` to the command deletes any existing database and creates a new one.
[source, cypher]
----
-CREATE OR REPLACE DATABASE customers
+CREATE OR REPLACE DATABASE actors
----
-This is equivalent to running `DROP DATABASE customers IF EXISTS` followed by `CREATE DATABASE customers`.
+This is equivalent to running `DROP DATABASE actors IF EXISTS` followed by `CREATE DATABASE actors`.
Keep in mind that using `CREATE OR REPLACE DATABASE` also removes indexes and constraints.
To preserve them, run the following Cypher commands before the `CREATE OR REPLACE DATABASE` and save their outputs:
@@ -367,144 +365,32 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
-==== Create databases with `DEFAULT LANGUAGE`
-The `CREATE DATABASE` command can be used to set the default Cypher version when creating a database.
-For more information see link:{neo4j-docs-base-uri}/cypher-manual/current/queries/select-version/#select-default-cypher-version[Cypher Manual -> Queries -> Select Cypher version].
-
-[[manage-databases-start]]
-== Start databases
-
-Databases can be started using the command `START DATABASE`.
-
-[NOTE]
-====
-Both standard databases and composite databases can be started using this command.
-====
-
-
-=== Syntax
-
-[options="header", width="100%", cols="1m,5a"]
-|===
-| Command | Syntax
-
-| START DATABASE
-|
-[source, syntax, role="noheader"]
-----
-START DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
-
-|===
+[role=new-2025.06]
+== Create a database with `DEFAULT LANGUAGE`
-=== Examples
-
-==== Start a database
-
-Starting a database is a straightforward operation.
-Suppose you have a database named `customers`.
-To start it, use the following command:
+You can set the default Cypher version for a database when creating it.
+If not specified, the default language for the database is set to the default language of the DBMS.
+For example:
[source, cypher]
----
-START DATABASE customers
+CREATE DATABASE actors DEFAULT LANGUAGE CYPHER 5
----
+This command creates a database named `actors` with the default Cypher version set to 5.
-You can see the status of the started database by running the command `SHOW DATABASE name`.
-
-[source, cypher]
-----
-SHOW DATABASE customers YIELD name, requestedStatus, currentStatus
-----
+include::partial$/view-cypher-version.adoc[]
.Result
-[role="queryresult"]
-----
-+-----------------------------------------------+
-| name | requestedStatus | currentStatus |
-+-----------------------------------------------+
-| "customers" | "online" | "online" |
-+-----------------------------------------------+
-----
-
-
-==== Start a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
-
-You can start your database using `WAIT` sub-clause to ensure that the command waits for a specified amount of time until the database is started.
-
-[source, cypher]
-----
-START DATABASE customers WAIT 5 SECONDS
-----
-
-
-[[manage-databases-stop]]
-== Stop databases
-
-Databases can be stopped using the command `STOP DATABASE`.
-
-=== Syntax
-
-[options="header", width="100%", cols="1m,5a"]
+[role="queryresult",options="header,footer",cols="2*
|defaultLanguage
-|The default query language for this database.
-Queries that are not prefixed with a query language version will default to executing with this version of Cypher.
+|The default Cypher version for this database.
+Queries that are not prefixed with a Cypher version will be executed with the Cypher version of the database. label:new[Introduced in Neo4j 2026.06]
|STRING
|options
@@ -428,3 +428,19 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results.
| "neo4j" | "online" | "online" |
+--------------------------------------------+
----
+
+== Show the default Cypher version of a database
+
+include::partial$/view-cypher-version.adoc[]
+
+.Result
+[role="queryresult",options="header,footer",cols="2* Upgrade a cluster].
+====
+
+
+[[manage-databases-start]]
+== Start databases
+
+Databases can be started using the command `START DATABASE`.
+
+[NOTE]
+====
+Both standard databases and composite databases can be started using this command.
+====
+
+
+=== Syntax
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| START DATABASE
+|
+[source, syntax, role="noheader"]
+----
+START DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+|===
+
+=== Start a database
+
+Starting a database is a straightforward operation.
+Suppose you have a database named `customers`.
+To start it, use the following command:
+
+[source, cypher]
+----
+START DATABASE customers
+----
+
+You can see the status of the started database by running the command `SHOW DATABASE name`.
+
+[source, cypher]
+----
+SHOW DATABASE customers YIELD name, requestedStatus, currentStatus
+----
+
+.Result
+[role="queryresult"]
+----
++-----------------------------------------------+
+| name | requestedStatus | currentStatus |
++-----------------------------------------------+
+| "customers" | "online" | "online" |
++-----------------------------------------------+
+----
+
+
+=== Start a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
+
+You can start your database using `WAIT` sub-clause to ensure that the command waits for a specified amount of time until the database is started.
+
+[source, cypher]
+----
+START DATABASE customers WAIT 5 SECONDS
+----
+
+
+[[manage-databases-stop]]
+== Stop databases
+
+Databases can be stopped using the command `STOP DATABASE`.
+
+=== Syntax
+
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| STOP DATABASE
+|
+[source, syntax, role="noheader"]
+----
+STOP DATABASE name [WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+|===
+
+=== Stop a database
+
+To stop a database, use the following command:
+
+[source, cypher]
+----
+STOP DATABASE customers
+----
+
+[NOTE]
+====
+Both standard databases and composite databases can be stopped using this command.
+====
+
+The status of the stopped database can be seen using the command `SHOW DATABASE name`:
+
+[source, cypher]
+----
+SHOW DATABASE customers YIELD name, requestedStatus, currentStatus
+----
+
+.Result
+[role="queryresult"]
+----
++-----------------------------------------------+
+| name | requestedStatus | currentStatus |
++-----------------------------------------------+
+| "customers" | "offline" | "offline" |
++-----------------------------------------------+
+----
+
+=== Stop a database with xref:database-administration/standard-databases/wait-options.adoc[`WAIT`]
+
+You can also stop your database using the `WAIT` sub-clause, which allows you to specify the amount of time that the system should wait for the database to stop.
+
+[source, cypher]
+----
+STOP DATABASE customers WAIT 10 SECONDS
+----
+
+
+[NOTE]
+====
+Databases that are stopped with the `STOP` command are completely shut down and may be started again through the `START` command.
+In a cluster, as long as a database is in a shutdown state, it can not be considered available to other members of the cluster.
+It is not possible to do online backups against shutdown databases and they need to be taken into special consideration during disaster recovery, as they do not have a running Raft machine while shutdown.
+Unlike stopped databases, dropped databases are completely removed and are not intended to be used again at all.
+====
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index 21a889075..a0e268830 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -5,9 +5,18 @@
Almost all administration commands have variations.
The most common are parts of the command that are optional or that can have multiple values.
-See below a summary of the syntax used to describe all versions of a command.
+The syntax summaries on this page have examples for both Cypher 5 and Cypher 25 when available.
These summaries use some special characters to indicate such variations.
+== Cypher® versions
+
+Starting from Neo4j 2025.06, Cypher language introduces a new version Cypher 25.
+Cypher 5 will continue to be the default version for all newly-created databases, however, new features will be added only to Cypher 25.
+For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
+
+You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, per database, or by setting it on a per-query basis.
+For details, see the xref:configuration/cypher-version-configuration.adoc[].
+
[[administration-syntax-reading]]
== Reading the administration commands syntax
@@ -107,7 +116,7 @@ YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[.tabbed-example]
=====
-[role=include-with-Cypher-5]
+[role=include-with-cypher-5]
======
[options="header", width="100%", cols="1m,5a"]
|===
@@ -136,7 +145,7 @@ CREATE OR REPLACE DATABASE name
======
-[role=include-with-Cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
[options="header", width="100%", cols="1m,5a"]
@@ -170,7 +179,7 @@ CREATE OR REPLACE DATABASE name
[.tabbed-example]
=====
-[role=include-with-Cypher-5]
+[role=include-with-cypher-5]
======
[options="header", width="100%", cols="2m,4a"]
|===
@@ -196,7 +205,7 @@ CREATE OR REPLACE COMPOSITE DATABASE name
|===
======
-[role=include-with-Cypher-25]
+[role=include-with-cypher-25 label--new-2025.06]
======
[options="header", width="100%", cols="2m,4a"]
|===
@@ -223,8 +232,46 @@ CREATE OR REPLACE COMPOSITE DATABASE name
======
=====
+
=== Alter a database
+[.tabbed-example]
+=====
+[role=include-with-cypher-5]
+======
+[options="header", width="100%", cols="1m,5a"]
+|===
+| Command | Syntax
+
+| ALTER DATABASE
+|
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+{
+SET ACCESS {READ ONLY \| READ WRITE} \|
+SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
+SET OPTION option value \|
+}
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+[source, syntax, role="noheader"]
+----
+ALTER DATABASE name [IF EXISTS]
+REMOVE OPTION option
+[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
+----
+
+[NOTE]
+====
+There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
+====
+|===
+======
+
+[role=include-with-cypher-25 label--new-2025.06]
+======
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
@@ -243,7 +290,7 @@ SET DEFAULT LANGUAGE CYPHER {5\|25}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
-[source, syntax]
+[source, syntax, role="noheader"]
----
ALTER DATABASE name [IF EXISTS]
REMOVE OPTION option
@@ -255,13 +302,16 @@ REMOVE OPTION option
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
====
|===
+======
+=====
+[role=label--new-2025.06]
=== Alter a composite database
+
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
-
| ALTER DATABASE
|
[source, syntax, role="noheader"]
diff --git a/modules/ROOT/partials/view-cypher-version.adoc b/modules/ROOT/partials/view-cypher-version.adoc
new file mode 100644
index 000000000..1392520f2
--- /dev/null
+++ b/modules/ROOT/partials/view-cypher-version.adoc
@@ -0,0 +1,8 @@
+To view the default Cypher version of each database in the DBMS, run the command `SHOW DATABASES` with the `YIELD` clause and specify the `defaultLanguage` column.
+For example:
+
+.Query
+[source, cypher]
+----
+SHOW DATABASES YIELD name, defaultLanguage
+----
\ No newline at end of file
From ae4195ac421f82fe0c7ea032fc7959516b266d64 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 30 May 2025 15:39:43 +0100
Subject: [PATCH 13/65] add some labels and minor fixes
---
.../aliases/manage-aliases-composite-databases.adoc | 8 ++++++--
.../aliases/manage-aliases-standard-databases.adoc | 4 +++-
.../composite-databases/alter-composite-databases.adoc | 1 +
.../composite-databases/create-composite-databases.adoc | 2 +-
.../standard-databases/alter-databases.adoc | 2 +-
.../standard-databases/create-databases.adoc | 6 +++---
.../standard-databases/listing-databases.adoc | 1 +
modules/ROOT/pages/database-administration/syntax.adoc | 9 +--------
modules/ROOT/pages/introduction.adoc | 4 +++-
9 files changed, 20 insertions(+), 17 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index e2c1d0af3..b39aa6016 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -18,8 +18,12 @@ CREATE DATABASE `perennial-flowers`;
----
////
-Aliases in composite databases cannot be assigned a default Cypher version.
-They always get the default from the composite database.
+[NOTE]
+====
+Starting with Neo4j 2025.06, a database can be assigned a default Cypher version.
+However, aliases in composite databases cannot be assigned a default Cypher version.
+They always get the Cypher version of the composite database.
+====
[[manage-aliases-composite-databases-list]]
== List database aliases in composite databases
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index eb1aa8b5a..e5e70a7e0 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -41,7 +41,7 @@ It can be used for:
* Connecting to a database of a remote Neo4j DBMS
* `USE` clauses
* Setting a user's home database and defining the access privileges
-* Setting a default Cypher version for queries to the remote database.
+* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
+
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
@@ -469,6 +469,7 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD *
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
----
+[role=label--new-2025.06]
==== Set a default Cypher version for remote database aliases
You can set a default Cypher version for remote database aliases using the `DEFAULT LANGUAGE` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
@@ -624,6 +625,7 @@ ALTER ALIAS `movie scripts` SET DATABASE
DRIVER {}
----
+[role=label--new-2025.06]
=== Alter the default Cypher version of a remote database alias
You can alter the default Cypher version of a remote database alias using the `DEFAULT LANGUAGE` clause of the `ALTER ALIAS` command.
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
index 7bd8f811e..dc446f9bd 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -21,6 +21,7 @@ SET DEFAULT LANGUAGE CYPHER {5\|25}
----
|===
+[role=label--new-2025.06]
== Change the default Cypher version of a composite database
You can change the default Cypher version of an existing composite database using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
diff --git a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
index 34e6a4158..0da70ed5b 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
@@ -93,7 +93,7 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
-[role=new-2025.06]
+[role=label--new-2025.06]
[[composite-databases-default-language]]
== Set the default Cypher version for a composite database
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index 739cc0368..a13df4e70 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -151,7 +151,7 @@ include::partial$/view-cypher-version.adoc[]
|===
| name | defaultLanguage
-| "actors" | "CYPHER 5"
+| "actors" | "CYPHER 25"
| "movies" | "CYPHER 25"
| "neo4j" | "CYPHER 25"
| "system" | "CYPHER 25"
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index d131162d3..dbeb83fb4 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -365,7 +365,7 @@ The behavior of `IF NOT EXISTS` and `OR REPLACE` apply to both standard and comp
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
====
-[role=new-2025.06]
+[role=label--new-2025.06]
== Create a database with `DEFAULT LANGUAGE`
You can set the default Cypher version for a database when creating it.
@@ -374,7 +374,7 @@ For example:
[source, cypher]
----
-CREATE DATABASE actors DEFAULT LANGUAGE CYPHER 5
+CREATE DATABASE actors DEFAULT LANGUAGE CYPHER 25
----
This command creates a database named `actors` with the default Cypher version set to 5.
@@ -385,7 +385,7 @@ include::partial$/view-cypher-version.adoc[]
|===
| name | defaultLanguage
-| "actors" | "CYPHER 5"
+| "actors" | "CYPHER 25"
| "movies" | "CYPHER 5"
| "neo4j" | "CYPHER 25"
| "system" | "CYPHER 25"
diff --git a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
index 141efca43..8021d6cb5 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/listing-databases.adoc
@@ -429,6 +429,7 @@ It is also possible to use `SKIP` and `LIMIT` to paginate the results.
+--------------------------------------------+
----
+[role=label--new-2025.06]
== Show the default Cypher version of a database
include::partial$/view-cypher-version.adoc[]
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index a0e268830..fa1cd7e52 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -8,14 +8,7 @@ The most common are parts of the command that are optional or that can have mult
The syntax summaries on this page have examples for both Cypher 5 and Cypher 25 when available.
These summaries use some special characters to indicate such variations.
-== Cypher® versions
-
-Starting from Neo4j 2025.06, Cypher language introduces a new version Cypher 25.
-Cypher 5 will continue to be the default version for all newly-created databases, however, new features will be added only to Cypher 25.
-For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
-
-You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, per database, or by setting it on a per-query basis.
-For details, see the xref:configuration/cypher-version-configuration.adoc[].
+include::partial$/cypher-versions.adoc[]
[[administration-syntax-reading]]
== Reading the administration commands syntax
diff --git a/modules/ROOT/pages/introduction.adoc b/modules/ROOT/pages/introduction.adoc
index 328b1b346..8bf2ef587 100644
--- a/modules/ROOT/pages/introduction.adoc
+++ b/modules/ROOT/pages/introduction.adoc
@@ -283,7 +283,7 @@ For more information about what data is collected, see link:https://neo4j.com/do
====
[[versioning]]
-== Versioning
+== Neo4j server versions
2025.01.0 introduces a new calendar versioning (CalVer) for the Neo4j server instead of the previously used semantic versioning (SemVer).
The new versioning format, *YYYY.MM.Patch*, is based on the year and month of the release, for example, 2025.01.0, 2025.02.0, and so on.
@@ -293,6 +293,8 @@ Some of the releases will be designated as long-term support (LTS) releases.
link:{aura-uri}[Neo4j Aura] always uses the latest version of the Neo4j server.
+include::partial$/cypher-versions.adoc[]
+
== Operations Manual versioning
The Operations Manual is versioned according to the calendar version of the Neo4j server.
From 41195322abf8458f7d4a422da92ebc8785964d2e Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 10:17:35 +0100
Subject: [PATCH 14/65] add the missing partial file
---
modules/ROOT/partials/cypher-versions.adoc | 9 +++++++++
1 file changed, 9 insertions(+)
create mode 100644 modules/ROOT/partials/cypher-versions.adoc
diff --git a/modules/ROOT/partials/cypher-versions.adoc b/modules/ROOT/partials/cypher-versions.adoc
new file mode 100644
index 000000000..e144c9809
--- /dev/null
+++ b/modules/ROOT/partials/cypher-versions.adoc
@@ -0,0 +1,9 @@
+[role=label--new-2025.06]
+== Cypher® versions
+
+Starting from Neo4j 2025.06, Cypher language introduces a new version Cypher 25.
+Cypher 5 will continue to be the default version for all newly-created databases, however, new features will be added only to Cypher 25.
+For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
+
+You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, per database, or by setting it on a per-query basis.
+For details, see the xref:configuration/cypher-version-configuration.adoc[].
From afd11e562494b89c9e597d0d286eb16be62bdc3b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 15:49:53 +0100
Subject: [PATCH 15/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
Co-authored-by: Therese Magnusson
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index 480f3fca3..561d4509e 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -18,7 +18,7 @@ It only applies to newly-created databases unless the version is specified as pa
Configure a a default Cypher version per database::
The default language for a specific database can be set using a Cypher admin command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
This setting determines the default language for the specified database, overriding the default language set in the configuration file.
-For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER_25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER_5`.
+For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
If not specified, the default language for the database is set to the default language of the DBMS.
Setting the default language requires the `SET DATABASE DEFAULT LANGUAGE` privilege.
From 71d2f0b70c14b6fb86397ab4bb3bf764161c980b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 15:50:06 +0100
Subject: [PATCH 16/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
Co-authored-by: Therese Magnusson
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index 561d4509e..fb668219a 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -16,7 +16,7 @@ Changing this setting in an existing DBMS, *does not* affect existing databases.
It only applies to newly-created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
Configure a a default Cypher version per database::
-The default language for a specific database can be set using a Cypher admin command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
+The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
This setting determines the default language for the specified database, overriding the default language set in the configuration file.
For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
From 8c5c3026c6a89f7067a0f88e8a4c8eaae11798ae Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 15:50:23 +0100
Subject: [PATCH 17/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
Co-authored-by: Therese Magnusson
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index fb668219a..93a85c97f 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -15,7 +15,7 @@ The default language version for the whole DBMS can be configured in the _neo4j.
Changing this setting in an existing DBMS, *does not* affect existing databases.
It only applies to newly-created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
-Configure a a default Cypher version per database::
+Configure a default Cypher version per database::
The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
This setting determines the default language for the specified database, overriding the default language set in the configuration file.
For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
From 642d3a108ededbee68cee742d442b49386fffde6 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 15:51:49 +0100
Subject: [PATCH 18/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index 93a85c97f..629e9c5b2 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -3,7 +3,7 @@
:page-role: new-2025.06
:description: How to configure the Cypher default version.
-You can specify the version of Cypher in which you want to run your administrative commands, choosing between Cypher 5 and Cypher 25.
+You can specify the version of Cypher in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
Cypher 5 is the default version for all newly-created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
From 4d677dd2949302e1b488e3da8e17c013b04072b0 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 15:52:43 +0100
Subject: [PATCH 19/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index 629e9c5b2..fbbf1cae0 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -17,7 +17,7 @@ It only applies to newly-created databases unless the version is specified as pa
Configure a default Cypher version per database::
The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
-This setting determines the default language for the specified database, overriding the default language set in the configuration file.
+This clause determines the default Cypher version for the specified database, overriding the version set in the configuration file.
For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
If not specified, the default language for the database is set to the default language of the DBMS.
From 71fbf7030194f0291fb7b3d358852d7c5b41dcac Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 2 Jun 2025 16:26:57 +0100
Subject: [PATCH 20/65] update the Database management command syntax intro
---
modules/ROOT/pages/database-administration/syntax.adoc | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index fa1cd7e52..a9916f9cb 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -3,10 +3,11 @@
= Database management command syntax
Almost all administration commands have variations.
-The most common are parts of the command that are optional or that can have multiple values.
-
-The syntax summaries on this page have examples for both Cypher 5 and Cypher 25 when available.
-These summaries use some special characters to indicate such variations.
+The most common variations include parts of the commands that are optional, or that can have multiple values.
+This page summarizes the various command syntax options.
