Users, roles and TLS

With --users FILE, clients log in with a user name and password: HTTP Basic authentication (Authorization: Basic …) or Bolt's basic scheme. A --token still works alongside, as an administrator. The file keeps PBKDF2-HMAC-SHA-256 hashes (600,000 rounds, random salts); a missing file is created on the first change.

# the first administrator, offline (password from GRAPHBUFF_PASSWORD or standard input)
graphbuff-server users users.txt add root admin
graphbuff-server --users users.txt --bolt 127.0.0.1:7687

Each user holds roles; the strongest decides what they may do, checked for every statement (a role granted or revoked applies to open connections at once):

Role	May
`reader`	read queries, `EXPLAIN`, `SHOW DATABASES`, explicit transactions that only read
`editor`	also write data, and create and drop indexes and constraints
`admin`	also create and drop databases, and manage users

A user with no role may only log in, run SHOW CURRENT USER and change their own password. Administrators manage accounts with Neo4j's commands (on the system database over Bolt, or anywhere in auto-commit): CREATE [OR REPLACE] USER name [IF NOT EXISTS] SET [PLAINTEXT] PASSWORD 'pw' | $pw [CHANGE NOT REQUIRED], ALTER USER name SET PASSWORD …, RENAME USER a TO b, DROP USER name [IF EXISTS], GRANT ROLE[S] r, … TO u, …, REVOKE ROLE[S] r FROM u, SHOW USERS, SHOW ROLES; every user may run SHOW CURRENT USER and ALTER CURRENT USER SET PASSWORD FROM 'old' TO 'new'. Explicit HTTP transactions belong to the client that began them. Not supported: custom roles and privileges (GRANT MATCH …), CHANGE REQUIRED, suspended users, home databases.

TLS serves HTTPS and Bolt over TLS (TLS 1.3 and 1.2) on the same ports. It is an optional build feature, with two choices of crypto provider for rustls:

cargo build --release -p graphbuff-server --features tls             # ring (needs a C compiler)
cargo build --release -p graphbuff-server --features tls-rustcrypto  # pure Rust (pre-release)
graphbuff-server --tls-cert cert.pem --tls-key key.pem --bolt 0.0.0.0:7687 --users users.txt

Drivers then connect with bolt+s:// (or bolt+ssc:// for a self-signed certificate). --tls-allow-plain also accepts clients without TLS on the same ports (the first byte tells them apart); without it, plain HTTP requests get a 400 and plain Bolt connections are closed.

Try it on your machine: one command starts the server with the movies graph. Needs Docker.

$ docker run --rm -p 127.0.0.1:7475:7475 -p 127.0.0.1:7687:7687 ghcr.io/janvencl/graphbuff --demo movies

Then follow Getting started.