Dynamic & Time-Based Access Control with ABAC, now in Neo4j Aura!

We are pleased to announce that Attribute-Based Access Controls (ABAC) are now available in AuraDB for Business Critical and Virtual Dedicated Cloud tiers.
Key Capabilities
Single Sign-On (SSO) Identity Provider Integration: Dynamically assign RBAC roles based on user claims controlled in your IdP (email
, email_verified
, name
, preferred_username
, groups
).
Native User Tags: Database instance users can be tagged with custom user tags directly in Neo4j AuraDB to enforce dynamic roles without bloating static role mappings.
Time-Based Access Rules: Dynamically grant permissions during specific operational windows using real-time attributes like datetime.transaction().
ABAC User Tags Example
ABAC rules are created directly in AuraDB using the Cypher25 language.
The following example grants the FinancialAuditor RBAC role to native users who are tagged with both finance and auditor:
CREATE ROLE FinancialAuditor;
CREATE AUTH RULE financeAuditorRule SET CONDITION all(tag IN ['finance', 'auditor'] WHERE tag IN abac.native.user_tags());
GRANT ROLE FinancialAuditor TO AUTH RULE financeAuditorRule;
Read the ABAC Documentation for more details on creating and managing dynamic Auth Rules.