+Some variations are indicated using special characters.
+See <> for details.
+It also includes examples for both Cypher 5 and Cypher 25 when available.
include::partial$/cypher-versions.adoc[]
From 79fc1bfe300704f642327500e907ebdd872ab295 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 10 Jun 2025 15:21:29 +0100
Subject: [PATCH 21/65] Update
modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
Co-authored-by: Therese Magnusson
---
.../aliases/manage-aliases-composite-databases.adoc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index b39aa6016..5ce5231e7 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -20,9 +20,9 @@ CREATE DATABASE `perennial-flowers`;
[NOTE]
====
-Starting with Neo4j 2025.06, a database can be assigned a default Cypher version.
-However, aliases in composite databases cannot be assigned a default Cypher version.
-They always get the Cypher version of the composite database.
+Starting with Neo4j 2025.06, a database or remote alias can be assigned a default Cypher version.
+However, local aliases and aliases in composite databases cannot be assigned a default Cypher version.
+Local aliases always get the Cypher version of their target database and aliases in composite databases always get the Cypher version of the composite database.
====
[[manage-aliases-composite-databases-list]]
From c1c5910be4a467a3866656c0b20a8a59138601c5 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 10 Jun 2025 15:22:57 +0100
Subject: [PATCH 22/65] Update
modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
Co-authored-by: Therese Magnusson
---
.../standard-databases/create-databases.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index dbeb83fb4..965dbc528 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -376,7 +376,7 @@ For example:
----
CREATE DATABASE actors DEFAULT LANGUAGE CYPHER 25
----
-This command creates a database named `actors` with the default Cypher version set to 5.
+This command creates a database named `actors` with the default Cypher version set to 25.
include::partial$/view-cypher-version.adoc[]
From 39ac4e7c7af679cd02e292ed45e4ef621517c00a Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 10 Jun 2025 15:23:28 +0100
Subject: [PATCH 23/65] Update
modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
Co-authored-by: Therese Magnusson
---
.../standard-databases/start-stop-databases.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
index 57c9e3f13..1f5129ad6 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
@@ -1,4 +1,4 @@
-:description: how to start, and stop databases in Neo4j. How to use `START DATABASE` and `STOP DATABASE` Cypher commands.
+:description: how to start and stop databases in Neo4j. How to use `START DATABASE` and `STOP DATABASE` Cypher commands.
[role=enterprise-edition not-on-aura]
= Start and stop databases
From 93b7a0b68f42cebe0d60034cac354154e28dbb2b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 23 Jun 2025 17:06:44 +0100
Subject: [PATCH 24/65] apply suggestions from review
---
.../dbms-administration.adoc | 79 ++++++++++++++----
.../manage-aliases-standard-databases.adoc | 74 +++++++++--------
.../pages/database-administration/index.adoc | 11 ++-
.../standard-databases/alter-databases.adoc | 8 +-
.../standard-databases/create-databases.adoc | 29 ++++---
.../start-stop-databases.adoc | 6 --
.../pages/database-administration/syntax.adoc | 83 +++++++++----------
modules/ROOT/partials/cypher-versions.adoc | 9 +-
8 files changed, 178 insertions(+), 121 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 7269078c5..5be186d0d 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -79,13 +79,14 @@ The xref:authentication-authorization/built-in-roles.adoc#access-control-built-i
These include:
-* Create, delete, and modify databases and aliases.
+* <> and <>.
* Change configuration parameters.
-* Manage transactions.
-* Manage users and roles.
-* Manage sub-graph privileges.
-* Manage procedure security.
-* Load data.
+* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
+* Manage <> and <>.
+* Manage sub-graph <>.
+* Manage <>.
+* Manage <>.
+* Manage <>.
To enable a user to perform these tasks, you can grant them the `admin` role, but it is also possible to make a custom role with a subset of these privileges.
All privileges are also assignable using Cypher commands.
@@ -148,7 +149,7 @@ To create a more powerful administrator, you can grant a different set of privil
=== Create a custom administrator role by copying the `admin` role
-You can also create a custom administrator role that can perform almost all DBMS capabilities, excluding database management.
+You can also create a custom administrator role that can perform almost all DBMS capabilities, excluding database management.
This is done by copying the `admin` role and denying the privileges you do not want.
However, the role still has some limited database capabilities, such as managing transactions:
@@ -177,7 +178,7 @@ DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator
GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator
----
+
-As a result, the `customAdministrator` role has privileges that include all DBMS privileges except creating, dropping, and modifying databases and aliases, as well as managing transactions.
+As a result, the `customAdministrator` role has privileges that include all DBMS privileges except creating, dropping, and modifying databases, as well as managing transactions.
. To list all privileges for the role `customAdministrator` as commands, use the following query:
+
[source, cypher, role=noplay]
@@ -195,6 +196,37 @@ SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
a|Rows: 3
|===
+===
+
+CREATE ROLE newRole AS COPY OF admin and then revoke the ability to read/write/load data?
+
+[source, cypher, role=noplay]
+----
+CREATE ROLE newRole AS COPY OF admin;
+REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM newRole;
+REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM newRole;
+REVOKE GRANT WRITE ON GRAPH * FROM newRole;
+REVOKE GRANT LOAD ON ALL DATA FROM newRole;
+----
+
+potentially also remove the index/constraint/name management
+
+[source, cypher, role=noplay]
+----
+REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM newRole;
+REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM newRole;
+REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM newRole;
+REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM newRole;
+REVOKE GRANT SHOW INDEX ON DATABASE * FROM newRole;
+----
+
+If you want to be fancy we could also change what they have access on to system only:
+
+[source, cypher, role=noplay]
+----
+REVOKE GRANT ACCESS ON DATABASE * FROM newRole;
+GRANT ACCESS ON DATABASE system TO newRole;
+----
[[access-control-dbms-administration-role-management]]
== The DBMS `ROLE MANAGEMENT` privileges
@@ -335,7 +367,7 @@ a|Rows: 1
=== Grant privilege to assign roles
-You can grant the privilege to assign roles using the `ASSIGN ROLE` privilege.
+You can grant the privilege to assign roles to users using the `ASSIGN ROLE` privilege.
For example:
[source, cypher, role=noplay]
@@ -361,7 +393,7 @@ a|Rows: 1
=== Grant privilege to remove roles
-You can grant the privilege to remove roles using the `REMOVE ROLE` privilege.
+You can grant the privilege to remove roles from users using the `REMOVE ROLE` privilege.
For example:
[source, cypher, role=noplay]
@@ -390,13 +422,13 @@ a|Rows: 1
You can grant the privilege to show roles using the `SHOW ROLE` privilege.
A role with this privilege is allowed to execute the `SHOW ROLES` and `SHOW POPULATED ROLES` administration commands.
-The following query shows an example of how to grant the `SHOW ROLE` privilege:
-
[NOTE]
====
In order to use `SHOW ROLES WITH USERS` and `SHOW POPULATED ROLES WITH USERS` administration commands, both the `SHOW ROLE` and the `SHOW USER` privileges are required.
====
+The following query shows an example of how to grant the `SHOW ROLE` privilege:
+
[source, cypher, role=noplay]
----
GRANT SHOW ROLE ON DBMS TO roleShower
@@ -635,18 +667,31 @@ SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The `SET PASSWORDS` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
+The `SET PASSWORDS` privilege allows you to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
[source, cypher, role=noplay]
----
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
----
-A user that is granted the `SET AUTH` privilege is allowed to run the `ALTER USER` administration command with one or both of the `SET AUTH` and `REMOVE AUTH` parts:
+=== Grant privilege to modify users' auth providers
+
+You can grant the privilege to modify users' auth providers using the `SET AUTH` privilege.
+For example:
+
+[source, cypher, role=noplay]
+----
+GRANT SET AUTH ON DBMS TO userModifier
+----
+As a result, the `userModifier` role has privileges that only allow modifying users' auth providers.
+
+The `SET AUTH` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET
+AUTH` and `REMOVE AUTH` parts.
+For example:
[source, cypher, role=noplay]
----
-ALTER USER jake REMOVE AUTH 'native SET AUTH 'oidc-okta' { SET id 'jakesUniqueOktaUserId' }
+ALTER USER jake REMOVE AUTH 'native' SET AUTH 'oidc-okta' { SET id 'jakesUniqueOktaUserId' }
----
=== Grant privilege to modify the account status of users
@@ -675,7 +720,7 @@ SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-A user that is granted the `SET USER STATUS` privilege is allowed to run the `ALTER USER` administration command with only the `SET STATUS` part:
+The `SET USER STATUS` privilege allows the user to run the `ALTER USER` administration command with only the `SET STATUS` part:
[source, cypher, role=noplay]
----
@@ -709,7 +754,7 @@ SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-A user that is granted the `SET USER HOME DATABASE` privilege is allowed to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
+The `SET USER HOME DATABASE` privilege allows you to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
[source, cypher, role=noplay]
----
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index e5e70a7e0..fc6172d26 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -13,13 +13,6 @@ If a transaction modifies a database alias, other transactions concurrently exec
This prevents issues such as a transaction executing against multiple target databases for the same alias.
====
-When a query is run against a database alias, it will be redirected to the target database.
-The home database for users can be set to an alias, which will be resolved to the target database on use.
-Starting with Neo4j 2025.04, a database alias can also be set as the default database.
-
-This page describes managing database aliases for standard databases.
-For aliases created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database], see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
-
There are two kinds of database aliases - local and remote:
Local database aliases::
@@ -27,13 +20,7 @@ A local database alias can only target a database within the same DBMS.
It can be used in all Cypher commands in place of the target database.
Please note that the local database alias will be resolved while executing the command.
Privileges are defined on the target database, and not the local database alias.
-+
-[NOTE]
-====
-Starting with Neo4j 2025.06, a database can be assigned a default Cypher version.
-However, local database aliases cannot be assigned a default Cypher version.
-They always get the Cypher version of their target database.
-====
+
Remote database aliases::
A remote database alias may target a database from another Neo4j DBMS.
@@ -45,7 +32,20 @@ It can be used for:
+
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
-Starting with Neo4j 2025.06, a remote database alias can be assigned a default Cypher version.
+
+[NOTE]
+====
+Starting with Neo4j 2025.06, a database or remote alias can be assigned a default Cypher version.
+However, local database aliases cannot be assigned a default Cypher version.
+They always get the Cypher version of their target database.
+====
+
+When a query is run against a database alias, it will be redirected to the target database.
+The home database for users can be set to an alias, which will be resolved to the target database on use.
+Starting with Neo4j 2025.04, a database alias can also be set as the DBMS default database.
+
+This page describes managing database aliases for standard databases.
+For aliases created as part of a xref:database-administration/composite-databases/concepts.adoc[composite database], see xref:database-administration/aliases/manage-aliases-composite-databases.adoc[].
[[manage-aliases-list]]
== List database aliases
@@ -74,7 +74,7 @@ DEFAULT LANGUAGE CYPHER 25;
////
You can list all available database aliases using the `SHOW ALIASES FOR DATABASE` command.
-The command returns a table of all standard and composite database aliases. +
+The command returns a table of all database aliases, whether they belong to a composite database or not. +
If you need more details, you can append the command with `YIELD *`.
The `YIELD *` clause returns the full set of columns.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
@@ -337,7 +337,7 @@ CREATE OR REPLACE ALIAS `northwind` FOR DATABASE `northwind-graph-2021`
----
+
This is equivalent to running ```DROP ALIAS `northwind++` IF EXISTS FOR DATABASE++``` followed by ```CREATE ALIAS `northwind++` FOR DATABASE `northwind-graph-2021++````.
-+
+
[NOTE]
====
The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used together.
@@ -384,6 +384,8 @@ See xref:database-administration/aliases/remote-database-alias-configuration.ado
Since remote database aliases target databases that are not in this DBMS, they do not fetch the default Cypher version from their target like the local database aliases.
Instead, they are assigned the version given by xref:configuration/configuration-settings.adoc#config_db.query.default_language[`db.query.default_language`], which is set in the `neo4j.conf` file.
+Alternatively, you can specify the version in the `CREATE ALIAS` or `ALTER ALIAS` commands.
+See xref:database-administration/aliases/manage-aliases-standard-databases.adoc#set-default-language-for-remote-database-aliases[] and xref:database-administration/aliases/manage-aliases-standard-databases.adoc#alter-default-language-remote-database-alias[] for more information.
.Query
[source, cypher]
@@ -429,7 +431,7 @@ If `ssl_enforced` is set to true, a secure URL scheme is enforced.
It is be validated when the command is executed.
* `connection_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout].)
* `connection_max_lifetime` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].)
-* `connection_pool_acquisition_timeout` (Foror details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_acquisition_timeout[dbms.routing.driver.connection_pool_acquisition_timeout].)
+* `connection_pool_acquisition_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_acquisition_timeout[dbms.routing.driver.connection_pool_acquisition_timeout].)
* `connection_pool_idle_test` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_idle_test[dbms.routing.driver.connection_pool_idle_test].)
* `connection_pool_max_size` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].)
* `logging_level` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level].)
@@ -470,6 +472,7 @@ SHOW ALIAS `remote-with-driver-settings` FOR DATABASE YIELD *
----
[role=label--new-2025.06]
+[[set-default-language-for-remote-database-aliases]]
==== Set a default Cypher version for remote database aliases
You can set a default Cypher version for remote database aliases using the `DEFAULT LANGUAGE` clause of the `CREATE ALIAS` or `ALTER ALIAS` commands.
@@ -539,7 +542,8 @@ SHOW ALIAS `remote-northwind-2021` FOR DATABASE YIELD name, properties
== Alter database aliases
You can alter both local and remote database aliases using the `ALTER ALIAS` command.
-The command allows you to change the target database, properties, URL, user credentials, default language, or driver settings of the database alias.
+For all aliases, the command allows you to change the target database and properties of the database alias.
+For remote aliases, the command also allows you to change the URL, user credentials, default language, or driver settings of the database alias.
The required privileges are described in the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-alias-management[The DBMS ALIAS MANAGEMENT privileges].
Only the clauses used will be altered.
@@ -561,7 +565,7 @@ SET DATABASE TARGET `northwind-graph-2021`
----
To verify that the local database alias has a new target database, you can use the `SHOW DATABASE` command.
-
+It shows up in the `aliases` column for the target database.
.Query
[source, cypher]
----
@@ -587,25 +591,26 @@ For example:
.Query
[source, cypher]
----
-ALTER ALIAS `remote-northwind` SET DATABASE
-TARGET `northwind-graph-2020` AT "neo4j+s://other-location:7687"
+ALTER ALIAS `remote-northwind`
+SET DATABASE TARGET `northwind-graph-2020` AT "neo4j+s://other-location:7687"
----
=== Alter a remote database alias credentials and driver settings
-You can change the user credentials and driver settings of a remote database alias using the `USER`, `PASSWORD`, and `DRIVER` clauses of the `ALTER ALIAS` command.
+You can change the user credentials and driver settings of a remote database alias using the `USER`, `PASSWORD`, and `DRIVER` subclauses of the `SET DATABASE` clause of the `ALTER ALIAS` command.
For example:
.Query
[source, cypher]
----
-ALTER ALIAS `remote-with-driver-settings` SET DATABASE
-USER bob
-PASSWORD 'new_example_secret'
-DRIVER {
- connection_timeout: duration({ minutes: 1}),
- logging_level: 'debug'
-}
+ALTER ALIAS `remote-with-driver-settings`
+SET DATABASE
+ USER bob
+ PASSWORD 'new_example_secret'
+ DRIVER {
+ connection_timeout: duration({ minutes: 1}),
+ logging_level: 'debug'
+ }
----
[IMPORTANT]
@@ -626,16 +631,17 @@ DRIVER {}
----
[role=label--new-2025.06]
+[[alter-default-language-remote-database-alias]]
=== Alter the default Cypher version of a remote database alias
-You can alter the default Cypher version of a remote database alias using the `DEFAULT LANGUAGE` clause of the `ALTER ALIAS` command.
+You can alter the default Cypher version of a remote database alias using the `SET DATABASE DEFAULT LANGUAGE` clause of the `ALTER ALIAS` command.
For example:
.Query
[source, cypher]
----
-ALTER ALIAS `remote-with-default-language` SET DATABASE
-DEFAULT LANGUAGE CYPHER 5
+ALTER ALIAS `remote-with-default-language`
+SET DATABASE DEFAULT LANGUAGE CYPHER 5
----
=== Alter properties of local and remote database aliases
@@ -691,7 +697,7 @@ For example:
DROP ALIAS `northwind` FOR DATABASE
----
-To verify that the local database alias has been deleted, you can use the `SHOW ALIASES FOR DATABASE` command.
+To verify that the local database alias has been deleted, you can use the `SHOW DATABASES` command.
The deleted alias will no longer appear in the `aliases` column.
.Query
diff --git a/modules/ROOT/pages/database-administration/index.adoc b/modules/ROOT/pages/database-administration/index.adoc
index bf9d20936..39541c4a9 100644
--- a/modules/ROOT/pages/database-administration/index.adoc
+++ b/modules/ROOT/pages/database-administration/index.adoc
@@ -8,7 +8,16 @@ The DBMS can manage a standalone server, or a group of servers in a cluster.
A database is an administrative partition of a DBMS.
In practical terms, it is a physical structure of files organized within a directory or folder, that has the same name of the database.
-This chapter describes how to manage local and remote standard databases, composite databases, and database aliases.
+
+This chapter describes how to manage local and remote standard databases, composite databases, and database aliases. +
+All databases are managed using the Cypher administration commands.
+For more information on the Cypher administration commands syntax, see xref:database-administration/syntax.adoc[Database management command syntax].
+
+[WARNING]
+====
+Cypher administration commands must not be used during a rolling upgrade.
+For more information, see link:{neo4j-docs-base-uri}/upgrade-migration-guide/upgrade/upgrade-4.4/causal-cluster/[Upgrade and Migration Guide -> Upgrade a cluster].
+====
== Standard databases
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index a13df4e70..9507ce748 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -8,7 +8,7 @@ You can modify standard databases using the Cypher command `ALTER DATABASE`.
[.tabbed-example]
=====
-[role=include-with-cypher-5]
+[role=include-with-cypher-5 label--before-2025.06]
======
[options="header", width="100%", cols="1m,5a"]
|===
@@ -22,7 +22,7 @@ ALTER DATABASE name [IF EXISTS]
{
SET ACCESS {READ ONLY \| READ WRITE} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value \|
+SET OPTION option value
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -133,7 +133,7 @@ SET ACCESS READ WRITE
[role=label--new-2025.06]
[[alter-database-default-language]]
-== Alter database default language
+== Alter database default Cypher version
You can change the default Cypher version of an existing database, including the `system` database, using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
For example:
@@ -168,7 +168,7 @@ For more information, see xref::clustering/databases.adoc#alter-topology[Managin
[role=label--enterprise-edition label--not-on-aura]
[[alter-database-options]]
-== `ALTER DATABASE` options
+== Alter database options
The `ALTER DATABASE` command can be used to set or remove specific options for a database.
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index 965dbc528..bc1cacbcf 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -9,13 +9,6 @@ The metadata for these databases, including the associated security model, is ma
All multi-database administrative commands must be run against the `system` database.
These administrative commands are automatically routed to the `system` database when connected to the DBMS over Bolt.
-[NOTE]
-====
-Administrative commands should not be used during a rolling upgrade.
-For more information, see link:{neo4j-docs-base-uri}/upgrade-migration-guide/upgrade/upgrade-4.4/causal-cluster/[Upgrade and Migration Guide -> Upgrade a cluster].
-====
-
-
You can create a database using the Cypher command `CREATE DATABASE`.
The initial contents of the database depend on the state of the server and the options provided to the command.
When no additional options are provided, `CREATE DATABASE` will attempt to mount any pre-existing store files in place (e.g., as the result of restoring a backup).
@@ -67,9 +60,13 @@ CREATE OR REPLACE DATABASE name
----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available in Cypher 5 starting from Neo4j 2025.06 onwards.
+====
======
-[role=include-with-cypher-25 label--new-2025.06]
+[role=include-with-cypher-25]
======
[options="header", width="100%", cols="1m,5a"]
@@ -96,6 +93,11 @@ CREATE OR REPLACE DATABASE name
----
|===
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards. +
+`[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` is replaced by `[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` in Cypher 25.
+====
======
=====
@@ -173,7 +175,7 @@ The `existingDataSeedInstance` and `existingDataSeedServer` are still not suppor
More details about seeding options can be found in xref::clustering/databases.adoc#cluster-seed[Seed a cluster].
