Neo4j 4 on Aura permissions adjustment due to PUBLIC role

[moxious]

For Neo4j 4 running on Aura, the neo4j user was adjusted to have the role PUBLIC, with some special exceptions. The reasons why this is the case are complicated, but that's how it works.

APOC has some security checks in it (I think) which is causing some functions to fail specifically on Neo4j 4 running on Aura.

Specific example, this succeeds in the "Neo4j 4 on Aura" environment:

CREATE INDEX location_type FOR (l:Location) ON (l.type)

But this fails:

CALL apoc.cypher.doIt("CREATE INDEX whatever FOR (w:Whatever) ON (w.type)", {}) YIELD value RETURN value

Schema operations are not allowed for user 'neo4j' with roles [PUBLIC] restricted to TOKEN_WRITE.

[craigtaverner]

This is due to a security feature introduced in Neo4j 3.1 allowing procedures to run with adjusted security settings, so that Neo4j could provide a kind of fine-grained access control. Now that real fine-grained access control is available in Neo4j 4.0, all that is missing to facilitate the removal of the old mechanism is procedure privileges. There are plans to add these to Neo4j, hopefully soon. Until that happens, Cypher run through a procedure can be affected by the mode of the procedure, as we see here.

[jexp]

@moxious can you clarify with @conker84 what / if we need to do?

[jexp]

We also need to add a apoc.cypher.runSchema() procedure that has Mode.SCHEMA for operations like this.

[jexp]

Probably we should also add an alias apoc.cypher.runWrite for apoc.cypher.doIt

[moxious]

@jexp I don't know what needs to be done, other than adjusting the mode of the procedure as suggested by @craigtaverner . Also not sure if this is something you want to do -- in theory any APOC call which can run Cypher needs every possible permission that the database could grant to a procedure, since you can do pretty much anything with cypher.

Less clear to me is whether apoc.cypher.doIt should work if it's not cypher (are index creations cypher? CREATE USER definitely isn't cypher)

[vga91]

@jexp I created a pr with the procedure apoc.cypher.runSchema.
In addition to the procedure apoc.cypher.doIt, are there any other procedures to add with the analogous Mode.SCHEMA?
The apoc.do.when, for example?