COPS-569: Show users and roles as commands - #3245
Conversation
OliviaYtterbrink
added
team-cypher-operations
renetapopova
left a comment
renetapopova
left a comment
There was a problem hiding this comment.
Thank you so much, @OliviaYtterbrink! I added some editorial comments and suggestions.
Co-authored-by: Reneta Popova <reneta.popova@neo4j.com>
a56fc65 to
6efafee
Compare
|
This PR includes documentation updates Updated pages: |
|
|
||
| [source, cypher, role=noplay] | ||
| ---- | ||
| SHOW ROLES WITH AUTH RULES AS COMMANDS |
There was a problem hiding this comment.
| SHOW ROLES WITH AUTH RULES AS COMMANDS | |
| SHOW ROLES WITH AUTH RULES AS COMMANDS; |
renetapopova
left a comment
renetapopova
left a comment
There was a problem hiding this comment.
Looks good to me—just one missing semi-colon.
| @@ -392,7 +398,7 @@ a|Rows: 1 | |||
|
|
|||
| == Grant privilege to show users | |||
There was a problem hiding this comment.
we don't want a section like this for the show users as commands? or at least add a sentence in this section that for the AS COMMANDS variant you need SHOW USER CREDENTIALS?
| | Enables the specified roles to list users. | ||
|
|
||
| | [source, syntax, role=noheader] | ||
| GRANT [IMMUTABLE] SHOW USER CREDENTIAL[S] |
There was a problem hiding this comment.
the images on https://neo4j-docs-operations-3245.surge.sh/operations-manual/2026.08/authentication-authorization/dbms-administration/ needs to be updated to include this privilege
|
|
||
| When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. | ||
|
|
||
| label:new[Introduced in 2026.08] When using the `AS COMMAND` clause, the result will be the commands to assign the users to the roles. |
There was a problem hiding this comment.
do we also want to mention here that it is an implicit POPULATED by users filter?
|
|
||
| When using the `RETURN` clause, the `YIELD` clause is mandatory and must not be omitted. | ||
|
|
||
| label:new[Introduced in 2026.08] When using the `AS COMMAND` clause, the result will be the commands to assign the auth rules to the roles. |
There was a problem hiding this comment.
do we also want to mention here that it is an implicit POPULATED by auth rules filter?
| The command produces a row per role per user and yields a member column, in addition to the one returned by `SHOW ROLES AS COMMANDS`, containing the name of the user assigned to the role. | ||
| If a role is assigned to multiple users, it will appear once for each user, and if it is assigned to no users, it will not appear at all. |
There was a problem hiding this comment.
To also cover the YIELD * behaviour.
| The command produces a row per role per user and yields a member column, in addition to the one returned by `SHOW ROLES AS COMMANDS`, containing the name of the user assigned to the role. | |
| If a role is assigned to multiple users, it will appear once for each user, and if it is assigned to no users, it will not appear at all. | |
| The command produces a row per role per user and yields a member column, in addition to the ones returned by `SHOW ROLES AS COMMANDS`, containing the name of the user assigned to the role. | |
| The `member` column is returned by default. | |
| If a role is assigned to multiple users, it will appear once for each user, and if it is assigned to no users, it will not appear at all. |
| | BOOLEAN | ||
| |=== | ||
|
|
||
| === Showing all roles as commands |
There was a problem hiding this comment.
| === Showing all roles as commands | |
| === Showing create role commands |
| +-------------------------+ | ||
| ---- | ||
|
|
||
| === Showing roles with users as commands |
There was a problem hiding this comment.
| === Showing roles with users as commands | |
| === Showing assign user to role commands |
| +--------------------------------------------+ | ||
| ---- | ||
|
|
||
| === Showing roles with auth rules as commands |
There was a problem hiding this comment.
| === Showing roles with auth rules as commands | |
| === Showing assign auth rule to role commands |
| [role=label--new-2026.08 label--cypher-25] | ||
| == Showing users as commands | ||
|
|
||
| To get the commands to create users, use SHOW USERS AS COMMANDS. The command produces a row per user and yields the following column: |
There was a problem hiding this comment.
shouldn't you also show which columns are returned with YIELD *? as I think you have two in the CIP and three in the implementation that is yield-only columns...
|
|
||
| [[access-control-list-user-as-commands]] | ||
| [role=label--new-2026.08 label--cypher-25] | ||
| == Showing users as commands |
There was a problem hiding this comment.
Be aware of clashes with #3206 as that one moves things around in manage-users, so as to not get a weird order when both are merged
and that PR also updates some of the examples and what users are available at this point so these examples might need to be updated as well to match
(I guess it is on whichever of the two that goes in last to do such updates)
4 participants
Goes hand-in-hand with neo4j/docs-cypher#1638