====
======
-[role=include-with-cypher-25 label--new-2025.06]
+[role=include-with-cypher-25]
======
The `CREATE DATABASE [OR REPLACE]` command can have a map of options, e.g., `OPTIONS {key: 'value'}`.
@@ -223,17 +225,22 @@ This will seed the database with transactions committed before the provided time
To seed up to a specific transaction ID, specify a transaction ID.
This will seed the database with transactions up to, but not including the specified transaction.
-| `seedSourceDatabase`
+| `seedSourceDatabase` label:new[Introduced in 2025.06]
| A source database name
|
If the `seedURI` points to a folder containing backups for multiple databases, you can specify the database name to filter the artifacts.
-| `existingData` label:deprecated[Deprecated]
+| `existingData` label:deprecated[Deprecated in 2025.06]
| `use`
|
Included for backward compatibility only, has no effect and will be removed in a future version.
|===
+
+[NOTE]
+====
+In Cypher 25, the options `seedCredentials` and `existingDataSeedInstance` have been removed, while the `existingData` option is now deprecated and has no effect.
+====
======
=====
diff --git a/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
index 1f5129ad6..def6fb8e8 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/start-stop-databases.adoc
@@ -8,12 +8,6 @@ The metadata for these databases, including the associated security model, is ma
All multi-database administrative commands must be run against the `system` database.
These administrative commands are automatically routed to the `system` database when connected to the DBMS over Bolt.
-[NOTE]
-====
-Administrative commands should not be used during a rolling upgrade.
-For more information, see link:{neo4j-docs-base-uri}/upgrade-migration-guide/upgrade/upgrade-4.4/causal-cluster/[Upgrade and Migration Guide -> Upgrade a cluster].
-====
-
[[manage-databases-start]]
== Start databases
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index a9916f9cb..ee56ed839 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -4,13 +4,15 @@
Almost all administration commands have variations.
The most common variations include parts of the commands that are optional, or that can have multiple values.
-This page summarizes the various command syntax options.
Some variations are indicated using special characters.
See <> for details.
-It also includes examples for both Cypher 5 and Cypher 25 when available.
include::partial$/cypher-versions.adoc[]
+This page summarizes the various command syntax options.
+It also includes examples for both Cypher 5 and Cypher 25 when available.
+
+
[[administration-syntax-reading]]
== Reading the administration commands syntax
@@ -115,7 +117,6 @@ YIELD { * \| field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
-
| CREATE DATABASE
|
[source, syntax, role="noheader"]
@@ -137,9 +138,13 @@ CREATE OR REPLACE DATABASE name
----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
======
-[role=include-with-cypher-25 label--new-2025.06]
+[role=include-with-cypher-25]
======
[options="header", width="100%", cols="1m,5a"]
@@ -166,6 +171,11 @@ CREATE OR REPLACE DATABASE name
----
|===
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards. +
+`[TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` is replaced by `[[SET] TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}]]` in Cypher 25.
+====
======
=====
@@ -197,9 +207,14 @@ CREATE OR REPLACE COMPOSITE DATABASE name
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
======
-[role=include-with-cypher-25 label--new-2025.06]
+[role=include-with-cypher-25]
======
[options="header", width="100%", cols="2m,4a"]
|===
@@ -223,16 +238,17 @@ CREATE OR REPLACE COMPOSITE DATABASE name
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
+
+[NOTE]
+====
+`[[SET] DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
======
=====
=== Alter a database
-[.tabbed-example]
-=====
-[role=include-with-cypher-5]
-======
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
@@ -246,6 +262,7 @@ ALTER DATABASE name [IF EXISTS]
SET ACCESS {READ ONLY \| READ WRITE} \|
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
SET OPTION option value \|
+SET DEFAULT LANGUAGE CYPHER {5\|25}
}
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
@@ -256,48 +273,15 @@ ALTER DATABASE name [IF EXISTS]
REMOVE OPTION option
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
-
-[NOTE]
-====
-There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
-====
-|===
-======
-
-[role=include-with-cypher-25 label--new-2025.06]
-======
-[options="header", width="100%", cols="1m,5a"]
|===
-| Command | Syntax
-| ALTER DATABASE
-|
-[source, syntax, role="noheader"]
-----
-ALTER DATABASE name [IF EXISTS]
-{
-SET ACCESS {READ ONLY \| READ WRITE} \|
-SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value \|
-SET DEFAULT LANGUAGE CYPHER {5\|25}
-}
-[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
-
-[source, syntax, role="noheader"]
-----
-ALTER DATABASE name [IF EXISTS]
-REMOVE OPTION option
-[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
[NOTE]
====
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
+
+`SET DEFAULT LANGUAGE CYPHER {5|25}` is available from Neo4j 2025.06 onwards.
====
-|===
-======
-=====
[role=label--new-2025.06]
=== Alter a composite database
@@ -432,6 +416,11 @@ AT 'url' USER username PASSWORD 'password'
-----
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+
=== Alter a local alias
[options="header", width="100%", cols="1m,5a"]
@@ -465,9 +454,13 @@ ALTER ALIAS name [IF EXISTS] SET DATABASE
[DEFAULT LANGUAGE CYPHER {5\|25}]
[PROPERTIES "{" key: value[, ...] "}"]
-----
-
|===
+[NOTE]
+====
+`[DEFAULT LANGUAGE CYPHER {5|25}]` is available from Neo4j 2025.06 onwards.
+====
+
=== Delete an alias
[options="header", width="100%", cols="1m,5a"]
diff --git a/modules/ROOT/partials/cypher-versions.adoc b/modules/ROOT/partials/cypher-versions.adoc
index e144c9809..5e7ce5502 100644
--- a/modules/ROOT/partials/cypher-versions.adoc
+++ b/modules/ROOT/partials/cypher-versions.adoc
@@ -1,9 +1,12 @@
[role=label--new-2025.06]
== Cypher® versions
-Starting from Neo4j 2025.06, Cypher language introduces a new version Cypher 25.
-Cypher 5 will continue to be the default version for all newly-created databases, however, new features will be added only to Cypher 25.
+In Neo4j 2025.06, the Cypher language has been decoupled from the Neo4j server versioning and now has its own versioning system.
+You can choose between Cypher 5 and Cypher 25.
+Cypher 5 is the version that has been in use in Neo4j up to and including version 2025.05.
+It will remain the default version for all newly created databases but will not receive new features.
+All new features and improvements will be introduced in Cypher 25.
For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
-You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, per database, or by setting it on a per-query basis.
+You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, for a database, or by setting it on a per-query basis.
For details, see the xref:configuration/cypher-version-configuration.adoc[].
From cf3a24f2b2d94699df8dfd9eb932903588950167 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 23 Jun 2025 21:56:19 +0100
Subject: [PATCH 25/65] apply suggestions from review
---
.../dbms-administration.adoc | 626 ++++++++++--------
1 file changed, 358 insertions(+), 268 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 5be186d0d..db2c3e430 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -9,7 +9,7 @@ CREATE ROLE roleNameModifier IF NOT EXISTS;
CREATE ROLE roleDropper IF NOT EXISTS;
CREATE ROLE roleAssigner IF NOT EXISTS;
CREATE ROLE roleRemover IF NOT EXISTS;
-CREATE ROLE roleShower IF NOT EXISTS;
+CREATE ROLE roleViewer IF NOT EXISTS;
CREATE ROLE roleManager IF NOT EXISTS;
CREATE ROLE userAdder IF NOT EXISTS;
CREATE ROLE userNameModifier IF NOT EXISTS;
@@ -17,7 +17,7 @@ CREATE ROLE userModifier IF NOT EXISTS;
CREATE ROLE passwordModifier IF NOT EXISTS;
CREATE ROLE statusModifier IF NOT EXISTS;
CREATE ROLE userDropper IF NOT EXISTS;
-CREATE ROLE userShower IF NOT EXISTS;
+CREATE ROLE userViewer IF NOT EXISTS;
CREATE ROLE userManager IF NOT EXISTS;
CREATE ROLE userImpersonator IF NOT EXISTS;
CREATE ROLE databaseAdder IF NOT EXISTS;
@@ -33,9 +33,9 @@ CREATE ROLE databaseManager IF NOT EXISTS;
CREATE ROLE aliasAdder IF NOT EXISTS;
CREATE ROLE aliasDropper IF NOT EXISTS;
CREATE ROLE aliasModifier IF NOT EXISTS;
-CREATE ROLE aliasLister IF NOT EXISTS;
+CREATE ROLE aliasViewer IF NOT EXISTS;
CREATE ROLE aliasManager IF NOT EXISTS;
-CREATE ROLE privilegeShower IF NOT EXISTS;
+CREATE ROLE privilegeViewer IF NOT EXISTS;
CREATE ROLE privilegeAssigner IF NOT EXISTS;
CREATE ROLE privilegeRemover IF NOT EXISTS;
CREATE ROLE privilegeManager IF NOT EXISTS;
@@ -59,6 +59,8 @@ CREATE ROLE globbing6 IF NOT EXISTS;
CREATE ROLE dbmsManager IF NOT EXISTS;
CREATE ROLE configurationViewer IF NOT EXISTS;
CREATE ROLE deniedConfigurationViewer IF NOT EXISTS;
+CREATE ROLE serverManager IF NOT EXISTS;
+CREATE ROLE serverViewer IF NOT EXISTS;
----
////
@@ -73,6 +75,11 @@ image::privileges_grant_and_deny_syntax_dbms_privileges.svg[width="800", title="
image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarchy"]
+[NOTE]
+====
+You can only grant privileges to existing roles.
+====
+
== The `admin` role privileges
The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] role is a built-in superuser role that has all privileges on the DBMS and can perform all administrative tasks.
@@ -100,7 +107,7 @@ You can create a custom role to manage DBMS privileges by granting the privilege
Alternatively, you can copy the `admin` role and revoke or deny the unwanted privileges.
The following exaples show how to create a custom role with a subset of the privileges that the `admin` role using both methods.
-=== Create a custom administrator role by creating a new role from scratch
+=== Create a custom administrator role from scratch
Create an administrator role that can only manage users and roles by creating a new role and granting the `USER MANAGEMENT` and `ROLE MANAGEMENT` privileges.
@@ -108,19 +115,19 @@ Create an administrator role that can only manage users and roles by creating a
+
[source, cypher, role=noplay]
----
-CREATE ROLE usermanager
+CREATE ROLE usermanager;
----
. Grant the privilege to manage users:
+
[source, cypher, role=noplay]
----
-GRANT USER MANAGEMENT ON DBMS TO usermanager
+GRANT USER MANAGEMENT ON DBMS TO usermanager;
----
. Grant the privilege to manage roles:
+
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO usermanager
+GRANT ROLE MANAGEMENT ON DBMS TO usermanager;
----
+
As a result, the `usermanager` role has privileges that only allow user and role management.
@@ -128,7 +135,7 @@ As a result, the `usermanager` role has privileges that only allow user and role
+
[source, cypher, role=noplay]
----
-SHOW ROLE usermanager PRIVILEGES AS COMMANDS
+SHOW ROLE usermanager PRIVILEGES AS COMMANDS;
----
+
.Result
@@ -147,35 +154,35 @@ For example, the role is missing privileges for managing, creating, and dropping
To create a more powerful administrator, you can grant a different set of privileges.
====
-=== Create a custom administrator role by copying the `admin` role
+=== Create a custom administrator role from scratch with limited capabilities
-You can also create a custom administrator role that can perform almost all DBMS capabilities, excluding database management.
-This is done by copying the `admin` role and denying the privileges you do not want.
-However, the role still has some limited database capabilities, such as managing transactions:
+You can also create a custom administrator role with limited capabilities.
+This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting only the privileges you want to include.
+For example, you can create a custom administrator role `customAdministrator` that has all DBMS privileges except for creating, dropping, and modifying databases, but still has the privilege for managing transactions.
. Create a new role:
+
[source, cypher, role=noplay]
----
-CREATE ROLE customAdministrator
+CREATE ROLE customAdministrator;
----
. Grant the privilege for all DBMS capabilities:
+
[source, cypher, role=noplay]
----
-GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator
+GRANT ALL DBMS PRIVILEGES ON DBMS TO customAdministrator;
----
. Explicitly deny the privilege to manage databases:
+
[source, cypher, role=noplay]
----
-DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator
+DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator;
----
. Grant the transaction management privilege:
+
[source, cypher, role=noplay]
----
-GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator
+GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator;
----
+
As a result, the `customAdministrator` role has privileges that include all DBMS privileges except creating, dropping, and modifying databases, as well as managing transactions.
@@ -183,7 +190,7 @@ As a result, the `customAdministrator` role has privileges that include all DBMS
+
[source, cypher, role=noplay]
----
-SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
+SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS;
----
+
.Result
@@ -196,21 +203,30 @@ SHOW ROLE customAdministrator PRIVILEGES AS COMMANDS
a|Rows: 3
|===
-===
+=== Create a custom administrator role by copying the `admin` role
-CREATE ROLE newRole AS COPY OF admin and then revoke the ability to read/write/load data?
+You can also create a custom administrator role by copying the `admin` role and then revoking or denying the privileges you do not want.
+For example, you can create a new role called `newRole` that has all the privileges of the `admin` role, and then revoke the ability to read/write/load data, manage constraints, indexes, name, and remove ability to access all databases, except the `system` database.
+. Create a new role by copying the `admin` role:
++
[source, cypher, role=noplay]
----
CREATE ROLE newRole AS COPY OF admin;
+----
+
+. Revoke the ability to read/write/load data:
++
+[source, cypher, role=noplay]
+----
REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM newRole;
REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM newRole;
REVOKE GRANT WRITE ON GRAPH * FROM newRole;
REVOKE GRANT LOAD ON ALL DATA FROM newRole;
----
-potentially also remove the index/constraint/name management
-
+. Revoke the ability to manage index/constraint/name:
++
[source, cypher, role=noplay]
----
REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM newRole;
@@ -220,22 +236,46 @@ REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM newRole;
REVOKE GRANT SHOW INDEX ON DATABASE * FROM newRole;
----
-If you want to be fancy we could also change what they have access on to system only:
-
+. Revoke the ability to access all databases:
++
[source, cypher, role=noplay]
----
REVOKE GRANT ACCESS ON DATABASE * FROM newRole;
+----
+. Grant the ability to access the `system` database:
++
+[source, cypher, role=noplay]
+----
GRANT ACCESS ON DATABASE system TO newRole;
----
+. To list all privileges for the role `newRole` as commands, use the following query:
++
+[source, cypher, role=noplay]
+----
+SHOW ROLE newRole PRIVILEGES AS COMMANDS;
+----
++
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+| "GRANT ACCESS ON DATABASE `system` TO `newRole`"
+| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `newRole`"
+| "GRANT START ON DATABASE * TO `newRole`"
+| "GRANT STOP ON DATABASE * TO `newRole`"
+| "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `newRole`"
+a|Rows: 5
+|===
+
[[access-control-dbms-administration-role-management]]
== The DBMS `ROLE MANAGEMENT` privileges
-The DBMS privileges for role management can be granted, denied, and revoked like other privileges.
+The DBMS privileges for role management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.Role management privileges command syntax
@@ -289,12 +329,12 @@ GRANT [IMMUTABLE] ROLE MANAGEMENT
=== Grant privilege to create roles
-You can grant the privilege to add roles using the `CREATE ROLE` command.
+You can grant the privilege to add roles using the `CREATE ROLE` command. +
For example:
[source, cypher, role=noplay]
----
-GRANT CREATE ROLE ON DBMS TO roleAdder
+GRANT CREATE ROLE ON DBMS TO roleAdder;
----
As a result, the `roleAdder` role has privileges that only allow adding roles.
@@ -302,7 +342,7 @@ To list all privileges for the role `roleAdder` as commands, use the following q
[source, cypher, role=noplay]
----
-SHOW ROLE roleAdder PRIVILEGES AS COMMANDS
+SHOW ROLE roleAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -315,12 +355,12 @@ a|Rows: 1
=== Grant privilege to rename roles
-You can grant the privilege to rename roles using the `RENAME ROLE` privilege.
+You can grant the privilege to rename roles using the `RENAME ROLE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT RENAME ROLE ON DBMS TO roleNameModifier
+GRANT RENAME ROLE ON DBMS TO roleNameModifier;
----
As a result, the `roleNameModifier` role has privileges that only allow renaming roles.
@@ -328,7 +368,7 @@ To list all privileges for the role `roleNameModifier`, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS
+SHOW ROLE roleNameModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -341,12 +381,12 @@ a|Rows: 1
=== Grant privilege to delete roles
-You can grant the privilege to delete roles using the `DROP ROLE` privilege.
+You can grant the privilege to delete roles using the `DROP ROLE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT DROP ROLE ON DBMS TO roleDropper
+GRANT DROP ROLE ON DBMS TO roleDropper;
----
As a result, the `roleDropper` role has privileges that only allow deleting roles.
@@ -354,7 +394,7 @@ To list all privileges for the role `roleDropper`, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleDropper PRIVILEGES AS COMMANDS
+SHOW ROLE roleDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -367,12 +407,12 @@ a|Rows: 1
=== Grant privilege to assign roles
-You can grant the privilege to assign roles to users using the `ASSIGN ROLE` privilege.
+You can grant the privilege to assign roles to users using the `ASSIGN ROLE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ASSIGN ROLE ON DBMS TO roleAssigner
+GRANT ASSIGN ROLE ON DBMS TO roleAssigner;
----
As a result, the `roleAssigner` role has privileges that only allow assigning/granting roles.
@@ -380,7 +420,7 @@ To list all privileges for the role `roleAssigner` as commands, use the followin
[source, cypher, role=noplay]
----
-SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS
+SHOW ROLE roleAssigner PRIVILEGES AS COMMANDS;
----
.Result
@@ -393,12 +433,12 @@ a|Rows: 1
=== Grant privilege to remove roles
-You can grant the privilege to remove roles from users using the `REMOVE ROLE` privilege.
+You can grant the privilege to remove roles from users using the `REMOVE ROLE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT REMOVE ROLE ON DBMS TO roleRemover
+GRANT REMOVE ROLE ON DBMS TO roleRemover;
----
As a result, the `roleRemover` role has privileges that only allow removing/revoking roles.
@@ -406,7 +446,7 @@ To list all privileges for the role `roleRemover` as commands, use the following
[source, cypher, role=noplay]
----
-SHOW ROLE roleRemover PRIVILEGES AS COMMANDS
+SHOW ROLE roleRemover PRIVILEGES AS COMMANDS;
----
.Result
@@ -431,33 +471,33 @@ The following query shows an example of how to grant the `SHOW ROLE` privilege:
[source, cypher, role=noplay]
----
-GRANT SHOW ROLE ON DBMS TO roleShower
+GRANT SHOW ROLE ON DBMS TO roleViewer;
----
-As a result, the `roleShower` role has privileges that only allow showing roles.
-To list all privileges for the role `roleShower` as commands, use the following query:
+As a result, the `roleViewer` role has privileges that only allow showing roles.
+To list all privileges for the role `roleViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE roleShower PRIVILEGES AS COMMANDS
+SHOW ROLE roleViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW ROLE ON DBMS TO `roleShower`"
+|"GRANT SHOW ROLE ON DBMS TO `roleViewer`"
a|Rows: 1
|===
=== Grant privilege to manage roles
-You can grant the privilege to create, rename, delete, assign, remove, and list roles using the `ROLE MANAGEMENT` privilege.
+You can grant the privilege to create, rename, delete, assign, remove, and list roles using the `ROLE MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO roleManager
+GRANT ROLE MANAGEMENT ON DBMS TO roleManager;
----
As a result, the `roleManager` role has all privileges to manage roles.
@@ -465,7 +505,7 @@ To list all privileges for the role `roleManager` as commands, use the following
[source, cypher, role=noplay]
----
-SHOW ROLE roleManager PRIVILEGES AS COMMANDS
+SHOW ROLE roleManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -480,11 +520,11 @@ a|Rows: 1
[[access-control-dbms-administration-user-management]]
== The DBMS `USER MANAGEMENT` privileges
-The DBMS privileges for user management can be granted, denied, and revoked like other privileges.
+The DBMS privileges for user management can be granted, denied, or revoked like other privileges.
[NOTE]
====
-For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
.User management privileges command syntax
@@ -556,7 +596,7 @@ GRANT [IMMUTABLE] USER MANAGEMENT
=== Grant privilege to create users
-You can grant the privilege to add users using the `CREATE USER` privilege.
