Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security #539

Open
wants to merge 7 commits into
base: console
Choose a base branch
from
Open

Security #539

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9254365
wip
AlexicaWright Nov 20, 2024
73360da
first stab on auto connect and predefined roles
AlexicaWright Nov 21, 2024
43e0b4e
update
AlexicaWright Nov 21, 2024
e3cf68f
add start of table
AlexicaWright Nov 21, 2024
b415b83
update tables
AlexicaWright Nov 26, 2024
ee289ef
added to table
AlexicaWright Nov 27, 2024
5c3fb4c
more stuff
AlexicaWright Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions modules/ROOT/content-nav.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,6 @@ Generic Start
** xref:managing-instances/migration-readiness.adoc[Migration Readiness Report]
** xref:managing-instances/develop.adoc[Develop]

//(tapping on resources will take you to the metrics tab, and then I fully document the metrics tab further down and I link to that in my notes)

* **Import data**
** xref:import/introduction.adoc[What is Import?]
** xref:import/visual-tour.adoc[Visual tour]
Expand Down Expand Up @@ -70,6 +68,9 @@ Generic Start
// ** xref:logging/log-forwarding.adoc[Security log forwarding]
** xref:logging/query-log-analyzer.adoc[Query log analyzer]

* **Security**
** xref:security/tool-auth.adoc[Tool authentication]

* **Manage users**
** xref:user-management.adoc[]

Expand Down
20 changes: 10 additions & 10 deletions modules/ROOT/pages/getting-started/quick-start-guide.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,20 +104,20 @@ Use the *Import* button and select the _.csv_ file you downloaded from Workspace
[.shadow]
image::import-saved-cypher.png[width=400]

// === Perspectives
=== Perspectives

// Perspectives, except for the default Perspective (which is automatically re-created in the new console), can be exported from the Perspective drawer in Workspace.
// Use the *Export* option on the Perspective you want to save.
// It is exported as a _.json_ file.
Perspectives, except for the default Perspective (which is automatically re-created in the new console), can be exported from the Perspective drawer in Workspace.
Use the *Export* option on the Perspective you want to save.
It is exported as a _.json_ file.

// [.shadow]
// image::export-perspective.png[width=300]
[.shadow]
image::export-perspective.png[width=300]

// In the new console, navigate to the *Explore* tab and open the *Perspective* drawer.
// Use the *Import* option and select the _.json_ file you downloaded from Workspace.
In the new console, navigate to the *Explore* tab and open the *Perspective* drawer.
Use the *Import* option and select the _.json_ file you downloaded from Workspace.

// [.shadow]
// image::import-perspective.png[width=600]
[.shadow]
image::import-perspective.png[width=600]



Expand Down
0 ...T/pages/platform/security/encryption.adoc → modules/ROOT/pages/security/encryption.adoc
View file
Open in desktop
File renamed without changes.
0 ...platform/security/secure-connections.adoc → ...OT/pages/security/secure-connections.adoc
View file
Open in desktop
File renamed without changes.
0 ...ges/platform/security/single-sign-on.adoc → ...s/ROOT/pages/security/single-sign-on.adoc
View file
Open in desktop
File renamed without changes.
15 changes: 15 additions & 0 deletions modules/ROOT/pages/security/tool-auth.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
[[tool-auth]]
= Tool authentication
:description: This section describes the seamless tool authentication functionality in AuraDB.

Organization admins can allow users in a project to connect seamlessly to a project and the instances within it.

This feature can be enabled and configured from the Org settings.

As an Org admin, you maintain access control of all projects within the organization.
You can select which projects and instances users can connect seamlessly to and which they should be required to use username and password to connect to.

To prevent unauthorized access and allow Project admins full access control, the authentication is used in conjunction with predefined roles with varying levels of access to the database.

This means that Project admins assign roles to the users that grants them seamless connection to the project and its instances as well as certain privileges to the databases there.
See xref:user-management.adoc#roles[User management - Roles] for more information.
182 changes: 163 additions & 19 deletions modules/ROOT/pages/user-management.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ image::inviteusers.png[]

Grant users access to a project.

The project you're currently viewing is displayed in the header of the console.
The project you're currently viewing is displayed in the header of the console.
You can select the project name to open the project dropdown menu, allowing you to view all the projects that you have access to and switch between them.

Additionally, you can perform the following actions from the *Project Settings* page.
Expand All @@ -24,43 +24,187 @@ You can access the **Settings** page by selecting **Settings** from the sidebar

Each project can have multiple users with individual accounts allowing access to the same environment.

