7.1.4.4. 기본 사용자 및 역할 관리 절차 Enterprise Edition

Neo4j에서는 Cypher를 통해 내장 프로 시저를 사용하여 기본 사용자 및 역할 관리를 관리합니다. 이 절에서는 몇 가지 간단한 예제와 함께 사용자 관리를위한 모든 보안 절차 목록을 제공합니다. 제공된 예제를 실행하려면 Neo4j Browser 또는 Neo4j Cypher Shell을 사용하십시오.

이 절에서는 다음을 설명합니다.

• List all users
• List all roles
• List all roles for a user
• List all users for a role
• Create a user
• Delete a user
• Assign a role to a user
• Remove a role from a user
• Create a custom role
• Delete a custom role
• Suspend a user
• Activate a user
• Change a user’s password
• Change the current user’s password
• List roles per procedure

List all users

administrator는 모든 user에 대해서 내용을 확인이 가능합니다.

문법:

CALL dbms.security.listUsers()

결과값:

예외:

+---------------------------------------------------------------------+
| username | roles                     | flags                        |
+---------------------------------------------------------------------+
| "neo4j"  | ["admin"]                 | []                           |
| "anne"   | []                        | ["password_change_required"] |
| "bill"   | ["reader"]                | ["is_suspended"]             |
| "john"   | ["architect","publisher"] | []                           |
+---------------------------------------------------------------------+
4 rows

List all roles

administrator는 시스템의 각 역할에 대해 할당 된 모든 사용자를 볼 수 있습니다.

문법:

CALL dbms.security.listRoles()

결과값:

예외:

+------------------------------+
| role        | users          |
+------------------------------+
| "reader"    | ["bill"]       |
| "architect" | []             |
| "admin"     | ["neo4j"]      |
| "publisher" | ["john","bob"] |
+------------------------------+
4 rows

List all roles for a user

active user는 할당 된 roles을 모두 볼 수 있습니다. administrator는 시스템의 모든 user에 대해 할당 된 모든 역할을 볼 수 있습니다.

문법:

CALL dbms.security.listRolesForUser(*username*)

인수:

결과값:

예외:

고려사항:

• 현재 사용자가 관리자인지 여부에 관계없이 이 절차는 현재 사용자가 자신의 역할을 보기 위해 호출 할 수 있습니다.
• 관리자가 이 절차를 호출하여 다른 사용자의 역할을 볼 수 있습니다.

+-------------+
| value       |
+-------------+
| "reader"    |
| "publisher" |
+-------------+
2 rows

List all users for a role

administrator는 roles에 대해 할당 된 모든 user를 볼 수 있습니다.

문법:

CALL dbms.security.listUsersForRole(*roleName*)

인수:

결과값:

예외:

+--------+
| value  |
+--------+
| "bill" |
| "anne" |
+--------+
2 rows

Create a user

administrator는 새 user를 만들 수 있습니다. 이 작업은 사용자에게 roles을 할당하여 수행해야합니다. 설명은 여기를 참조하세요.

문법:

CALL dbms.security.createUser(*username*, *password*, *requirePasswordChange*)

인수:

예외:

Delete a user

An administrator is able to delete permanently a user from the system. It is not possible to undo this action, so, if in any doubt, consider suspending the user instead.

문법:

CALL dbms.security.deleteUser(*username*)

인수:

예외:

고려사항:

• It is not necessary to remove any assigned roles from the user prior to deleting the user.
• Deleting a user will terminate with immediate effect all of the user’s sessions and roll back any running transactions.
• As it is not possible for the current user to delete themselves, there will always be at least one administrator in the system.

Assign a role to a user

An administrator is able to assign a role to any user in the system, thus allowing the user to perform a series of actions upon the data.

문법:

CALL dbms.security.addRoleToUser(*roleName*, *username*)

인수:

예외:

고려사항:

• This is an idempotent procedure.

Remove a role from a user

An administrator is able to remove a role from any user in the system, thus preventing the user from performing upon the data any actions prescribed by the role.

문법:

CALL dbms.security.removeRoleFromUser(*roleName*, *username*)

인수:

예외:

고려사항:

• If the username is that of the current user and the role name provided is admin, an error will be thrown; i.e. the current user may not be demoted from being an administrator.
• As it is not possible for the current user to remove the admin role from themselves, there will always be at least one administrator in the system.
• This is an idempotent procedure.

Create a custom role

An administrator is able to create custom roles in the system.

문법:

CALL dbms.security.createRole(*roleName*)

인수:

예외:

Delete a custom role

An administrator is able to delete custom roles from the system. The native roles reader, publisher, architect, and admin (see Section 7.1.4.1, “Native roles”) cannot be deleted.

문법:

CALL dbms.security.deleteRole(*roleName*)

인수:

예외:

고려사항:

• Any role assignments will be removed.

Suspend a user

An administrator is able to suspend a user from the system. The suspended user may be activated at a later stage.

문법:

CALL dbms.security.suspendUser(*username*)

인수:

예외:

고려사항:

• Suspending a user will terminate with immediate effect all of the user’s sessions and roll back any running transactions.
• All of the suspended user’s attributes — assigned roles and password — will remain intact.
• A suspended user will not be able to log on to the system.
• As it is not possible for the current user to suspend themselves, there will always be at least one active administrator in the system.
• This is an idempotent procedure.

Activate a user

An administrator is able to activate a suspended user so that the user is once again able to access the data in their original capacity.

문법:

CALL dbms.security.activateUser(*username*, *requirePasswordChange*)

인수:

예외:

고려사항:

• This is an idempotent procedure.

Change a user’s password

An administrator is able to change the password of any user within the system. Alternatively, the current user may change their own password.

문법:

CALL dbms.security.changeUserPassword(*username*, *newPassword*, *requirePasswordChange*)

인수:

예외:

고려사항:

• This procedure may be invoked by the current user to change their own password, irrespective of whether or not the current user is an administrator.
• This procedure may be invoked by an administrator to change another user’s password.
• In addition to changing the user’s password, this will terminate with immediate effect all of the user’s sessions and roll back any running transactions.

예제 7.13. Change a user’s password

The following example changes the password of the user with the username 'joebloggs' to 'h6u4%kr'. When the user 'joebloggs' next logs in, he will be required to change his password.

CALL dbms.security.changeUserPassword('joebloggs', 'h6u4%kr')

Change the current user’s password

Any active user is able to change their own password at any time.

문법:

CALL dbms.security.changePassword(*password*, *requirePasswordChange*)

인수:

예외:

List roles per procedure

Any active user is able to view all procedures in the system, including which role(s) have the privilege to execute them.

문법:

CALL dbms.procedures()

결과값:

CALL dbms.procedures()
YIELD name, signature, description, roles
WITH name, description, roles
WHERE name contains 'security'
RETURN name, description, roles
ORDER BY name
LIMIT 4
+--------------------------------------------------------------------------------------------------------------+
|name                              |description                          |roles                                |
+--------------------------------------------------------------------------------------------------------------+
|"dbms.security.activateUser"      |"Activate a suspended user."         | ["admin"]                           |
|"dbms.security.addRoleToUser"     |"Assign a role to the user."         | ["admin"]                           |
|"dbms.security.changePassword"    |"Change the current user's password."| ["reader","editor","publisher", ... |
|"dbms.security.changeUserPassword"|"Change the given user's password."  | ["admin"]                           |
+--------------------------------------------------------------------------------------------------------------+
4 rows