+You can grant the privilege to add users using the `CREATE USER` privilege. +
For example:
[source, cypher, role=noplay]
@@ -569,7 +609,7 @@ To list all privileges for the role `userAdder` as commands, use the following q
[source, cypher, role=noplay]
----
-SHOW ROLE userAdder PRIVILEGES AS COMMANDS
+SHOW ROLE userAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -582,7 +622,7 @@ a|Rows: 1
=== Grant privilege to rename users
-You can grant the privilege to rename users using the `RENAME USER` privilege.
+You can grant the privilege to rename users using the `RENAME USER` privilege. +
For example:
[source, cypher, role=noplay]
@@ -595,7 +635,7 @@ To list all privileges for the role `userNameModifier` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS
+SHOW ROLE userNameModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -608,7 +648,7 @@ a|Rows: 1
=== Grant privilege to modify users
-You can grant the privilege to modify users using the `ALTER USER` privilege.
+You can grant the privilege to modify users using the `ALTER USER` privilege. +
For example:
[source, cypher, role=noplay]
@@ -621,7 +661,7 @@ To list all privileges for the role `userModifier` as commands, use the followin
[source, cypher, role=noplay]
----
-SHOW ROLE userModifier PRIVILEGES AS COMMANDS
+SHOW ROLE userModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -633,7 +673,7 @@ a|Rows: 1
|===
-The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts.
+The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts. +
For example:
[source, cypher, role=noplay]
@@ -641,9 +681,14 @@ For example:
ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED
----
+[NOTE]
+====
+Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
+====
+
=== Grant privilege to modify users' passwords
-You can grant the privilege to modify users' passwords and whether those passwords must be changed upon first login using the `SET PASSWORDS` privilege.
+You can grant the privilege to modify users' passwords and whether those passwords must be changed upon first login using the `SET PASSWORDS` privilege. +
For example:
[source, cypher, role=noplay]
@@ -656,7 +701,7 @@ To list all privileges for the role `passwordModifier` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
+SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -667,7 +712,7 @@ SHOW ROLE passwordModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-The `SET PASSWORDS` privilege allows you to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
+The `SET PASSWORDS` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET PASSWORD` and `SET PASSWORD CHANGE [NOT] REQUIRED` parts.
[source, cypher, role=noplay]
----
@@ -676,7 +721,7 @@ ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
=== Grant privilege to modify users' auth providers
-You can grant the privilege to modify users' auth providers using the `SET AUTH` privilege.
+You can grant the privilege to modify users' auth providers using the `SET AUTH` privilege. +
For example:
[source, cypher, role=noplay]
@@ -686,7 +731,7 @@ GRANT SET AUTH ON DBMS TO userModifier
As a result, the `userModifier` role has privileges that only allow modifying users' auth providers.
The `SET AUTH` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET
-AUTH` and `REMOVE AUTH` parts.
+AUTH` and `REMOVE AUTH` parts. +
For example:
[source, cypher, role=noplay]
@@ -696,7 +741,7 @@ ALTER USER jake REMOVE AUTH 'native' SET AUTH 'oidc-okta' { SET id 'jakesUniqueO
=== Grant privilege to modify the account status of users
-You can grant the privilege to modify the account status of users using the `SET USER STATUS` privilege.
+You can grant the privilege to modify the account status of users using the `SET USER STATUS` privilege. +
For example:
[source, cypher, role=noplay]
@@ -709,7 +754,7 @@ To list all privileges for the role `statusModifier` as commands, use the follow
[source, cypher, role=noplay]
----
-SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
+SHOW ROLE statusModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -729,7 +774,7 @@ ALTER USER jake SET STATUS ACTIVE
=== Grant privilege to modify the home database of users
-You can grant the privilege to modify the home database of users using the `SET USER HOME DATABASE` privilege.
+You can grant the privilege to modify the home database of users using the `SET USER HOME DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -742,7 +787,7 @@ To list all privileges for the role `statusModifier` as commands, use the follow
[source, cypher, role=noplay]
----
-SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
+SHOW ROLE statusModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -754,7 +799,7 @@ SHOW ROLE statusModifier PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-The `SET USER HOME DATABASE` privilege allows you to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
+The `SET USER HOME DATABASE` privilege allows the user to run the `ALTER USER` administration command with only the `SET HOME DATABASE` or `REMOVE HOME DATABASE` part:
[source, cypher, role=noplay]
----
@@ -766,14 +811,9 @@ ALTER USER jake SET HOME DATABASE otherDb
ALTER USER jake REMOVE HOME DATABASE
----
-[NOTE]
-====
-Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
-====
-
=== Grant privilege to delete users
-You can grant the privilege to delete users using the `DROP USER` privilege.
+You can grant the privilege to delete users using the `DROP USER` privilege. +
For example:
[source, cypher, role=noplay]
@@ -786,7 +826,7 @@ To list all privileges for the role `userDropper` as commands, use the following
[source, cypher, role=noplay]
----
-SHOW ROLE userDropper PRIVILEGES AS COMMANDS
+SHOW ROLE userDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -800,33 +840,33 @@ a|Rows: 1
=== Grant privilege to show users
-You can grant the privilege to show users using the `SHOW USER` privilege.
+You can grant the privilege to show users using the `SHOW USER` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT SHOW USER ON DBMS TO userShower
+GRANT SHOW USER ON DBMS TO userViewer
----
-As a result, the `userShower` role has privileges that only allow showing users.
-To list all privileges for the role `userShower` as commands, use the following query:
+As a result, the `userViewer` role has privileges that only allow showing users.
+To list all privileges for the role `userViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE userShower PRIVILEGES AS COMMANDS
+SHOW ROLE userViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW USER ON DBMS TO `userShower`"
+|"GRANT SHOW USER ON DBMS TO `userViewer`"
a|Rows: 1
|===
=== Grant privilege to manage users
-You can grant the privilege to create, rename, modify, delete, and list users using the `USER MANAGEMENT` privilege.
+You can grant the privilege to create, rename, modify, delete, and list users using the `USER MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
@@ -839,7 +879,7 @@ To list all privileges for the role `userManager` as commands, use the following
[source, cypher, role=noplay]
----
-SHOW ROLE userManager PRIVILEGES AS COMMANDS
+SHOW ROLE userManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -853,10 +893,15 @@ a|Rows: 1
[[access-control-dbms-administration-impersonation]]
== The DBMS `IMPERSONATE` privileges
-The DBMS privileges for impersonation can be granted, denied, and revoked like other privileges.
+The DBMS privileges for impersonation can be granted, denied, or revoked like other privileges.
Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands).
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
+
You can use the `IMPERSONATE` privilege to allow a user to impersonate another user.
.Impersonation privileges command syntax
@@ -880,40 +925,34 @@ GRANT [IMMUTABLE] IMPERSONATE (user[, ...])
=== Grant privilege to impersonate all users
-You can grant the privilege to impersonate all users using the `IMPERSONATE (*)` privilege.
+You can grant the privilege to impersonate all users using the `IMPERSONATE (*)` privilege. +
For example:
-[NOTE]
-====
-`userImpersonator` must be an existing role in order to grant the privilege.
-====
-
.Query
[source, cypher, role=noplay]
----
-GRANT IMPERSONATE (*) ON DBMS TO userImpersonator
+GRANT IMPERSONATE (*) ON DBMS TO allUserImpersonator
----
-As a result, the `userImpersonator` role has privileges that allow impersonating all users.
-To list all privileges for the role `userImpersonator` as commands, use the following query:
+As a result, the `allUserImpersonator` role has privileges that allow impersonating all users.
+To list all privileges for the role `allUserImpersonator` as commands, use the following query:
.Query
[source, cypher, role=noplay]
----
-SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS
+SHOW ROLE allUserImpersonator PRIVILEGES AS COMMANDS;
----
-
.Result
[options="header,footer", width="100%", cols="m"]
|===
| command
-| "GRANT IMPERSONATE (*) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (*) ON DBMS TO `allUserImpersonator`"
a|Rows: 1
|===
=== Grant privilege to impersonate specific users
-You can grant (or revoke) the privilege to impersonate specific users or a subset of users using the following query:
+You can also grant the privilege to impersonate specific users or a subset of users. +
For example:
.Query
@@ -931,12 +970,17 @@ Then, you deny the privilege to impersonate `alice`:
DENY IMPERSONATE (alice) ON DBMS TO userImpersonator
----
-As a result, the `userImpersonator` user would be able to impersonate all users, except `alice`.
+As a result, the `userImpersonator` user would be able to impersonate only `bob`.
[[access-control-dbms-administration-database-management]]
== The DBMS `DATABASE MANAGEMENT` privileges
-The DBMS privileges for database management can be granted, denied and revoked like other privileges.
+The DBMS privileges for database management can be granted, denied, or revoked like other privileges.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Database management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1007,7 +1051,7 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT
=== Grant privilege to create standard databases
-You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege.
+You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1020,7 +1064,7 @@ To list all privileges for the role `databaseAdder` as commands, use the followi
[source, cypher, role=noplay]
----
-SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS
+SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -1033,7 +1077,7 @@ a|Rows: 1
=== Grant privilege to create composite databases
-You can grant the privilege to create composite databases using the `CREATE COMPOSITE DATABASE` privilege.
+You can grant the privilege to create composite databases using the `CREATE COMPOSITE DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1046,7 +1090,7 @@ To list all privileges for the role `compositeDatabaseAdder` as commands, use th
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -1059,7 +1103,7 @@ a|Rows: 1
=== Grant privilege to delete standard databases
-You can grant the privilege to delete standard databases using the `DROP DATABASE` privilege.
+You can grant the privilege to delete standard databases using the `DROP DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1072,7 +1116,7 @@ To list all privileges for the role `databaseDropper` as commands, use the follo
[source, cypher, role=noplay]
----
-SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS
+SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -1085,7 +1129,7 @@ a|Rows: 1
=== Grant privilege to delete composite databases
-You can grant the privilege to delete composite databases using the `DROP COMPOSITE DATABASE` privilege.
+You can grant the privilege to delete composite databases using the `DROP COMPOSITE DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1098,7 +1142,7 @@ To list all privileges for the role `compositeDatabaseDropper` as commands, use
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -1111,12 +1155,12 @@ a|Rows: 1
=== Grant privilege to modify standard databases
-You can grant the privilege to modify standard databases using the `ALTER DATABASE` privilege.
+You can grant the privilege to modify standard databases using the `ALTER DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ALTER DATABASE ON DBMS TO databaseModifier
+GRANT ALTER DATABASE ON DBMS TO databaseModifier;
----
As a result, the `databaseModifier` role has privileges that only allow modifying standard databases.
@@ -1124,7 +1168,7 @@ To list all privileges for the role `databaseModifier` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS
+SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1135,9 +1179,9 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-=== Grant privilege to modify access to composite databases
+=== Grant privilege to modify access to standard databases
-You can grant the privilege to modify access to composite databases using the `ALTER COMPOSITE DATABASE` privilege.
+You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1150,7 +1194,7 @@ To list all privileges for the role `accessModifier` as commands, use the follow
[source, cypher, role=noplay]
----
-SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
+SHOW ROLE accessModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1161,9 +1205,10 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
+[rol=label--new-2025.06]
=== Grant privilege to modify the default language of standard databases
-You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege.
+You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. +
For example:
[source, cypher, role=noplay]
@@ -1176,7 +1221,7 @@ To list all privileges for the role `languageModifier` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE languageModifier PRIVILEGES AS COMMANDS
+SHOW ROLE languageModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1187,14 +1232,15 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-=== Grant privilege to modify the default language of composite databases
+[rol=label--new-2025.06]
+=== Grant privilege to modify a composite databases
-You can grant the privilege to modify the default language of composite databases using the `SET COMPOSITE DATABASE DEFAULT LANGUAGE` privilege.
+You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier
+GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier;
----
As a result, the `compositeDatabaseModifier` role has privileges that only allow modifying composite databases.
@@ -1202,7 +1248,7 @@ To list all privileges for the role `compositeDatabaseModifier` as commands, use
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1215,12 +1261,12 @@ a|Rows: 1
=== Grant privilege to manage composite databases
-You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege.
+You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager
+GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager;
----
As a result, the `compositeDatabaseManager` role has all privileges to manage composite databases.
@@ -1228,7 +1274,7 @@ To list all privileges for the role `compositeDatabaseManager` as commands, use
[source, cypher, role=noplay]
----
-SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS
+SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1241,12 +1287,12 @@ a|Rows: 1
=== Grant privilege to manage standard and composite databases
-You can grant the privilege to create, delete, and modify standard and composite databases using the `DATABASE MANAGEMENT` privilege.
+You can grant the privilege to create, delete, and modify standard and composite databases using the `DATABASE MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager
+GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager;
----
As a result, the `databaseManager` role has all privileges to manage standard and composite databases.
@@ -1254,7 +1300,7 @@ To list all privileges for the role `databaseManager` as commands, use the follo
[source, cypher, role=noplay]
----
-SHOW ROLE databaseManager PRIVILEGES AS COMMANDS
+SHOW ROLE databaseManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1268,7 +1314,13 @@ a|Rows: 1
[[access-control-dbms-administration-alias-management]]
== The DBMS `ALIAS MANAGEMENT` privileges
-The DBMS privileges for alias management can be granted, denied and revoked like other privileges and can be applied to both local and remote aliases.
+The DBMS privileges for alias management can be granted, denied, or revoked like other privileges.
+This applies to both local and remote aliases.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Alias management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1309,12 +1361,12 @@ TO role[, ...]
=== Grant privilege to create aliases
-You can grant the privilege to create aliases using the `CREATE ALIAS` privilege.
+You can grant the privilege to create aliases using the `CREATE ALIAS` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT CREATE ALIAS ON DBMS TO aliasAdder
+GRANT CREATE ALIAS ON DBMS TO aliasAdder;
----
As a result, the `aliasAdder` role has privileges that only allow creating aliases.
@@ -1322,7 +1374,7 @@ To list all privileges for the role `aliasAdder` as commands, use the following
[source, cypher, role=noplay]
----
-SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS
+SHOW ROLE aliasAdder PRIVILEGES AS COMMANDS;
----
.Result
@@ -1335,12 +1387,12 @@ a|Rows: 1
=== Grant privilege to delete aliases
-You can grant the privilege to delete aliases using the `DROP ALIAS` privilege.
+You can grant the privilege to delete aliases using the `DROP ALIAS` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT DROP ALIAS ON DBMS TO aliasDropper
+GRANT DROP ALIAS ON DBMS TO aliasDropper;
----
As a result, the `aliasDropper` role has privileges that only allow deleting aliases.
@@ -1348,7 +1400,7 @@ See all privileges for the role `aliasDropper` as commands, use the following qu
[source, cypher, role=noplay]
----
-SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS
+SHOW ROLE aliasDropper PRIVILEGES AS COMMANDS;
----
.Result
@@ -1361,12 +1413,12 @@ a|Rows: 1
=== Grant privilege to modify aliases
-You can grant the privilege to modify aliases using the `ALTER ALIAS` privilege.
+You can grant the privilege to modify aliases using the `ALTER ALIAS` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ALTER ALIAS ON DBMS TO aliasModifier
+GRANT ALTER ALIAS ON DBMS TO aliasModifier;
----
As a result, the `aliasModifier` role has privileges that only allow modifying aliases.
@@ -1374,7 +1426,7 @@ To list all privileges for the role `aliasModifier` as commands, use the followi
[source, cypher, role=noplay]
----
-SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS
+SHOW ROLE aliasModifier PRIVILEGES AS COMMANDS;
----
.Result
@@ -1388,38 +1440,38 @@ a|Rows: 1
=== Grant privilege to list aliases
-You can grant the privilege to list aliases using the `SHOW ALIAS` privilege.
+You can grant the privilege to list aliases using the `SHOW ALIAS` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT SHOW ALIAS ON DBMS TO aliasLister
+GRANT SHOW ALIAS ON DBMS TO aliasViewer;
----
-As a result, the `aliasLister` role has privileges that only allow modifying aliases.
-To list all privileges for the role `aliasLister` as commands, use the following query:
+As a result, the `aliasViewer` role has privileges that only allow modifying aliases.
+To list all privileges for the role `aliasViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE aliasLister PRIVILEGES AS COMMANDS
+SHOW ROLE aliasViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW ALIAS ON DBMS TO `aliasLister`"
+|"GRANT SHOW ALIAS ON DBMS TO `aliasViewer`"
a|Rows: 1
|===
=== Grant privilege to manage aliases
-You can grant the privilege to create, delete, modify, and list aliases using the `ALIAS MANAGEMENT` privilege.
+You can grant the privilege to create, delete, modify, and list aliases using the `ALIAS MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager
+GRANT ALIAS MANAGEMENT ON DBMS TO aliasManager;
----
As a result, the `aliasManager` role has all privileges to manage aliases.
@@ -1427,7 +1479,7 @@ To list all privileges for the role `aliasManager` as commands, use the followin
[source, cypher, role=noplay]
----
-SHOW ROLE aliasManager PRIVILEGES AS COMMANDS
+SHOW ROLE aliasManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1441,7 +1493,12 @@ a|Rows: 1
[[access-control-dbms-administration-server-management]]
== The DBMS `SERVER MANAGEMENT` privileges
-The DBMS privileges for server management can be granted, denied, and revoked like other privileges.
+The DBMS privileges for server management can be granted, denied, or revoked like other privileges.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Server management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1463,12 +1520,12 @@ GRANT [IMMUTABLE] SHOW SERVERS
=== Grant privilege to manage servers
-You can grant the privilege to show, enable, rename, alter, reallocate, deallocate, and drop servers using the `SERVER MANAGEMENT` privilege.
+You can grant the privilege to show, enable, rename, alter, reallocate, deallocate, and drop servers using the `SERVER MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT SERVER MANAGEMENT ON DBMS TO serverManager
+GRANT SERVER MANAGEMENT ON DBMS TO serverManager;
----
As a result, the `serverManager` role has all privileges to manage servers.
@@ -1476,7 +1533,7 @@ To list all privileges for the role `serverManager` as commands, use the followi
[source, cypher, role=noplay]
----
-SHOW ROLE serverManager PRIVILEGES AS COMMANDS
+SHOW ROLE serverManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1490,34 +1547,39 @@ a|Rows: 1
=== Grant privilege to show servers
-You can grant the privilege to show servers using the `SHOW SERVERS` privilege.
+You can grant the privilege to show servers using the `SHOW SERVERS` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT SHOW SERVERS ON DBMS TO serverLister
+GRANT SHOW SERVERS ON DBMS TO serverViewer;
----
-As a result, the `serverLister` role has privileges that only allow showing servers.
-To list all privileges for the role `serverLister` as commands, use the following query:
+As a result, the `serverViewer` role has privileges that only allow showing servers.
+To list all privileges for the role `serverViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE serverLister PRIVILEGES AS COMMANDS
+SHOW ROLE serverViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW SERVERS ON DBMS TO `serverLister`"
+|"GRANT SHOW SERVERS ON DBMS TO `serverViewer`"
a|Rows: 1
|===
[[access-control-dbms-administration-privilege-management]]
== The DBMS `PRIVILEGE MANAGEMENT` privileges
-The DBMS privileges for privilege management can be granted, denied and revoked like other privileges.
+The DBMS privileges for privilege management can be granted, denied, or revoked like other privileges.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Privilege management privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1553,27 +1615,27 @@ GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT
You can grant the privilege to list privileges using the `SHOW PRIVILEGE` privilege. +
A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands.
-To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required.
+To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required. +
For example:
[source, cypher, role=noplay]
----
-GRANT SHOW PRIVILEGE ON DBMS TO privilegeShower
+GRANT SHOW PRIVILEGE ON DBMS TO privilegeViewer;
----
-As a result, the `privilegeShower` role has privileges that only allow showing privileges.
-To list all privileges for the role `privilegeShower` as commands, use the following query:
+As a result, the `privilegeViewer` role has privileges that only allow showing privileges.
+To list all privileges for the role `privilegeViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeShower PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeViewer PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeShower`"
+|"GRANT SHOW PRIVILEGE ON DBMS TO `privilegeViewer`"
a|Rows: 1
|===
@@ -1588,12 +1650,12 @@ Other users' privileges cannot be listed when using a non-native auth provider.
=== Grant privilege to assign privileges
You can grant the privilege to assign privileges using the `ASSIGN PRIVILEGE` privilege. +
-A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands.