The users with access to a project can be viewed and managed from the **Users** page.
The users with access to a project can be viewed and managed from the **Users** page.
You can access the **Users** page by selecting **Users** from the sidebar menu of the console.

=== Roles
[[roles]]
== Roles

Users within a project can be assigned one of the following roles:
Users within a project can be assigned one of the following predefined roles:

* _Project Admin_
* _Project Member_
* _Project Viewer_
* _Project Metrics Integration Reader_

These roles grant the users certain privileges both on the console level as well as on the instance level.
The roles are immutable and every new user needs to be assigned one.

:check-mark: icon:check[]

.Roles
.Roles and console capabilities
[opts="header",cols="3,1,1,1"]
|===
| Capability | Admin | Member | Viewer
| Capability | Viewer | Member | Admin
| View users and their roles | {check-mark} | {check-mark} | {check-mark}
| View and open instances | {check-mark} | {check-mark} | {check-mark}
| Access the Neo4j Customer Support Portal | {check-mark} | {check-mark} | {check-mark}
| Perform all actions on instances footnote:[Actions include creating, deleting, pausing, resuming, and editing instances.] | {check-mark} | {check-mark} |
| Clone data to new and existing instances | {check-mark} | {check-mark} |
| Take on-demand snapshots | {check-mark} | {check-mark} |
| Restore from snapshots | {check-mark} | {check-mark} |
| Edit the project name | {check-mark} | |
| Invite new users to the project | {check-mark} | |
| Edit existing users' roles | {check-mark} | |
| Delete existing users from the project | {check-mark} | |
| View and edit billing information | {check-mark} | |
| Access the Neo4j Customer Support Portal | {check-mark} | {check-mark} | {check-mark}
| Perform all actions on instances footnote:[Actions include creating, deleting, pausing, resuming, and editing instances.] | | {check-mark} | {check-mark}
| Clone data to new and existing instances | | {check-mark} | {check-mark}
| Take on-demand snapshots | | {check-mark} | {check-mark}
| Restore from snapshots | | {check-mark} | {check-mark}
| Edit the project name | | | {check-mark}
| Invite new users to the project | | | {check-mark}
| Edit existing users' roles | | | {check-mark}
| Delete existing users from the project | | | {check-mark}
| View and edit billing information | | | {check-mark}
|===

[NOTE]
====
Each project must have at least one Project Admin, but it is also possible for projects to have multiple Project Admins.
====

Additionally, predefined roles are assigned certain privileges on the instance level as well.

.Roles and database privileges
[options="header", cols="3,1,1,1,1,1"]
|===
| Privilege
| Viewer
| Member
| Admin Free
| Admin Pro
| Admin BC
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is Admin BC widely used in this part of the docs? Or do you think it would be better to expand it?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, I put that there mainly for brevity, but should probably write that out, space permitting.


| Access to database
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| List constraints
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Create constraints
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}


| Delete constraints
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| List indexes
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Create indexes
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Delete indexes
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Find nodes and relationships and read their properties
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Load external data in queries
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Write to the graph
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| Name management for node labels, relationship types, and property names.
|
| {check-mark}
| {check-mark}
| {check-mark}
| {check-mark}

| List and end transactions for specified users on the database
|
|
| {check-mark}
| {check-mark}
| {check-mark}

| List, create, delete, and modify users.
|
|
|
| {check-mark}
| {check-mark}

| List roles
|
|
|
| {check-mark}
| {check-mark}

| Create roles
|
|
|
|
| {check-mark}

| Assign roles
|
|
|
| {check-mark}
| {check-mark}

| Rename roles
|
|
|
|
| {check-mark}

| Remove roles
|
|
|
| {check-mark}
| {check-mark}
|===

=== Inviting users

As an _Admin_, to invite a new user:
Expand Down Expand Up @@ -98,13 +242,13 @@ As an _Admin_, to delete an existing user:

=== Accepting an invite

When invited to a project, you will receive an email with a link to accept the invite.
When invited to a project, you will receive an email with a link to accept the invite.
This link will direct you to the Aura console, where a **Project invitation** modal will appear.
You can select the project(s) you have been invited to and choose to accept or decline the invite(s).
You can select the project(s) you have been invited to and choose to accept or decline the invite(s).

// You can also close the **Project invitation** modal without accepting or declining the invite(s) and later manually re-open the modal by selecting the **Pending invites** envelope icon in the console header.

[TIP]
====
User management within the Aura console does not replace built-in roles or fine-grained RBAC at the database level.
User management within the Aura console does not replace built-in roles or fine-grained RBAC at the database level.
====