SQL Command : List users

[ExtReMLapin]

Hello,

As of right now, we use arcadedb's user system, when you login into our app, you actually log into arcadedb.

What would be nice is to have a command to list existing users (with or without root, idk).

We right now read the users JSONL file which is kind of dirty.

Also cypher has this : https://neo4j.com/docs/operations-manual/current/authentication-authorization/manage-users/

[lvca]

I'd like to implement cypher commands for user list and mgmt. This should work only when running on a server, so we have the security plugin (users/permissions) available.

[gramian]

Also, such a statement, even though idempotent, should be treated as non-idempotent command due to security considerations.

Postgres on the other hand has a system table (view) holding user names, i.e. pg_catalog.pg_user, so one gets all user names via SELECT FROM pg_catalog.pg_user.

[lvca]

Implemented. We're lucky, Neo4j has users per server, not per database, so it's similar to ArcadeDB. @gramian the commands SHOW USERS and SHOW CURRENT USER are idempotent now. What's the risk?

[gramian]

Why would any database user need to see all user names? This info is only relevant to an admin. Even the SHOW CURRENT USER could be problematic as now the query language reports user metadata, not the metadata wrapper.

However, it doesn't make any sense to restrict these commands if they are free for all in OpenCypher.

[lvca]

I agree. Perhaps these commands can be executed only by users with privileges, like root. Let me see a clean way to do this.

[lvca]

SHOW CURRENT USER remains accessible to all users since it only reveals the caller's own identity (consistent with Neo4j behavior and common security principles). All other user management commands require the updateSecurity permission, which is granted to the admin group in the default server configuration.