+A user with this privilege is allowed to execute `GRANT` and `DENY` administration commands. +
For example:
[source, cypher, role=noplay]
----
-GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner
+GRANT ASSIGN PRIVILEGE ON DBMS TO privilegeAssigner;
----
As a result, the `privilegeAssigner` role has privileges that only allow assigning privileges.
@@ -1601,7 +1663,7 @@ To list all privileges for the role `privilegeAssigner` as commands, use the fol
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeAssigner PRIVILEGES AS COMMANDS;
----
.Result
@@ -1615,12 +1677,12 @@ a|Rows: 1
=== Grant privilege to remove privileges
You can grant the privilege to remove privileges from roles using the `REMOVE PRIVILEGE` privilege. +
-A user with this privilege is allowed to execute `REVOKE` administration commands.
+A user with this privilege is allowed to execute `REVOKE` administration commands. +
For example:
[source, cypher, role=noplay]
----
-GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover
+GRANT REMOVE PRIVILEGE ON DBMS TO privilegeRemover;
----
As a result, the `privilegeRemover` role has privileges that only allow removing privileges.
@@ -1628,7 +1690,7 @@ To list all privileges for the role `privilegeRemover` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeRemover PRIVILEGES AS COMMANDS;
----
.Result
@@ -1641,12 +1703,12 @@ a|Rows: 1
=== Grant privilege to manage privileges
-You can grant the privilege to list, assign, and remove privileges using the `PRIVILEGE MANAGEMENT` privilege.
+You can grant the privilege to list, assign, and remove privileges using the `PRIVILEGE MANAGEMENT` privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager
+GRANT PRIVILEGE MANAGEMENT ON DBMS TO privilegeManager;
----
As a result, the `privilegeManager` role has all privileges to manage privileges.
@@ -1654,7 +1716,7 @@ To list all privileges for the role `privilegeManager` as commands, use the foll
[source, cypher, role=noplay]
----
-SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS
+SHOW ROLE privilegeManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -1669,7 +1731,12 @@ a|Rows: 1
[[access-control-dbms-administration-execute]]
== The DBMS `EXECUTE` privileges
-The DBMS privileges for procedure and user-defined function execution can be granted, denied and revoked like other privileges.
+The DBMS privileges for procedure and user-defined function execution can be granted, denied, or revoked like other privileges.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Execute privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -1709,26 +1776,26 @@ GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, .
|===
[[access-control-execute-procedure]]
-=== The `EXECUTE PROCEDURE` privilege
+=== Grant privilege to execute procedures
You can grant the privilege to execute procedures using the `EXECUTE PROCEDURE` privilege. +
A role with this privilege is allowed to execute the procedures matched by the <>.
-For example:
+
+For example, the following query allow the execution of procedures starting with `db.schema`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor
+GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor;
----
Users with the role `procedureExecutor` can run any procedure in the `db.schema` namespace.
The procedure is run using the user's own privileges.
-As a result, the `procedureExecutor` role has privileges that only allow executing procedures in the `db.schema` namespace.
To list all privileges for the role `procedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1739,27 +1806,29 @@ SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-=== Grant privilege to execute specific procedures
+=== Grant privilege to execute all but some procedures
-You can grant the privilege to execute specific procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
+You can grant the privilege to execute all except a few procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
For example, the following queries allow the execution of all procedures, except those starting with `dbms.cluster`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor
+GRANT EXECUTE PROCEDURE * ON DBMS TO deniedProcedureExecutor;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor
+DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor;
----
-As a result, the `deniedProcedureExecutor` role has privileges that only allow executing all procedures except those starting with `dbms.cluster`.
+Users with the role `deniedProcedureExecutor` can run any procedure except those starting with `dbms.cluster`.
+The procedure is run using the user's own privileges.
+
To list all privileges for the role `deniedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE deniedProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1776,7 +1845,7 @@ The `dbms.cluster.checkConnectivity`, `dbms.cluster.cordonServer`, `dbms.cluster
[[access-control-execute-boosted-procedure]]
-=== The `EXECUTE BOOSTED PROCEDURE` privilege
+=== Grant privilege to execute procedures with elevated privileges
You can grant the privilege to execute procedures with elevated privileges using the `EXECUTE BOOSTED PROCEDURE` privilege. +
A user with this privilege will not be restricted to their other privileges when executing the procedures matched by the <>.
@@ -1784,8 +1853,11 @@ The `EXECUTE BOOSTED PROCEDURE` privilege only affects the elevation, and not th
Therefore, it is needed to grant `EXECUTE PROCEDURE` privilege for the procedures as well.
Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a procedure with elevated privileges.
-=== Grant privilege to execute boosted procedures
-For example:
+==== Grant privilege to execute some procedures with elevated privileges
+
+You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
+
+For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges:
[source, cypher, role=noplay]
----
@@ -1801,7 +1873,7 @@ To list all privileges for the role `boostedProcedureExecutor` as commands, use
[source, cypher, role=noplay]
----
-SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1814,30 +1886,27 @@ SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS
a|Rows: 3
|===
-=== Grant `EXECUTE PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
-
-As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
-For example:
+[[deny-privilege-to-execute-procedures-with-elevated-privileges]]
+==== Deny privilege to execute procedures with elevated privileges
-[source, cypher, role=noplay]
-----
-GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1
-----
+As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure. +
+For example, the following query allows the execution of all procedures using the user's own privileges, but prevents the elevation of `db.labels`:
[source, cypher, role=noplay]
----
-DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1
+GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1;
+DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1;
----
As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user's own privileges.
It also prevents the `db.labels` procedure from being elevated.
-Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`.
+Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block the execution of `db.labels`.
To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1849,17 +1918,21 @@ SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-=== Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE PROCEDURE`
+[[execute-boosted-procedures-deny-execution]]
+==== Grant privilege to execute boosted procedures and deny execution of specific procedures
+You can also grant the privilege to execute boosted procedures and deny the execution of specific procedures.
+
+For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2
+GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor2;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2
+DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2;
----
As a result, the `deniedBoostedProcedureExecutor2` role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
@@ -1867,7 +1940,7 @@ To list all privileges for the role `deniedBoostedProcedureExecutor2` as command
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1879,24 +1952,30 @@ SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-=== Grant `EXECUTE BOOSTED PROCEDURE` and deny `EXECUTE BOOSTED PROCEDURE`
+[[execute-boosted-procedures-deny-elevation]]
+==== Grant privilege to execute boosted procedures and deny elevation of specific procedures
+
+You can also grant the privilege to execute boosted procedures and deny the elevation of specific procedures.
+
+For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
[source, cypher, role=noplay]
----
-GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3
+GRANT EXECUTE BOOSTED PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor3;
----
[source, cypher, role=noplay]
----
-DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3
+DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor3;
----
-As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`, however no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
+As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`.
+However, no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
To list all privileges for the role `deniedBoostedProcedureExecutor3` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS
+SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS;
----
.Result
@@ -1908,14 +1987,15 @@ SHOW ROLE deniedBoostedProcedureExecutor3 PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-.How would the privileges from examples 1 to 3 affect the output of a procedure?
-[example]
-====
-Assume there is a procedure called `myProc`.
+==== Control procedure output with privileges
+
+You can control the output of procedures based on the privileges granted or denied to a role using the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
+For example, assume there is a procedure called `myProc`.
This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege.
-Now, adapt the privileges from examples 1 to 3 to be applied to this procedure and show what is returned.
+Now, adapt the privileges from sections <> (example 1), <> (example 2), and <> (example 3) to be applied to this procedure and show what is returned.
+
With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`.
With the privileges from example 2, granted `EXECUTE BOOSTED PROCEDURE *` and denied `EXECUTE PROCEDURE myProc`, execution of the `myProc` procedure is not allowed.
@@ -1927,29 +2007,28 @@ For comparison, when granted:
* `EXECUTE PROCEDURE myProc`: the `myProc` procedure returns the result `A` and `B`.
* `EXECUTE BOOSTED PROCEDURE myProc`: execution of the `myProc` procedure is not allowed.
* `EXECUTE PROCEDURE myProc` and `EXECUTE BOOSTED PROCEDURE myProc`: the `myProc` procedure returns the result `A`, `B`, and `C`.
-====
[[access-control-admin-procedure]]
-=== The `EXECUTE ADMIN PROCEDURE` privilege
+=== Grant privilege to execute admin procedures
-You can grant the privilege to execute admin procedures (annotated with `@Admin`) using the `EXECUTE ADMIN PROCEDURE` privilege. +
+You can grant the privilege to execute admin procedures (annotated with `@Admin`) using the `EXECUTE ADMIN PROCEDURES` privilege. +
This privilege is equivalent with granting the <> and <> privileges on each of the admin procedures.
-Any newly added `admin` procedure is automatically included in this privilege.
+Any newly added `admin` procedure is automatically included in this privilege. +
For example:
[source, cypher, role=noplay]
----
-GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor
+GRANT EXECUTE ADMIN PROCEDURES ON DBMS TO adminProcedureExecutor;
----
-Users with the role `adminProcedureExecutor` can then run any `admin` procedure with elevated privileges.
+Users with the role `adminProcedureExecutor` can run any `admin` procedure with elevated privileges.
As a result, the `adminProcedureExecutor` role has privileges that allow the execution of all admin procedures.
To list all privileges for the role `adminProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE adminProcedureExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -1970,7 +2049,7 @@ Any denied `EXECUTE` privilege results in the procedure not being allowed to be
In this case, it does not matter whether `EXECUTE PROCEDURE`, `EXECUTE BOOSTED PROCEDURE` or `EXECUTE ADMIN PROCEDURES` is being denied.
[[access-control-execute-user-defined-function]]
-=== The `EXECUTE USER DEFINED FUNCTION` privilege
+=== Grant privilege to execute user-defined functions
//EXECUTE [USER [DEFINED]] FUNCTION[S]
You can grant the privilege to execute user-defined functions (UDFs) using the `EXECUTE USER DEFINED FUNCTION` privilege.
@@ -1978,16 +2057,16 @@ A role with this privilege is allowed to execute the UDFs matched by the <>.
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege only affects the elevation and not the execution of the function.
-Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the functions as well.
+Therefore, it is needed to grant `EXECUTE USER DEFINED FUNCTION` privilege for the UDFs as well.
Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION` are needed to execute a function with elevated privileges.
[IMPORTANT]
====
-The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
+The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in UDFs, as they have no concept of elevated privileges.
====
-=== Execute boosted user-defined function
+==== Execute boosted user-defined function
The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege:
[source,cypher,role=noplay]
----
-GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor
-GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor
+GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO boostedFunctionExecutor;
+GRANT EXECUTE BOOSTED USER DEFINED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor;
----
Or in short form:
[source,cypher,role=noplay]
----
-GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor
-GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor
+GRANT EXECUTE FUNCTION * ON DBMS TO boostedFunctionExecutor;
+GRANT EXECUTE BOOSTED FUNCTION apoc.any.properties ON DBMS TO boostedFunctionExecutor;
----
Users with the role `boostedFunctionExecutor` can thus run `apoc.any.properties` with full privileges and see every property on the node/relationship, not just the properties that the user has `READ` privilege on.
@@ -2105,7 +2185,7 @@ To list all privileges for the role `boostedFunctionExecutor` as commands, use t
[source,cypher,role=noplay]
----
-SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS
+SHOW ROLE boostedFunctionExecutor PRIVILEGES AS COMMANDS;
----
.Result
@@ -2122,7 +2202,12 @@ a|Rows: 2
== The DBMS `SETTING` privileges
You can grant the privilege to show configuration settings using the `SHOW SETTING` privilege.
-A role with this privilege is allowed to query the configuration settings matched by the <>.
+A role with this privilege is allowed to list the configuration settings matched by the <>.
+
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
.Setting privileges command syntax
[options="header", width="100%", cols="3a,2"]
@@ -2134,7 +2219,7 @@ A role with this privilege is allowed to query the configuration settings matche
GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...]
ON DBMS
TO role[, ...]
-| Enables the specified roles to query given configuration settings.
+| Enables the specified roles to list given configuration settings.
|===
=== Grant privilege to show all settings
@@ -2144,17 +2229,17 @@ The following query shows an example of how to grant `SHOW SETTING` privilege to
[source, cypher, role=noplay]
----
-GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer
+GRANT SHOW SETTING server.bolt.* ON DBMS TO configurationViewer;
----
-Users with the role `configurationViewer` can then query any setting in the `server.bolt` namespace.
+Users with the role `configurationViewer` can then view any setting in the `server.bolt` namespace.
-As a result, the `configurationViewer` role has privileges that only allow querying settings in the `server.bolt` namespace.
+As a result, the `configurationViewer` role has privileges that only allow listing settings in the `server.bolt` namespace.
To list all privileges for the role `configurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS
+SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS;
----
.Result
@@ -2165,27 +2250,27 @@ SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS
a|Rows: 1
|===
-=== Grant privilege to show specific settings
+=== Grant privilege to show execute all but some settings
-You can grant the privilege to show all settings using `SHOW SETTINGS *` and deny the unwanted settings. +
-For example, the following queries allow the querying of all settings, except those starting with `dbms.security`:
+You can grant the privilege to show all but a few settings using `SHOW SETTINGS *` and deny the unwanted settings. +
+For example, the following queries allow you to view all settings, except those starting with `dbms.security`:
[source, cypher, role=noplay]
----
-GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer
+GRANT SHOW SETTINGS * ON DBMS TO deniedConfigurationViewer;
----
[source, cypher, role=noplay]
----
-DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer
+DENY SHOW SETTING dbms.security* ON DBMS TO deniedConfigurationViewer;
----
-As a result, the `deniedConfigurationViewer` role has privileges that allow querying all settings except those starting with `dbms.security`.
+As a result, the `deniedConfigurationViewer` role has privileges that allow listing all settings except those starting with `dbms.security`.
To list all privileges for the role `deniedConfigurationViewer` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS
+SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS;
----
.Result
@@ -2197,7 +2282,7 @@ SHOW ROLE deniedConfigurationViewer PRIVILEGES AS COMMANDS
a|Rows: 2
|===
-As the query result shows, access to any setting starting with `dbms.security` are blocked, but the rest can still be queried.
+As the query result shows, viewing settings starting with `dbms.security` is blocked, but the rest can still be listed.
[[access-control-dbms-administration-all]]
@@ -2208,13 +2293,18 @@ The `ALL DBMS PRIVILEGES` privilege is equivalent to granting the following priv
* Create, drop, assign, remove, and show roles.
* Create, alter, drop, show, and impersonate users.
-* Create, alter, and drop databases and aliases.
-* Enable, alter, rename, reallocate, deallocate, and drop servers
+* Create, alter, drop, and show databases and aliases.
+* Enable, alter, rename, reallocate, deallocate, drop, and show servers.
* Show, assign, and remove privileges.
* Execute all procedures with elevated privileges.
* Execute all user-defined functions with elevated privileges.
* Show all configuration settings.
+[NOTE]
+====
+For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
+====
+
[source, syntax, role=noheader]
----
GRANT [IMMUTABLE] ALL [[DBMS] PRIVILEGES]
@@ -2226,14 +2316,14 @@ For example, to grant the role `dbmsManager` all DBMS abilities, use the followi
[source, cypher, role=noplay]
----
-GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager
+GRANT ALL DBMS PRIVILEGES ON DBMS TO dbmsManager;
----
To list all privileges for the role `dbmsManager` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS
+SHOW ROLE dbmsManager PRIVILEGES AS COMMANDS;
----
.Result
@@ -2278,42 +2368,42 @@ Note that the same rules apply to user-defined functions and settings.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1
+GRANT EXECUTE PROCEDURE * ON DBMS TO globbing1;
----
Users with the role `globbing1` can run all the procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2
+GRANT EXECUTE PROCEDURE mine.*.exampleProcedure ON DBMS TO globbing2;
----
Users with the role `globbing2` can run procedures `mine.public.exampleProcedure` and `mine.private.exampleProcedure`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3
+GRANT EXECUTE PROCEDURE mine.*.exampleProcedure? ON DBMS TO globbing3;
----
Users with the role `globbing3` can run procedures `mine.public.exampleProcedure1`, `mine.private.exampleProcedure1`, and `mine.private.exampleProcedure2`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4
+GRANT EXECUTE PROCEDURE *.exampleProcedure ON DBMS TO globbing4;
----
Users with the role `globbing4` can run procedures `your.exampleProcedure`, `mine.public.exampleProcedure`, and `mine.private.exampleProcedure`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5
+GRANT EXECUTE PROCEDURE mine.public.exampleProcedure* ON DBMS TO globbing5;
----
Users with the role `globbing5` can run procedures `mine.public.exampleProcedure`, `mine.public.exampleProcedure1` and `mine.public.exampleProcedure42`, but no other procedures.
[source, cypher, role=noplay]
----
-GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6
+GRANT EXECUTE PROCEDURE `mine.public.with#*§Characters`, mine.private.`with#Spec???§Characters` ON DBMS TO globbing6;
----
Users with the role `globbing6` can run procedures `mine.public.with#Special§Characters`, and `mine.private.with#Special§Characters`, but no other procedures.
From 0e0ea5ae0038e7534f4588d6aa9c8e95412cae59 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 24 Jun 2025 11:44:41 +0100
Subject: [PATCH 26/65] further improvements
---
.../dbms-administration.adoc | 47 ++++++++++---------
.../pages/backup-restore/copy-database.adoc | 2 +-
.../cypher-version-configuration.adoc | 11 ++---
.../manage-aliases-composite-databases.adoc | 1 -
.../manage-aliases-standard-databases.adoc | 2 +-
.../standard-databases/alter-databases.adoc | 35 +-------------
.../standard-databases/create-databases.adoc | 2 +-
.../database-internals/store-formats.adoc | 2 +-
8 files changed, 35 insertions(+), 67 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index db2c3e430..cc88afdf5 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1233,7 +1233,7 @@ a|Rows: 1
|===
[rol=label--new-2025.06]
-=== Grant privilege to modify a composite databases
+=== Grant privilege to modify composite databases
You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
For example:
@@ -1857,7 +1857,7 @@ Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a
You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
-For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges:
+For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
[source, cypher, role=noplay]
----
@@ -1868,7 +1868,6 @@ GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boost
Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges, seeing everything in the graph and not just the labels and types that the user has `TRAVERSE` privilege on.
Without the `EXECUTE PROCEDURE`, no procedures could be executed at all.
-As a result, the `boostedProcedureExecutor` role has privileges that allow executing the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges.
To list all privileges for the role `boostedProcedureExecutor` as commands, use the following query:
[source, cypher, role=noplay]
@@ -1886,11 +1885,12 @@ SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS;
a|Rows: 3
|===
-[[deny-privilege-to-execute-procedures-with-elevated-privileges]]
-==== Deny privilege to execute procedures with elevated privileges
+[[grant-execute-procedure-deny-elevation]]
+==== Combination of granting execution and denying privilege elevation
-As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure. +
-For example, the following query allows the execution of all procedures using the user's own privileges, but prevents the elevation of `db.labels`:
+As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
+
+For example:
[source, cypher, role=noplay]
----
@@ -1898,9 +1898,9 @@ GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1;
DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1;
----
-As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user's own privileges.
-It also prevents the `db.labels` procedure from being elevated.
-Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block the execution of `db.labels`.
+As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user’s own privileges.
+They also prevent the `db.labels` procedure from being elevated.
+Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`.
To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query:
@@ -1918,12 +1918,12 @@ SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS;
a|Rows: 2
|===
-[[execute-boosted-procedures-deny-execution]]
-==== Grant privilege to execute boosted procedures and deny execution of specific procedures
+[[grant-privilege-elevation-deny-execution]]
+==== Combination of granting privilege elevation and denying execution
-You can also grant the privilege to execute boosted procedures and deny the execution of specific procedures.
+You can also grant the privilege to execute procedures with elevated privileges and deny the execution of specific procedures.
-For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
+For example:
[source, cypher, role=noplay]
----
@@ -1936,6 +1936,7 @@ DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2;
----
As a result, the `deniedBoostedProcedureExecutor2` role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
+
To list all privileges for the role `deniedBoostedProcedureExecutor2` as commands, use the following query:
[source, cypher, role=noplay]
@@ -1952,12 +1953,13 @@ SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS;
a|Rows: 2
|===
-[[execute-boosted-procedures-deny-elevation]]
-==== Grant privilege to execute boosted procedures and deny elevation of specific procedures
+[[grant-deny-privilege-elevation]]
+==== Combination of granting and denying privilege elevation
-You can also grant the privilege to execute boosted procedures and deny the elevation of specific procedures.
