Users, Roles, Authentication Providers, Password Policy, and Administrative Separation

Learning outcomes

AtlasMart has one production-shaped mistake before it has a production outage: the order API connects with the same neo4j administrator credential used by engineers. An injection bug, leaked environment file, compromised CI runner or vulnerable procedure would therefore inherit administrative power. Security begins by separating who are you? from what are you allowed to do? and by recognizing that Community and Enterprise expose different authorization mechanisms.

Reproducible AtlasMart setup

$env:NEO4J_URI='bolt://127.0.0.1:7687'$env:NEO4J_USER='neo4j'$env:NEO4J_PASSWORD='atlasmart-course-2026'$env:NEO4J_DATABASE='neo4j'py -3 -m venv .venv.\.venv\Scripts\Activate.ps1python -m pip install --upgrade pippython -m pip install neo4j==6.3.0

CYPHER 25CREATE CONSTRAINT customer_id IF NOT EXISTSFOR (c:Customer) REQUIRE c.customerId IS UNIQUE;CREATE CONSTRAINT product_id IF NOT EXISTSFOR (p:Product) REQUIRE p.productId IS UNIQUE;CREATE CONSTRAINT order_id IF NOT EXISTSFOR (o:Order) REQUIRE o.orderId IS UNIQUE;MERGE (c:Customer {customerId:'C-1001'})SET c.name='Mina Rahimi', c.tier='GOLD', c.tenantId='TENANT-A'MERGE (p:Product {productId:'P-1001'})SET p.name='Trail Camera', p.category='Cameras', p.price=129.90MERGE (o:Order {orderId:'O-5001'})SET o.status='PAID', o.tenantId='TENANT-A', o.orderedAt=datetime('2026-09-08T16:30:00Z')MERGE (c)-[:PLACED]->(o)MERGE (o)-[r:CONTAINS]->(p)SET r.quantity=1, r.unitPrice=129.90;

These are course-only credentials and synthetic records. The fixture deliberately includes tenantId because authorization mistakes often appear when a graph traversal crosses a tenant boundary even though authentication succeeded.

1. Authentication is not authorization

Do not call a Community username “least privilege” merely because it has a different password. It is a separate credential, but the DBMS still grants implied administrator capability.

2. Native user and password controls

CREATE USER atlasmart_app IF NOT EXISTSSET PASSWORD 'atlasmart-app-lab-2026'CHANGE NOT REQUIRED;SHOW USERSYIELD user, passwordChangeRequiredRETURN user, passwordChangeRequiredORDER BY user;

SHOW SETTINGSYIELD name, valueWHERE name IN [  'dbms.security.auth_enabled',  'dbms.security.auth_minimum_password_length',  'dbms.security.auth_max_failed_attempts',  'dbms.security.auth_lock_time']RETURN name, valueORDER BY name;

Current defaults document authentication enabled, minimum password length 8, three failed attempts before lockout and a 5-second lock interval. Defaults are evidence to inspect, not a universal policy recommendation: your organization may need stronger credential controls upstream or stricter values after testing operational effects.

3. Prove authentication failure without damaging the lab

docker exec atlasmart-neo4j cypher-shell `  -a neo4j://localhost:7687 -u atlasmart_app -p atlasmart-app-lab-2026 `  "SHOW CURRENT USER;"docker exec atlasmart-neo4j cypher-shell `  -a neo4j://localhost:7687 -u atlasmart_app -p definitely-wrong `  "RETURN 1;"

The second command should fail authentication. That proves a credential boundary, not least privilege. In Community, SHOW USERS or another administrative operation remains available to the authenticated user because the edition has no role model.

4. Enterprise administrative separation (licensed path)

CREATE ROLE atlasmart_app_role IF NOT EXISTS;CREATE USER atlasmart_service IF NOT EXISTSSET PASSWORD $password CHANGE NOT REQUIRED;GRANT ROLE atlasmart_app_role TO atlasmart_service;GRANT ACCESS ON DATABASE neo4j TO atlasmart_app_role;GRANT MATCH {*} ON GRAPH neo4j  NODES Customer, Product, Order TO atlasmart_app_role;GRANT MATCH {*} ON GRAPH neo4j  RELATIONSHIPS PLACED, CONTAINS TO atlasmart_app_role;SHOW ROLE atlasmart_app_role PRIVILEGES AS COMMANDS;

5. External providers and administrative identity

6. Deliberately wrong: admin credentials in application source

# WRONG — synthetic example onlyfrom neo4j import GraphDatabasedriver = GraphDatabase.driver(    "neo4j://db.example.internal:7687",    auth=("neo4j", "SuperSecretPasswordInGit"))

import osfrom neo4j import GraphDatabaseuri = os.environ["NEO4J_URI"]user = os.environ["NEO4J_USER"]password = os.environ["NEO4J_PASSWORD"]driver = GraphDatabase.driver(uri, auth=(user, password))driver.verify_connectivity()

Environment variables are only a delivery mechanism, not a complete secrets manager. In production, define who can read the process environment, CI variables, container secrets, crash dumps and diagnostics; prefer your platform secret store and rotation workflow.

7. Verification checklist and cleanup

DROP USER atlasmart_app IF EXISTS;

Production judgment

Summary and next step

Identity is the first layer, not the whole security model. Lesson 2 turns the intended AtlasMart behavior into explicit database, graph, label/type and procedure privileges where the tier supports them, while keeping the Community gap visible.

Authoritative references

• Current Neo4j versions — Current server and 5.26 LTS release snapshot.
• Security checklist — Official baseline for deployment, transport, extensions, backup and filesystem security.
• Manage users — Native users, password handling, Community/Enterprise user-model distinctions.
• Role-based access control — Enterprise RBAC model and GRANT/DENY/REVOKE semantics.
• Read privileges — TRAVERSE, READ and MATCH graph privilege semantics.
• Write privileges — CREATE, DELETE, SET, MERGE and WRITE privilege semantics.
• SSL framework — Bolt/HTTPS TLS policies, certificate files, TLS levels and URI schemes.
• Procedure/function privileges — Execute and boosted-execution privilege boundaries.
• Python driver advanced connections — TLS/trust and rotating authentication token support in the maintained Python driver.
• Configuration settings — Authentication enabled, minimum password length and lockout settings.
• User auth providers — Enterprise per-user native/OIDC/LDAP provider model.
• Single sign-on integration — Enterprise OIDC/SSO architecture and configuration.