+You can also grant the privilege to execute procedures with elevated privileges and deny the elevation for specific procedures.
-For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
+For example, the following queries allow has privileges that allow elevating the privileges for all procedures except `db.labels`.
+However, no procedures can be executed due to a missing `EXECUTE BOOSTED PROCEDURE` privilege.
[source, cypher, role=noplay]
----
@@ -1971,6 +1973,7 @@ DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecut
As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`.
However, no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
+
To list all privileges for the role `deniedBoostedProcedureExecutor3` as commands, use the following query:
[source, cypher, role=noplay]
@@ -1994,7 +1997,7 @@ For example, assume there is a procedure called `myProc`.
This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege.
-Now, adapt the privileges from sections <> (example 1), <> (example 2), and <> (example 3) to be applied to this procedure and show what is returned.
+Now, adapt the privileges from sections <> (example 1), <> (example 2), and <> (example 3) to be applied to this procedure and show what is returned.
With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`.
@@ -2094,7 +2097,6 @@ SHOW ROLE functionExecutor PRIVILEGES AS COMMANDS;
|"GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO `functionExecutor`"
a|Rows: 1
|===
-======
==== Grant privilege to execute execute all but some UDFs
@@ -2142,7 +2144,6 @@ a|Rows: 2
|===
The `apoc.any.property` and `apoc.any.properties` are blocked, as well as any other UDFs starting with `apoc.any.prop`.
-======
[[access-control-execute-boosted-user-defined-function]]
=== Grant privilege to execute user-defined functions with elevated privileges
@@ -2224,7 +2225,7 @@ GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...]
=== Grant privilege to show all settings
-You can grant the privilege to show all settings using `SHOW SETTING *` or all settings in a namespace using `SHOW SETTING namespace.*`.
+You can grant the privilege to show all settings using `SHOW SETTING \*` or all settings in a namespace using `SHOW SETTING namespace.*`.
The following query shows an example of how to grant `SHOW SETTING` privilege to view all settings in the `server.bolt` namespace:
[source, cypher, role=noplay]
@@ -2250,7 +2251,7 @@ SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-=== Grant privilege to show execute all but some settings
+=== Grant privilege to show all but some settings
You can grant the privilege to show all but a few settings using `SHOW SETTINGS *` and deny the unwanted settings. +
For example, the following queries allow you to view all settings, except those starting with `dbms.security`:
diff --git a/modules/ROOT/pages/backup-restore/copy-database.adoc b/modules/ROOT/pages/backup-restore/copy-database.adoc
index 6998b5127..3d17183db 100644
--- a/modules/ROOT/pages/backup-restore/copy-database.adoc
+++ b/modules/ROOT/pages/backup-restore/copy-database.adoc
@@ -206,7 +206,7 @@ If you go from `high_limit` to `standard` or `aligned`, there is no validation t
[role=label--enterprise-edition]
[NOTE]
====
-The block format is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
+The block format is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
For more information on the block format, see xref:database-internals/store-formats.adoc[Store formats].
====
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index fbbf1cae0..c119d6f71 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -3,17 +3,16 @@
:page-role: new-2025.06
:description: How to configure the Cypher default version.
-You can specify the version of Cypher in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
-Cypher 5 is the default version for all newly-created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
-
-For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
+You can specify the version of Cypher® in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
+Cypher 5 is the default version for all newly created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
+For more information, see xref:introduction.adoc#_cypher_versions[Cypher® versions].
To specify the Cypher version, use one of the following options:
Configure a default Cypher version for the whole DBMS::
The default language version for the whole DBMS can be configured in the _neo4j.conf_ file using the setting xref:configuration/configuration-settings.adoc#config_db.query.default_language[db.query.default_language] (default value: CYPHER_5). +
-Changing this setting in an existing DBMS, *does not* affect existing databases.
-It only applies to newly-created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
+Changing this setting in an existing DBMS *does not* affect existing databases.
+It only applies to newly created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
Configure a default Cypher version per database::
The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
index 5ce5231e7..3b16cbb8b 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc
@@ -4,7 +4,6 @@
= Managing database aliases in composite databases
Both local and remote database aliases can be created as part of a composite database.
-Starting with Neo4j 2025.04, a database alias can also be set as the default database for a composite database.
////
[source, cypher, role=test-setup]
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index fc6172d26..44d956433 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -124,7 +124,7 @@ The driver options for connection to the remote database or `null` if the target
List of xref::database-administration/aliases/manage-aliases-standard-databases.adoc#alias-management-create-remote-database-alias-driver-settings[driver settings] allowed for remote database aliases.
| MAP
-| defaultLanguage
+| defaultLanguage label:new[Introduced in 2025.06]
|
The default language for non-constituent remote database aliases or `null` if it is a constituent or local database alias.
| STRING
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index 9507ce748..68c004f7e 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -6,37 +6,6 @@ You can modify standard databases using the Cypher command `ALTER DATABASE`.
== Syntax
-[.tabbed-example]
-=====
-[role=include-with-cypher-5 label--before-2025.06]
-======
-[options="header", width="100%", cols="1m,5a"]
-|===
-| Command | Syntax
-
-| ALTER DATABASE
-|
-[source, syntax, role="noheader"]
-----
-ALTER DATABASE name [IF EXISTS]
-{
-SET ACCESS {READ ONLY \| READ WRITE} \|
-SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
-SET OPTION option value
-}
-[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
-
-[source, syntax]
-----
-ALTER DATABASE name [IF EXISTS]
-REMOVE OPTION option
-[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
-----
-|===
-======
-[role=include-with-cypher-25 label--new-2025.06]
-======
[options="header", width="100%", cols="1m,5a"]
|===
| Command | Syntax
@@ -62,12 +31,12 @@ REMOVE OPTION option
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
----
|===
-======
-=====
[NOTE]
====
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
+
+`SET DEFAULT LANGUAGE CYPHER {5|25}` is available from Neo4j 2025.06 onwards.
====
[role=label--enterprise-edition label--not-on-aura]
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index bc1cacbcf..fa407c162 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -21,7 +21,7 @@ Having dots (`.`) in the database names is not recommended.
This is due to the difficulty of determining if a dot is part of the database name or a delimiter for a database alias in a composite database.
====
-`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
+`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
Alternatively, you can set the store format of new databases using the `CREATE DATABASE databasename OPTIONS {storeFormat: 'the-new-format'}` command.
However, if the store is seeded with `seedURI`, `existingDataSeedServer` or `existingDataSeedInstance`, or if the command is being used to mount pre-existing store files already present on the disk, they will use their current store format without any alterations.
diff --git a/modules/ROOT/pages/database-internals/store-formats.adoc b/modules/ROOT/pages/database-internals/store-formats.adoc
index 1491a2c4f..6f4f89185 100644
--- a/modules/ROOT/pages/database-internals/store-formats.adoc
+++ b/modules/ROOT/pages/database-internals/store-formats.adoc
@@ -92,7 +92,7 @@ You can either set the store format when creating a new database or change the s
[[create-new-databases]]
=== Creating new databases
-`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
+`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
You can also create a new database on a specific store format by passing the new format as an argument to the command creating the database, for example, xref:import.adoc#import-tool-full[`neo4j-admin database import full`] or xref:backup-restore/copy-database.adoc[`neo4j-admin database copy`] commands, or by using `storeFormat:` option in the Cypher command `CREATE DATABASE`.
From 1faf1b88fb36ff01d8bc63cd7b69e70e203a8e93 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 24 Jun 2025 13:51:55 +0100
Subject: [PATCH 27/65] add Jens suggestions
---
.../configuration/cypher-version-configuration.adoc | 9 +++++++++
.../aliases/manage-aliases-standard-databases.adoc | 12 ++++++++++++
.../alter-composite-databases.adoc | 10 ++++++++--
.../create-composite-databases.adoc | 8 +++++++-
.../standard-databases/alter-databases.adoc | 7 ++++++-
.../standard-databases/create-databases.adoc | 12 +++++++++---
6 files changed, 51 insertions(+), 7 deletions(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index c119d6f71..c3bd75c4d 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -21,6 +21,15 @@ For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DAT
For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
If not specified, the default language for the database is set to the default language of the DBMS.
Setting the default language requires the `SET DATABASE DEFAULT LANGUAGE` privilege.
++
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+
+Setting the default language to `CYPHER 5` ensures that all queries run on that database will use the version of `Cypher 5` as it existed at the time of the Neo4j 2025.06 release (unless you prepend your queries with `CYPHER 25`, which overrides this default).
+Any changes introduced after the 2025.06 release will not affect the semantics of the query.
+====
Set the Cypher version on a per-query basis::
The default language for a specific query can be set by prepending the query with the `CYPHER 5` or `CYPHER 25` keyword. +
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 44d956433..2648c9b00 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -506,6 +506,12 @@ SHOW ALIAS `remote-with-default-language` FOR DATABASE YIELD name, defaultLangua
+--------------------------------------------------+
----
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+====
+
==== Set properties for remote database aliases
You can set properties for remote database aliases using the `PROPERTIES` clause of the `CREATE ALIAS` command.
@@ -644,6 +650,12 @@ ALTER ALIAS `remote-with-default-language`
SET DATABASE DEFAULT LANGUAGE CYPHER 5
----
+[NOTE]
+====
+Setting the default language to `CYPHER 5` ensures that all queries run on that database will use the version of `Cypher 5` as it existed at the time of the Neo4j 2025.06 release (unless you prepend your queries with `CYPHER 25`, which overrides this default).
+Any changes introduced after the 2025.06 release will not affect the semantics of the query.
+====
+
=== Alter properties of local and remote database aliases
You can alter the properties of a local or remote database alias using the `SET DATABASE PROPERTIES` clause of the `ALTER ALIAS` command.
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
index dc446f9bd..f32965c9d 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -22,7 +22,7 @@ SET DEFAULT LANGUAGE CYPHER {5\|25}
|===
[role=label--new-2025.06]
-== Change the default Cypher version of a composite database
+== Alter the default Cypher version of a composite database
You can change the default Cypher version of an existing composite database using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
For example:
@@ -48,4 +48,10 @@ include::partial$/view-cypher-version.adoc[]
| "system" | "CYPHER 25"
2+d|Rows: 5
-|===
\ No newline at end of file
+|===
+
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+====
\ No newline at end of file
diff --git a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
index 0da70ed5b..9afbc5e8f 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/create-composite-databases.adoc
@@ -95,7 +95,7 @@ The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used toge
[role=label--new-2025.06]
[[composite-databases-default-language]]
-== Set the default Cypher version for a composite database
+== Set a default Cypher version for a composite database
You can set the default Cypher version for a composite database when creating it.
If not specified, the default language for the composite database is set to the default language of the DBMS.
@@ -126,3 +126,9 @@ include::partial$/view-cypher-version.adoc[]
|===
For more information about other options for configuring the Cypher version, see xref:configuration/cypher-version-configuration.adoc[Configure the Cypher default version].
+
+[NOTE]
+====
+Setting the default language to `CYPHER 5` ensures that all queries run on that database will use the version of `Cypher 5` as it existed at the time of the Neo4j 2025.06 release (unless you prepend your queries with `CYPHER 25`, which overrides this default).
+Any changes introduced after the 2025.06 release will not affect the semantics of the query.
+====
\ No newline at end of file
diff --git a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
index 68c004f7e..4764774ed 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc
@@ -102,7 +102,7 @@ SET ACCESS READ WRITE
[role=label--new-2025.06]
[[alter-database-default-language]]
-== Alter database default Cypher version
+== Alter the default Cypher version of an existing database
You can change the default Cypher version of an existing database, including the `system` database, using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
For example:
@@ -128,6 +128,11 @@ include::partial$/view-cypher-version.adoc[]
2+d|Rows: 4
|===
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+====
[role=label--enterprise-edition label--not-on-aura]
== Alter database topology
diff --git a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
index fa407c162..e14406874 100644
--- a/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
+++ b/modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc
@@ -373,10 +373,10 @@ The `IF NOT EXISTS` and `OR REPLACE` parts of these commands cannot be used toge
====
[role=label--new-2025.06]
-== Create a database with `DEFAULT LANGUAGE`
+== Set a default Cypher version for a standard database
You can set the default Cypher version for a database when creating it.
-If not specified, the default language for the database is set to the default language of the DBMS.
+If not specified, the version for that database will be set to the default Cypher version of the DBMS.
For example:
[source, cypher]
@@ -400,4 +400,10 @@ include::partial$/view-cypher-version.adoc[]
2+d|Rows: 4
|===
-For more information about other options for configuring the Cypher version, see xref:configuration/cypher-version-configuration.adoc[Configure the Cypher default version].
\ No newline at end of file
+For more information about other options for configuring the Cypher version, see xref:configuration/cypher-version-configuration.adoc[Configure the Cypher default version].
+
+[NOTE]
+====
+Setting the default language to `CYPHER 25` ensures that all queries run on that database will use the version of `Cypher 25` that the database is currently running (unless you prepend your queries with `CYPHER 5`, which overrides this default).
+For example, a Neo4j 2025.08 database with default language `Cypher 25` will use `Cypher 25` as it exists in Neo4j 2025.08, including any changes introduced in Neo4j 2025.06, 2025.07, and 2025.08.
+====
\ No newline at end of file
From 7ca960c7f8f2e3951074bff5d427be8974d914f7 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Wed, 25 Jun 2025 15:49:12 +0100
Subject: [PATCH 28/65] update the driver settings
---
.../aliases/manage-aliases-standard-databases.adoc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 2648c9b00..b7cc99a20 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -431,8 +431,8 @@ If `ssl_enforced` is set to true, a secure URL scheme is enforced.
It is be validated when the command is executed.
* `connection_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.connect_timeout[dbms.routing.driver.connection.connect_timeout].)
* `connection_max_lifetime` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.max_lifetime[dbms.routing.driver.connection.max_lifetime].)
-* `connection_pool_acquisition_timeout` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_acquisition_timeout[dbms.routing.driver.connection_pool_acquisition_timeout].)
-* `connection_pool_idle_test` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection_pool_idle_test[dbms.routing.driver.connection_pool_idle_test].)
+* connection_pool_acquisition_timeout -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.acquisition_timeout[dbms.routing.driver.connection.pool.acquisition_timeout].
+* connection_pool_idle_test -- for details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.idle_test[dbms.routing.driver.connection.pool.idle_test].
* `connection_pool_max_size` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.connection.pool.max_size[dbms.routing.driver.connection.pool.max_size].)
* `logging_level` (For details, see xref:configuration/configuration-settings.adoc#config_dbms.routing.driver.logging.level[dbms.routing.driver.logging.level].)
From e43b38d45c7ddc5087b4beb0bbdc6bbdb8e1178d Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Thu, 26 Jun 2025 14:04:36 +0100
Subject: [PATCH 29/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Natalia Ivakina <82437520+NataliaIvakina@users.noreply.github.com>
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index cc88afdf5..44485932e 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -105,7 +105,7 @@ The following sections describe the privileges that are available for DBMS admin
You can create a custom role to manage DBMS privileges by granting the privileges you want to the role.
Alternatively, you can copy the `admin` role and revoke or deny the unwanted privileges.
-The following exaples show how to create a custom role with a subset of the privileges that the `admin` role using both methods.
+The following examples show how to create a custom role with a subset of the privileges that the `admin` role using both methods.
=== Create a custom administrator role from scratch
From a10c44ce588845d05d50804a02de4751769fa2f7 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Thu, 26 Jun 2025 14:10:00 +0100
Subject: [PATCH 30/65] Update
modules/ROOT/pages/database-administration/index.adoc
---
modules/ROOT/pages/database-administration/index.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/index.adoc b/modules/ROOT/pages/database-administration/index.adoc
index 39541c4a9..c019f5835 100644
--- a/modules/ROOT/pages/database-administration/index.adoc
+++ b/modules/ROOT/pages/database-administration/index.adoc
@@ -16,7 +16,7 @@ For more information on the Cypher administration commands syntax, see xref:data
[WARNING]
====
Cypher administration commands must not be used during a rolling upgrade.
-For more information, see link:{neo4j-docs-base-uri}/upgrade-migration-guide/upgrade/upgrade-4.4/causal-cluster/[Upgrade and Migration Guide -> Upgrade a cluster].
+For more information, see link:{neo4j-docs-base-uri}/upgrade-migration-guide/current/version-2025/#_clusters[Upgrade and Migration Guide -> Upgrade to a Neo4j 2025 release -> Clusters].
====
== Standard databases
From da114f7f5ed83c436b3b8873292680f3892a3a9b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:34:52 +0100
Subject: [PATCH 31/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 44485932e..a1a937c89 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1036,7 +1036,7 @@ GRANT ALTER COMPOSITE DATABASE
| Enables the specified roles to modify composite databases.
| [source, syntax, role=noheader]
-GRANT COMPOSITE DATABASE MANAGEMENT
+GRANT [IMMUTABLE] COMPOSITE DATABASE MANAGEMENT
ON DBMS
TO role[, ...]
| Enables the specified roles to create, delete or modify composite databases.
From 2195640fde624742423b684a4d6b2c32b65b7164 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:35:02 +0100
Subject: [PATCH 32/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index a1a937c89..dc350afd1 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1822,7 +1822,7 @@ DENY EXECUTE PROCEDURE dbms.cluster* ON DBMS TO deniedProcedureExecutor;
----
Users with the role `deniedProcedureExecutor` can run any procedure except those starting with `dbms.cluster`.
-The procedure is run using the user's own privileges.
+The procedures are executed using the user's own privileges.
To list all privileges for the role `deniedProcedureExecutor` as commands, use the following query:
From 862f8f4006b9c6e119e3c48a9450b8d38aa4a9b3 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:35:19 +0100
Subject: [PATCH 33/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index dc350afd1..764eb29a6 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -2157,7 +2157,7 @@ Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION`
[IMPORTANT]
====
-The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in UDFs, as they have no concept of elevated privileges.
+The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
====
==== Execute boosted user-defined function
From 53d7a066ccf193969aaa9a71a761fe506c5bdff3 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:35:35 +0100
Subject: [PATCH 34/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 764eb29a6..aab4f8591 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -2160,7 +2160,7 @@ Both `EXECUTE USER DEFINED FUNCTION` and `EXECUTE BOOSTED USER DEFINED FUNCTION`
The `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege does not apply to built-in functions, as they have no concept of elevated privileges.
====
-==== Execute boosted user-defined function
+==== Grant privilege to execute some UDFs with elevated privileges
The following query shows an example of how to grant the `EXECUTE BOOSTED USER DEFINED FUNCTION` privilege:
From 32e0b71b8a9e01261815fd412781ddb9b32bafc2 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:35:49 +0100
Subject: [PATCH 35/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index aab4f8591..5ceb6033b 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1789,7 +1789,7 @@ GRANT EXECUTE PROCEDURE db.schema.* ON DBMS TO procedureExecutor;
----
Users with the role `procedureExecutor` can run any procedure in the `db.schema` namespace.
-The procedure is run using the user's own privileges.
+The procedures are executed using the user's own privileges.
To list all privileges for the role `procedureExecutor` as commands, use the following query:
From 17b477852831470a68e673247f1e6097ee124316 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:36:01 +0100
Subject: [PATCH 36/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 5ceb6033b..3d55b5790 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1030,7 +1030,7 @@ GRANT DROP COMPOSITE DATABASE
| Enables the specified roles to delete composite databases.
| [source, syntax, role=noheader]
-GRANT ALTER COMPOSITE DATABASE
+GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE
ON DBMS
TO role[, ...]
| Enables the specified roles to modify composite databases.
From 4b32ad55e289c73a519f839bdddcf0bc2ac21005 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:36:32 +0100
Subject: [PATCH 37/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 3d55b5790..6e55588db 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1018,7 +1018,7 @@ GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
| Enables the specified roles to set the default query language on a standard database.
| [source, syntax, role=noheader]
-GRANT CREATE COMPOSITE DATABASE
+GRANT [IMMUTABLE] CREATE COMPOSITE DATABASE
ON DBMS
TO role[, ...]
| Enables the specified roles to create new composite databases.
From 1434700cf7decc5cc947d20035722520c1f95114 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:36:49 +0100
Subject: [PATCH 38/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 6e55588db..cf7b74c4b 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -719,7 +719,7 @@ The `SET PASSWORDS` privilege allows the user to run the `ALTER USER` administra
ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
----
-=== Grant privilege to modify users' auth providers
+=== Grant privilege to modify users' auth information
You can grant the privilege to modify users' auth providers using the `SET AUTH` privilege. +
For example:
From 2df0afcfb06169fad17d629879e7a70e2282e086 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:37:40 +0100
Subject: [PATCH 39/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index cf7b74c4b..7928b55f4 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -86,7 +86,7 @@ The xref:authentication-authorization/built-in-roles.adoc#access-control-built-i
These include:
-* <> and <>.
+* Create, delete, and modify <> and <>.
* Change configuration parameters.
* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
* Manage <> and <>.
From a4a4a19c61b586080a7543c09c6720551865a1f5 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:38:34 +0100
Subject: [PATCH 40/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 7928b55f4..81005a0ff 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -77,7 +77,7 @@ image::privileges_hierarchy_dbms.svg[width="800", title="DBMS privileges hierarc
[NOTE]
====
-You can only grant privileges to existing roles.
+You can only grant, deny, or revoke privileges to or from existing roles.
====
== The `admin` role privileges
From 6a66259d9c74df7c9b48284fa8fc86ed235f9b27 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:45:27 +0100
Subject: [PATCH 41/65] Update
modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
Co-authored-by: Therese Magnusson
---
.../aliases/manage-aliases-standard-databases.adoc | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index b7cc99a20..4fa184c40 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -27,7 +27,8 @@ A remote database alias may target a database from another Neo4j DBMS.
It can be used for:
* Connecting to a database of a remote Neo4j DBMS
* `USE` clauses
-* Setting a user's home database and defining the access privileges
+* Setting a user's home database
+* Defining the access privileges to the remote database
* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
+
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
From fa26e3072b10be5ffe7ed28d9deb7e486edafb20 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:45:56 +0100
Subject: [PATCH 42/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 81005a0ff..1c8a1eb0d 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -89,7 +89,7 @@ These include:
* Create, delete, and modify <> and <>.
* Change configuration parameters.
* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
-* Manage <> and <>.
+* Manage <> and <>.
* Manage sub-graph <>.
* Manage <>.
* Manage <>.
From 589c50edd20c53367d35f64e2fb14446c450946f Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:49:04 +0100
Subject: [PATCH 43/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 1c8a1eb0d..b3e2a872e 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -158,7 +158,7 @@ To create a more powerful administrator, you can grant a different set of privil
You can also create a custom administrator role with limited capabilities.
This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting only the privileges you want to include.
-For example, you can create a custom administrator role `customAdministrator` that has all DBMS privileges except for creating, dropping, and modifying databases, but still has the privilege for managing transactions.
+For example, you can create a custom administrator role `customAdministrator` that has all DBMS privileges except for creating, dropping, and modifying databases, and also has the privilege for managing transactions.
. Create a new role:
+
From aef43ac9500a2fddf713639646c109c76aa33acf Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 10:54:16 +0100
Subject: [PATCH 44/65] Update
modules/ROOT/pages/configuration/cypher-version-configuration.adoc
Co-authored-by: Therese Magnusson
---
.../ROOT/pages/configuration/cypher-version-configuration.adoc | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
index c3bd75c4d..ac0c87001 100644
--- a/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
+++ b/modules/ROOT/pages/configuration/cypher-version-configuration.adoc
@@ -20,7 +20,8 @@ This clause determines the default Cypher version for the specified database, ov
For example, `CREATE DATABASE mydb SET DEFAULT LANGUAGE CYPHER 25` or `ALTER DATABASE mydb SET DEFAULT LANGUAGE CYPHER 5`.
For more details and examples, see xref:database-administration/syntax.adoc#administration-syntax-database-management[Database management command syntax] and the respective pages in the xref:database-administration/index.adoc[] section. +
If not specified, the default language for the database is set to the default language of the DBMS.
-Setting the default language requires the `SET DATABASE DEFAULT LANGUAGE` privilege.
+Setting the default language on creation only require the correct `CREATE` privilege.
+Modifying the default language for an existing standard database requires the `SET DATABASE DEFAULT LANGUAGE` privilege and for an existing composite database the `ALTER COMPOSITE DATABASE` privilege.
+
[NOTE]
====
From 9577fb03738056e0536cfd67c1c56d53df44235b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 11:00:21 +0100
Subject: [PATCH 45/65] Update
modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
---
.../composite-databases/alter-composite-databases.adoc | 1 +
1 file changed, 1 insertion(+)
diff --git a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
index f32965c9d..bb753254e 100644
--- a/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
+++ b/modules/ROOT/pages/database-administration/composite-databases/alter-composite-databases.adoc
@@ -22,6 +22,7 @@ SET DEFAULT LANGUAGE CYPHER {5\|25}
|===
[role=label--new-2025.06]
+[[alter-default-language-composite-database]]
== Alter the default Cypher version of a composite database
You can change the default Cypher version of an existing composite database using the `ALTER DATABASE` command with the `SET DEFAULT LANGUAGE` clause.
From d2dac99dfc72cc22366e88e7e9230f2294ca6660 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 11:01:48 +0100
Subject: [PATCH 46/65] Update
modules/ROOT/pages/database-administration/index.adoc
Co-authored-by: Therese Magnusson
---
modules/ROOT/pages/database-administration/index.adoc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/index.adoc b/modules/ROOT/pages/database-administration/index.adoc
index c019f5835..67626ae59 100644
--- a/modules/ROOT/pages/database-administration/index.adoc
+++ b/modules/ROOT/pages/database-administration/index.adoc
@@ -9,8 +9,8 @@ The DBMS can manage a standalone server, or a group of servers in a cluster.
A database is an administrative partition of a DBMS.
In practical terms, it is a physical structure of files organized within a directory or folder, that has the same name of the database.
-This chapter describes how to manage local and remote standard databases, composite databases, and database aliases. +
-All databases are managed using the Cypher administration commands.
+This chapter describes how to manage standard databases, composite databases, and local and remote database aliases. +
+All databases and database aliases are managed using the Cypher administration commands.
For more information on the Cypher administration commands syntax, see xref:database-administration/syntax.adoc[Database management command syntax].
[WARNING]
From 4e02b7adb1eff7061089ccbb004e41ea4343a38b Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 11:03:42 +0100
Subject: [PATCH 47/65] Update
modules/ROOT/pages/database-administration/syntax.adoc
Co-authored-by: Therese Magnusson
---
modules/ROOT/pages/database-administration/syntax.adoc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/syntax.adoc b/modules/ROOT/pages/database-administration/syntax.adoc
index ee56ed839..957f2d37e 100644
--- a/modules/ROOT/pages/database-administration/syntax.adoc
+++ b/modules/ROOT/pages/database-administration/syntax.adoc
@@ -7,11 +7,11 @@ The most common variations include parts of the commands that are optional, or t
Some variations are indicated using special characters.
See <> for details.
-include::partial$/cypher-versions.adoc[]
-
This page summarizes the various command syntax options.
It also includes examples for both Cypher 5 and Cypher 25 when available.
+include::partial$/cypher-versions.adoc[]
+
[[administration-syntax-reading]]
== Reading the administration commands syntax
From 038f4e790769e32958524ae39b2b5f8b6cf5e6bd Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 13:46:03 +0100
Subject: [PATCH 48/65] Update
modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
Co-authored-by: Therese Magnusson
---
.../aliases/manage-aliases-standard-databases.adoc | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 4fa184c40..1d387a02a 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -482,11 +482,12 @@ For example, the following query creates a remote database alias with the defaul
.Query
[source, cypher]
----
-CREATE ALIAS `remote-with-default-language` FOR DATABASE `northwind-graph-2020`
-AT "neo4j+s://location:7687"
-USER alice
-PASSWORD 'example_secret'
-DEFAULT LANGUAGE CYPHER 25
+CREATE ALIAS `remote-with-default-language`
+FOR DATABASE `northwind-graph-2020`
+ AT "neo4j+s://location:7687"
+ USER alice
+ PASSWORD 'example_secret'
+ DEFAULT LANGUAGE CYPHER 25
----
To view the remote database alias details, including the default language, use the `SHOW ALIASES FOR DATABASE` command with the `YIELD` clause:
From fef39f48bd6846f6b665637420b12b8bdd06a742 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 13:48:36 +0100
Subject: [PATCH 49/65] Update
modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
---
.../aliases/manage-aliases-standard-databases.adoc | 1 -
1 file changed, 1 deletion(-)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 1d387a02a..57adfbdd3 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -30,7 +30,6 @@ It can be used for:
* Setting a user's home database
* Defining the access privileges to the remote database
* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
-+
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
From a0d73c59975d0456cab1505a704b744225e06d90 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 13:57:11 +0100
Subject: [PATCH 50/65] Update modules/ROOT/partials/cypher-versions.adoc
---
modules/ROOT/partials/cypher-versions.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/partials/cypher-versions.adoc b/modules/ROOT/partials/cypher-versions.adoc
index 5e7ce5502..8e1b4ab87 100644
--- a/modules/ROOT/partials/cypher-versions.adoc
+++ b/modules/ROOT/partials/cypher-versions.adoc
@@ -3,7 +3,7 @@
In Neo4j 2025.06, the Cypher language has been decoupled from the Neo4j server versioning and now has its own versioning system.
You can choose between Cypher 5 and Cypher 25.
-Cypher 5 is the version that has been in use in Neo4j up to and including version 2025.05.
+Cypher 5 is the version that has been in use in Neo4j up to and including version 2025.06.
It will remain the default version for all newly created databases but will not receive new features.
All new features and improvements will be introduced in Cypher 25.
For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
From b4e1dac2e2be1508626a2a32a50bc289579151e2 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 13:58:16 +0100
Subject: [PATCH 51/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index b3e2a872e..6e2e90c12 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -185,7 +185,7 @@ DENY DATABASE MANAGEMENT ON DBMS TO customAdministrator;
GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO customAdministrator;
----
+
-As a result, the `customAdministrator` role has privileges that include all DBMS privileges except creating, dropping, and modifying databases, as well as managing transactions.
+As a result, the `customAdministrator` role has privileges that include managing transactions and all DBMS privileges except creating, dropping, and modifying databases.
. To list all privileges for the role `customAdministrator` as commands, use the following query:
+
[source, cypher, role=noplay]
From bf83fde27af59b57296e713f00df9b303e342d93 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:02:33 +0100
Subject: [PATCH 52/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 6e2e90c12..029222ca4 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -683,7 +683,7 @@ ALTER USER jake SET PASSWORD 'verysecret' SET STATUS SUSPENDED
[NOTE]
====
-Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and the `SET USER HOME DATABASE` privilege actions is equivalent to the `ALTER USER` privilege action.
+Note that the combination of the `SET PASSWORDS`, `SET AUTH`, `SET USER STATUS`, and `SET USER HOME DATABASE` privileges is equivalent to the `ALTER USER` privilege.
====
=== Grant privilege to modify users' passwords
From 3fb61710ab413385bfde91e84e389281e008f076 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:03:22 +0100
Subject: [PATCH 53/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 029222ca4..464b11243 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -154,7 +154,7 @@ For example, the role is missing privileges for managing, creating, and dropping
To create a more powerful administrator, you can grant a different set of privileges.
====
-=== Create a custom administrator role from scratch with limited capabilities
+=== Create a more powerful custom administrator role from scratch
You can also create a custom administrator role with limited capabilities.
This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting only the privileges you want to include.
From f21bb754362d6676595993bcbc815e17d0ab26f5 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:04:10 +0100
Subject: [PATCH 54/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 464b11243..519f2764b 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -157,7 +157,7 @@ To create a more powerful administrator, you can grant a different set of privil
=== Create a more powerful custom administrator role from scratch
You can also create a custom administrator role with limited capabilities.
-This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting only the privileges you want to include.
+This can be done by creating a new role and granting all `DBMS` privileges, then denying the ones you do not want the role to have, and then granting additional privileges you want to include.
For example, you can create a custom administrator role `customAdministrator` that has all DBMS privileges except for creating, dropping, and modifying databases, and also has the privilege for managing transactions.
. Create a new role:
From 60a36c861318c46046860b0ef3b5da3b9260ac07 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:05:26 +0100
Subject: [PATCH 55/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 519f2764b..4cc6615b6 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -673,7 +673,7 @@ a|Rows: 1
|===
-The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH` and `SET STATUS` parts. +
+The `ALTER USER` privilege allows the user to run the `ALTER USER` administration command with one or several of the `SET PASSWORD`, `SET PASSWORD CHANGE [NOT] REQUIRED`, `SET AUTH`, `REMOVE AUTH`, `SET STATUS`, `SET HOME DATABASE`, and `REMOVE HOME DATABASE` parts. +
For example:
[source, cypher, role=noplay]
From 249909e8939e5fb4a57f63e124982eed8c138751 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:10:24 +0100
Subject: [PATCH 56/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 4cc6615b6..a4263919e 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -721,7 +721,7 @@ ALTER USER jake SET PASSWORD 'abcd5678' CHANGE NOT REQUIRED
=== Grant privilege to modify users' auth information
-You can grant the privilege to modify users' auth providers using the `SET AUTH` privilege. +
+You can grant the privilege to modify users' auth information using the `SET AUTH` privilege. +
For example:
[source, cypher, role=noplay]
From c9cc0f12f1dbbed9b297d5e80704205acfeb18f5 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 14:12:00 +0100
Subject: [PATCH 57/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index a4263919e..8d3a5c44e 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -726,7 +726,7 @@ For example:
[source, cypher, role=noplay]
----
-GRANT SET AUTH ON DBMS TO userModifier
+GRANT SET AUTH ON DBMS TO authModifier
----
As a result, the `userModifier` role has privileges that only allow modifying users' auth providers.
From 294d81a8168efa90f6cf2e7aa0e1040224b6d916 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 15:23:39 +0100
Subject: [PATCH 58/65] apply suggestion from review
---
.../dbms-administration.adoc | 118 ++++++++++--------
1 file changed, 69 insertions(+), 49 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 8d3a5c44e..d20c709bf 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -13,6 +13,8 @@ CREATE ROLE roleViewer IF NOT EXISTS;
CREATE ROLE roleManager IF NOT EXISTS;
CREATE ROLE userAdder IF NOT EXISTS;
CREATE ROLE userNameModifier IF NOT EXISTS;
+CREATE ROLE homeDbModifier IF NOT EXISTS;
+CREATE ROLE allUserImpersonator IF NOT EXISTS;
CREATE ROLE userModifier IF NOT EXISTS;
CREATE ROLE passwordModifier IF NOT EXISTS;
CREATE ROLE statusModifier IF NOT EXISTS;
@@ -90,7 +92,7 @@ These include:
* Change configuration parameters.
* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
* Manage <> and <>.
-* Manage sub-graph <>.
+* Manage <>.
* Manage <>.
* Manage <>.
* Manage <>.
@@ -115,35 +117,35 @@ Create an administrator role that can only manage users and roles by creating a
+
[source, cypher, role=noplay]
----
-CREATE ROLE usermanager;
+CREATE ROLE userManager;
----
. Grant the privilege to manage users:
+
[source, cypher, role=noplay]
----
-GRANT USER MANAGEMENT ON DBMS TO usermanager;
+GRANT USER MANAGEMENT ON DBMS TO userManager;
----
. Grant the privilege to manage roles:
+
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO usermanager;
+GRANT ROLE MANAGEMENT ON DBMS TO userManager;
----
+
-As a result, the `usermanager` role has privileges that only allow user and role management.
-. To list all privileges for the role `usermanager` as commands, use the following query:
+As a result, the `userManager` role has privileges that only allow user and role management.
+. To list all privileges for the role `userManager` as commands, use the following query:
+
[source, cypher, role=noplay]
----
-SHOW ROLE usermanager PRIVILEGES AS COMMANDS;
+SHOW ROLE userManager PRIVILEGES AS COMMANDS;
----
+
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT ROLE MANAGEMENT ON DBMS TO `usermanager`"
-|"GRANT USER MANAGEMENT ON DBMS TO `usermanager`"
+|"GRANT ROLE MANAGEMENT ON DBMS TO `userManager`"
+|"GRANT USER MANAGEMENT ON DBMS TO `userManager`"
a|Rows: 2
|===
@@ -206,65 +208,65 @@ a|Rows: 3
=== Create a custom administrator role by copying the `admin` role
You can also create a custom administrator role by copying the `admin` role and then revoking or denying the privileges you do not want.
-For example, you can create a new role called `newRole` that has all the privileges of the `admin` role, and then revoke the ability to read/write/load data, manage constraints, indexes, name, and remove ability to access all databases, except the `system` database.
+For example, you can create a new role called `newAdministrator` that has all the privileges of the `admin` role, and then revoke the ability to read/write/load data, manage constraints, indexes, name, and remove ability to access all databases, except the `system` database.
. Create a new role by copying the `admin` role:
+
[source, cypher, role=noplay]
----
-CREATE ROLE newRole AS COPY OF admin;
+CREATE ROLE newAdministrator AS COPY OF admin;
----
. Revoke the ability to read/write/load data:
+
[source, cypher, role=noplay]
----
-REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM newRole;
-REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM newRole;
-REVOKE GRANT WRITE ON GRAPH * FROM newRole;
-REVOKE GRANT LOAD ON ALL DATA FROM newRole;
+REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM newAdministrator;
+REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM newAdministrator;
+REVOKE GRANT WRITE ON GRAPH * FROM newAdministrator;
+REVOKE GRANT LOAD ON ALL DATA FROM newAdministrator;
----
. Revoke the ability to manage index/constraint/name:
+
[source, cypher, role=noplay]
----
-REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM newRole;
-REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM newRole;
-REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM newRole;
-REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM newRole;
-REVOKE GRANT SHOW INDEX ON DATABASE * FROM newRole;
+REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM newAdministrator;
+REVOKE GRANT SHOW INDEX ON DATABASE * FROM newAdministrator;
----
. Revoke the ability to access all databases:
+
[source, cypher, role=noplay]
----
-REVOKE GRANT ACCESS ON DATABASE * FROM newRole;
+REVOKE GRANT ACCESS ON DATABASE * FROM newAdministrator;
----
. Grant the ability to access the `system` database:
+
[source, cypher, role=noplay]
----
-GRANT ACCESS ON DATABASE system TO newRole;
+GRANT ACCESS ON DATABASE system TO newAdministrator;
----
-. To list all privileges for the role `newRole` as commands, use the following query:
+. To list all privileges for the role `newAdministrator` as commands, use the following query:
+
[source, cypher, role=noplay]
----
-SHOW ROLE newRole PRIVILEGES AS COMMANDS;
+SHOW ROLE newAdministrator PRIVILEGES AS COMMANDS;
----
+
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-| "GRANT ACCESS ON DATABASE `system` TO `newRole`"
-| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `newRole`"
-| "GRANT START ON DATABASE * TO `newRole`"
-| "GRANT STOP ON DATABASE * TO `newRole`"
-| "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `newRole`"
+| "GRANT ACCESS ON DATABASE `system` TO `newAdministrator`"
+| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `newAdministrator`"
+| "GRANT START ON DATABASE * TO `newAdministrator`"
+| "GRANT STOP ON DATABASE * TO `newAdministrator`"
+| "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `newAdministrator`"
a|Rows: 5
|===
@@ -728,7 +730,7 @@ For example:
----
GRANT SET AUTH ON DBMS TO authModifier
----
-As a result, the `userModifier` role has privileges that only allow modifying users' auth providers.
+As a result, the `authModifier` role has privileges that only allow modifying users' auth information.
The `SET AUTH` privilege allows the user to run the `ALTER USER` administration command with one or both of the `SET
AUTH` and `REMOVE AUTH` parts. +
@@ -779,23 +781,23 @@ For example:
[source, cypher, role=noplay]
----
-GRANT SET USER HOME DATABASE ON DBMS TO statusModifier
+GRANT SET USER HOME DATABASE ON DBMS TO homeDbModifier
----
-As a result, the `statusModifier` role has privileges that only allow modifying the home database of users.
-To list all privileges for the role `statusModifier` as commands, use the following query:
+As a result, the `homeDbModifier` role has privileges that only allow modifying the home database of users.
+To list all privileges for the role `homeDbModifier` as commands, use the following query:
[source, cypher, role=noplay]
----
-SHOW ROLE statusModifier PRIVILEGES AS COMMANDS;
+SHOW ROLE homeDbModifier PRIVILEGES AS COMMANDS;
----
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT SET USER HOME DATABASE ON DBMS TO `statusModifier`"
-|"GRANT SET USER STATUS ON DBMS TO `statusModifier`"
+|"GRANT SET USER HOME DATABASE ON DBMS TO `homeDbModifier`"
+|"GRANT SET USER STATUS ON DBMS TO `homeDbModifier`"
a|Rows: 2
|===
@@ -897,13 +899,13 @@ The DBMS privileges for impersonation can be granted, denied, or revoked like ot
Impersonation is the ability of a user to assume another user's roles (and therefore privileges), with the restriction of not being able to execute updating `admin` commands as the impersonated user (i.e. they would still be able to use `SHOW` commands).
+You can use the `IMPERSONATE` privilege to allow a user to impersonate another user.
+
[NOTE]
====
For more details about the syntax descriptions, see xref:database-administration/syntax.adoc#administration-syntax-reading[Reading the administration commands syntax].
====
-You can use the `IMPERSONATE` privilege to allow a user to impersonate another user.
-
.Impersonation privileges command syntax
[options="header", width="100%", cols="3a,2"]
|===
@@ -958,7 +960,7 @@ For example:
.Query
[source, cypher, role=noplay]
----
-GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator
+GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator;
----
As a result, the `userImpersonator` role has privileges that allow impersonating only `alice` and `bob`.
@@ -967,11 +969,28 @@ Then, you deny the privilege to impersonate `alice`:
.Query
[source, cypher, role=noplay]
----
-DENY IMPERSONATE (alice) ON DBMS TO userImpersonator
+DENY IMPERSONATE (alice) ON DBMS TO userImpersonator;
----
As a result, the `userImpersonator` user would be able to impersonate only `bob`.
+To list all privileges for the role `userImpersonator` as commands, use the following query:
+
+.Query
+[source, cypher, role=noplay]
+----
+SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS;
+----
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+| command
+| "DENY IMPERSONATE (alice) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (alice) ON DBMS TO `userImpersonator`"
+| "GRANT IMPERSONATE (bob) ON DBMS TO `userImpersonator`"
+a|Rows: 3
+|===
+
[[access-control-dbms-administration-database-management]]
== The DBMS `DATABASE MANAGEMENT` privileges
@@ -1233,6 +1252,7 @@ a|Rows: 1
|===
[rol=label--new-2025.06]
+[[grant-privilege-alter-composite-database]]
=== Grant privilege to modify composite databases
You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
@@ -1613,9 +1633,9 @@ GRANT [IMMUTABLE] PRIVILEGE MANAGEMENT
=== Grant privilege to list privileges
-You can grant the privilege to list privileges using the `SHOW PRIVILEGE` privilege. +
-A user with this privilege is allowed to execute the `SHOW PRIVILEGES` and `SHOW ROLE roleName PRIVILEGES` administration commands.
-To execute the `SHOW USER username PRIVILEGES` administration command, both this privilege and the `SHOW USER` privilege are required. +
+You can grant the `SHOW PRIVILEGE` privilege to allow a user to list privileges using the `SHOW PRIVILEGE`, `SHOW ROLE roleName PRIVILEGES`, and `SHOW USER username PRIVILEGES` administration commands.
+The `SHOW USER username PRIVILEGES` command also requires the `SHOW USER` privilege.
+
For example:
[source, cypher, role=noplay]
@@ -1857,7 +1877,7 @@ Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a
You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
-For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
+For example, the following query allow the execution of the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
[source, cypher, role=noplay]
----
@@ -1959,7 +1979,7 @@ a|Rows: 2
You can also grant the privilege to execute procedures with elevated privileges and deny the elevation for specific procedures.
For example, the following queries allow has privileges that allow elevating the privileges for all procedures except `db.labels`.
-However, no procedures can be executed due to a missing `EXECUTE BOOSTED PROCEDURE` privilege.
+However, no procedures can be executed due to a missing `EXECUTE PROCEDURE` privilege.
[source, cypher, role=noplay]
----
@@ -1995,7 +2015,7 @@ a|Rows: 2
You can control the output of procedures based on the privileges granted or denied to a role using the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
For example, assume there is a procedure called `myProc`.
-This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege.
+This procedure gives the result `A` and `B` for a user with only the `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with both the `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` privileges.
Now, adapt the privileges from sections <> (example 1), <> (example 2), and <> (example 3) to be applied to this procedure and show what is returned.
@@ -2060,7 +2080,7 @@ A role with this privilege is allowed to execute the UDFs matched by the <
Date: Fri, 27 Jun 2025 16:15:26 +0100
Subject: [PATCH 59/65] update the Cypher versions page
---
modules/ROOT/partials/cypher-versions.adoc | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/modules/ROOT/partials/cypher-versions.adoc b/modules/ROOT/partials/cypher-versions.adoc
index 8e1b4ab87..6b58018c1 100644
--- a/modules/ROOT/partials/cypher-versions.adoc
+++ b/modules/ROOT/partials/cypher-versions.adoc
@@ -1,11 +1,16 @@
[role=label--new-2025.06]
== Cypher® versions
-In Neo4j 2025.06, the Cypher language has been decoupled from the Neo4j server versioning and now has its own versioning system.
-You can choose between Cypher 5 and Cypher 25.
-Cypher 5 is the version that has been in use in Neo4j up to and including version 2025.06.
-It will remain the default version for all newly created databases but will not receive new features.
-All new features and improvements will be introduced in Cypher 25.
+The Cypher language has been decoupled from the Neo4j server versioning and now has its own versioning system.
+You can choose between Cypher 5 and Cypher 25:
+
+* Cypher 5 is the language version with which all queries written for Neo4j 2025.05 and earlier versions are compatible.
+It remains the default version for all newly created databases; however, as of Neo4j 2025.06, it is frozen and will only receive performance enhancements and bug fixes in future server releases.
+
+* Cypher 25 is the new version of the Cypher language.
+It builds upon Cypher 5 and includes new and improved features, as well as some removals.
+Any new Cypher features introduced in Neo4j 2025.06 or later will be added only to Cypher 25.
+
For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
You can specify the version of Cypher in which you want to run your queries (Cypher 5 or Cypher 25) by configuring a default Cypher version for the whole DBMS, for a database, or by setting it on a per-query basis.
From c20f591aad04e9a930fcdd05558ed95aa3c9597a Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Fri, 27 Jun 2025 16:56:32 +0100
Subject: [PATCH 60/65] reconcile execute procedures with functions
---
.../dbms-administration.adoc | 12 +++++++-----
.../aliases/manage-aliases-standard-databases.adoc | 1 +
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index d20c709bf..22aa2e5f0 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1801,7 +1801,9 @@ GRANT [IMMUTABLE] EXECUTE BOOSTED [USER [DEFINED]] FUNCTION[S] name-globbing[, .
You can grant the privilege to execute procedures using the `EXECUTE PROCEDURE` privilege. +
A role with this privilege is allowed to execute the procedures matched by the <>.
-For example, the following query allow the execution of procedures starting with `db.schema`:
+==== Grant privilege to execute some procedures
+
+The following query allow the execution of procedures starting with `db.schema`:
[source, cypher, role=noplay]
----
@@ -1826,7 +1828,7 @@ SHOW ROLE procedureExecutor PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-=== Grant privilege to execute all but some procedures
+==== Grant privilege to execute all but some procedures
You can grant the privilege to execute all except a few procedures using `EXECUTE PROCEDURES *` and deny the unwanted procedures.
For example, the following queries allow the execution of all procedures, except those starting with `dbms.cluster`:
@@ -2083,7 +2085,7 @@ A role with this privilege is allowed to execute the UDFs matched by the <> section.
+Both check for any remote or local database aliases.
[[alias-management-create-remote-database-alias-driver-settings]]
From 3b429d013f6482c6426e603d0e3caf78ad54b944 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 30 Jun 2025 10:12:09 +0100
Subject: [PATCH 61/65] apply suggestions from review
---
.../dbms-administration.adoc | 30 +++++++++++--------
.../manage-aliases-standard-databases.adoc | 3 +-
2 files changed, 20 insertions(+), 13 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 22aa2e5f0..c390d94ec 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -49,6 +49,8 @@ CREATE ROLE deniedBoostedProcedureExecutor2 IF NOT EXISTS;
CREATE ROLE deniedBoostedProcedureExecutor3 IF NOT EXISTS;
CREATE ROLE deniedBoostedProcedureExecutor4 IF NOT EXISTS;
CREATE ROLE adminProcedureExecutor IF NOT EXISTS;
+CREATE ROLE userAndRoleAdministrator IF NOT EXISTS;
+CREATE ROLE authModifier IF NOT EXISTS;
CREATE ROLE functionExecutor IF NOT EXISTS;
CREATE ROLE deniedFunctionExecutor IF NOT EXISTS;
CREATE ROLE boostedFunctionExecutor IF NOT EXISTS;
@@ -117,35 +119,35 @@ Create an administrator role that can only manage users and roles by creating a
+
[source, cypher, role=noplay]
----
-CREATE ROLE userManager;
+CREATE ROLE userAndRoleAdministrator;
----
. Grant the privilege to manage users:
+
[source, cypher, role=noplay]
----
-GRANT USER MANAGEMENT ON DBMS TO userManager;
+GRANT USER MANAGEMENT ON DBMS TO userAndRoleAdministrator;
----
. Grant the privilege to manage roles:
+
[source, cypher, role=noplay]
----
-GRANT ROLE MANAGEMENT ON DBMS TO userManager;
+GRANT ROLE MANAGEMENT ON DBMS TO userAndRoleAdministrator;
----
+
-As a result, the `userManager` role has privileges that only allow user and role management.
-. To list all privileges for the role `userManager` as commands, use the following query:
+As a result, the `userAndRoleAdministrator` role has privileges that only allow user and role management.
+. To list all privileges for the role `userAndRoleAdministrator` as commands, use the following query:
+
[source, cypher, role=noplay]
----
-SHOW ROLE userManager PRIVILEGES AS COMMANDS;
+SHOW ROLE userAndRoleAdministrator PRIVILEGES AS COMMANDS;
----
+
.Result
[options="header,footer", width="100%", cols="m"]
|===
|command
-|"GRANT ROLE MANAGEMENT ON DBMS TO `userManager`"
-|"GRANT USER MANAGEMENT ON DBMS TO `userManager`"
+|"GRANT ROLE MANAGEMENT ON DBMS TO `userAndRoleAdministrator`"
+|"GRANT USER MANAGEMENT ON DBMS TO `userAndRoleAdministrator`"
a|Rows: 2
|===
@@ -2037,9 +2039,13 @@ For comparison, when granted:
[[access-control-admin-procedure]]
=== Grant privilege to execute admin procedures
-You can grant the privilege to execute admin procedures (annotated with `@Admin`) using the `EXECUTE ADMIN PROCEDURES` privilege. +
-This privilege is equivalent with granting the <> and <> privileges on each of the admin procedures.
-Any newly added `admin` procedure is automatically included in this privilege. +
+Admin procedures (annotated with `@Admin`) are special in that they require elevated privileges to be executed at all.
+This means that to execute an admin procedure you need both the <> and <> privileges for that procedure.
+
+For a user to be allowed to execute all admin procedures, they can either be granted the two privileges for each of the admin procedures (which would need to be updated each time a new admin procedure is added), all procedures (which would then affect all non-admin procedures as well) or the `EXECUTE ADMIN PROCEDURES` privilege.
+
+The `EXECUTE ADMIN PROCEDURES` privilege is equivalent to granting the <> and <> privileges on each of the admin procedures.
+This also have the additional advantage that any newly added `admin` procedure is automatically included in this privilege. +
For example:
[source, cypher, role=noplay]
@@ -2098,7 +2104,7 @@ Or in short form:
[source,cypher,role=noplay]
----
-GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO functionExecutor
+GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO functionExecutor;
----
Users with the role `functionExecutor` can thus run any UDF in the `apoc.coll` namespace.
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 7d871b5ae..30e41eb05 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -316,7 +316,8 @@ SHOW ALIAS `northwind` FOR DATABASE
==== Use `IF EXISTS` or `OR REPLACE` when creating database aliases
The `CREATE ALIAS` command is optionally idempotent, with the default behavior to fail with an error if the database alias already exists.
-There are two ways to circumvent this behavior:
+To work around this, you can append `IF EXISTS` or `OR REPLACE` to the command.
+Both check for any remote or local database aliases.
* Appending `IF NOT EXISTS` to the command.
This ensures that no error is returned and nothing happens should the database alias already exist.
From d5f1683bee1905235c0dd7ae9d646b909476d2e4 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 30 Jun 2025 15:33:46 +0100
Subject: [PATCH 62/65] update the `admin` role privileges
---
.../authentication-authorization/dbms-administration.adoc | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index c390d94ec..3cf16c4c5 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -88,13 +88,15 @@ You can only grant, deny, or revoke privileges to or from existing roles.
The xref:authentication-authorization/built-in-roles.adoc#access-control-built-in-roles-admin[`admin` role] role is a built-in superuser role that has all privileges on the DBMS and can perform all administrative tasks.
-These include:
+This includes the following tasks and their relevant privileges:
* Create, delete, and modify <> and <>.
+* Manage <>.
* Change configuration parameters.
* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
* Manage <> and <>.
-* Manage <>.
+* Manage <>.
+* Manage xref:authentication-authorization/privileges-reads.adoc[read] and xref:authentication-authorization/privileges-writes.adoc[write] sub-graph privileges.
* Manage <>.
* Manage <>.
* Manage <>.
From 7a2d6951a874098868196a6b1326a03ddd8aa91f Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Mon, 30 Jun 2025 15:41:01 +0100
Subject: [PATCH 63/65] update the `admin` role privileges
---
.../aliases/manage-aliases-standard-databases.adoc | 1 +
1 file changed, 1 insertion(+)
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 30e41eb05..8c4a2096c 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -30,6 +30,7 @@ It can be used for:
* Setting a user's home database
* Defining the access privileges to the remote database
* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
+
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
From 9e9788d2ecd716295b95410e66485c252ec16b5a Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 1 Jul 2025 11:46:25 +0100
Subject: [PATCH 64/65] apply suggestions from review
---
.../dbms-administration.adoc | 16 +++++++---------
.../manage-aliases-standard-databases.adoc | 10 ++++------
.../pages/database-administration/index.adoc | 2 +-
3 files changed, 12 insertions(+), 16 deletions(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index 3cf16c4c5..a3374f1a7 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -13,22 +13,23 @@ CREATE ROLE roleViewer IF NOT EXISTS;
CREATE ROLE roleManager IF NOT EXISTS;
CREATE ROLE userAdder IF NOT EXISTS;
CREATE ROLE userNameModifier IF NOT EXISTS;
-CREATE ROLE homeDbModifier IF NOT EXISTS;
-CREATE ROLE allUserImpersonator IF NOT EXISTS;
CREATE ROLE userModifier IF NOT EXISTS;
-CREATE ROLE passwordModifier IF NOT EXISTS;
-CREATE ROLE statusModifier IF NOT EXISTS;
CREATE ROLE userDropper IF NOT EXISTS;
CREATE ROLE userViewer IF NOT EXISTS;
CREATE ROLE userManager IF NOT EXISTS;
CREATE ROLE userImpersonator IF NOT EXISTS;
+CREATE ROLE allUserImpersonator IF NOT EXISTS;
+CREATE ROLE authModifier IF NOT EXISTS;
+CREATE ROLE passwordModifier IF NOT EXISTS;
+CREATE ROLE statusModifier IF NOT EXISTS;
+CREATE ROLE homeDbModifier IF NOT EXISTS;
CREATE ROLE databaseAdder IF NOT EXISTS;
CREATE ROLE compositeDatabaseAdder IF NOT EXISTS;
CREATE ROLE databaseDropper IF NOT EXISTS;
CREATE ROLE compositeDatabaseDropper IF NOT EXISTS;
CREATE ROLE databaseModifier IF NOT EXISTS;
CREATE ROLE accessModifier IF NOT EXISTS;
-CREATE ROLE languageModifier IF NOT EXISTS;
+CREATE ROLE languageModifier IF NOT EXISTS;Enables the specified roles to delete composite databases.
CREATE ROLE compositeDatabaseModifier IF NOT EXISTS;
CREATE ROLE compositeDatabaseManager IF NOT EXISTS;
CREATE ROLE databaseManager IF NOT EXISTS;
@@ -49,8 +50,6 @@ CREATE ROLE deniedBoostedProcedureExecutor2 IF NOT EXISTS;
CREATE ROLE deniedBoostedProcedureExecutor3 IF NOT EXISTS;
CREATE ROLE deniedBoostedProcedureExecutor4 IF NOT EXISTS;
CREATE ROLE adminProcedureExecutor IF NOT EXISTS;
-CREATE ROLE userAndRoleAdministrator IF NOT EXISTS;
-CREATE ROLE authModifier IF NOT EXISTS;
CREATE ROLE functionExecutor IF NOT EXISTS;
CREATE ROLE deniedFunctionExecutor IF NOT EXISTS;
CREATE ROLE boostedFunctionExecutor IF NOT EXISTS;
@@ -91,7 +90,6 @@ The xref:authentication-authorization/built-in-roles.adoc#access-control-built-i
This includes the following tasks and their relevant privileges:
* Create, delete, and modify <> and <>.
-* Manage <>.
* Change configuration parameters.
* xref:authentication-authorization/database-administration.adoc#access-control-database-administration-transaction[Manage transactions].
* Manage <> and <>.
@@ -1047,7 +1045,7 @@ GRANT [IMMUTABLE] CREATE COMPOSITE DATABASE
| Enables the specified roles to create new composite databases.
| [source, syntax, role=noheader]
-GRANT DROP COMPOSITE DATABASE
+GRANT [IMMUTABLE] DROP COMPOSITE DATABASE
ON DBMS
TO role[, ...]
| Enables the specified roles to delete composite databases.
diff --git a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
index 8c4a2096c..2e18e1c67 100644
--- a/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
+++ b/modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc
@@ -25,14 +25,12 @@ Privileges are defined on the target database, and not the local database alias.
Remote database aliases::
A remote database alias may target a database from another Neo4j DBMS.
It can be used for:
-* Connecting to a database of a remote Neo4j DBMS
-* `USE` clauses
-* Setting a user's home database
-* Defining the access privileges to the remote database
-* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
-
+* Connecting to a database of a remote Neo4j DBMS. +
Remote database aliases require configuration to safely connect to the remote target, which is described in xref::database-administration/aliases/remote-database-alias-configuration.adoc[Connecting remote databases].
It is not possible to impersonate a user on the remote database or to execute an administration command on the remote database via a remote database alias.
+* `USE` clauses.
+* Defining the access privileges to the remote database.
+* label:new[Introduced in 2025.06] Setting a default Cypher version for queries to the remote database.
[NOTE]
====
diff --git a/modules/ROOT/pages/database-administration/index.adoc b/modules/ROOT/pages/database-administration/index.adoc
index 67626ae59..e2536c089 100644
--- a/modules/ROOT/pages/database-administration/index.adoc
+++ b/modules/ROOT/pages/database-administration/index.adoc
@@ -9,7 +9,7 @@ The DBMS can manage a standalone server, or a group of servers in a cluster.
A database is an administrative partition of a DBMS.
In practical terms, it is a physical structure of files organized within a directory or folder, that has the same name of the database.
-This chapter describes how to manage standard databases, composite databases, and local and remote database aliases. +
+This chapter describes how to manage standard databases, composite databases, and local and remote database aliases.
All databases and database aliases are managed using the Cypher administration commands.
For more information on the Cypher administration commands syntax, see xref:database-administration/syntax.adoc[Database management command syntax].
From 428f94c35812bd880b4c535c9e21ae0399a7cc83 Mon Sep 17 00:00:00 2001
From: Reneta Popova
Date: Tue, 1 Jul 2025 13:58:50 +0100
Subject: [PATCH 65/65] Update
modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
Co-authored-by: Therese Magnusson
---
.../pages/authentication-authorization/dbms-administration.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index a3374f1a7..80f0b6efa 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -29,7 +29,7 @@ CREATE ROLE databaseDropper IF NOT EXISTS;
CREATE ROLE compositeDatabaseDropper IF NOT EXISTS;
CREATE ROLE databaseModifier IF NOT EXISTS;
CREATE ROLE accessModifier IF NOT EXISTS;
-CREATE ROLE languageModifier IF NOT EXISTS;Enables the specified roles to delete composite databases.
+CREATE ROLE languageModifier IF NOT EXISTS;
CREATE ROLE compositeDatabaseModifier IF NOT EXISTS;
CREATE ROLE compositeDatabaseManager IF NOT EXISTS;
CREATE ROLE databaseManager IF NOT EXISTS;