Operations & Security 

 

Before you can deploy an application to production, ensure that your operational processes are in place and application security is implemented.  

 

This section introduces you to some of the operational readiness considerations you need to know.  As with the other stages of your Onboarding Journey, your Onboarding Manager can help you coordinate engagement with our technical experts:

 

Customer Success Advisory 

• Configuration Best practices

• Technical Health Check

• Pre-Go Live validation review

 

Professional Services

• Free estimate of customer specific services 

Authentication & Authorization

Authentication is the process of verifying the identity of a user. Neo4j supports a number of options for authentication (auth) providers that can perform user and role authentication.  Review the operations manual - Authentication & Authorization for details.

 

Authorization is the process of determining whether a user is allowed to perform a specific action. Authorization is managed using role-based access control (RBAC). RBAC is a method of restricting access to authorized users. It is a way of assigning privileges to roles that are then assigned to users. This simplifies user management, as permissions are assigned to roles rather than to individual users. The roles are defined in terms of their underlying privileges, and they can be modified by adding or removing these access rights using the Cypher commands.  

 

Neo4j provides a set of built-in roles and also allows you to create custom roles with specific privileges. You can also use the sub-graph access control, through which read access to the graph can be limited to specific combinations of labels, relationship types, and properties.

Role Based Access Control (RBAC)

Role-based access control (RBAC) is a method of restricting access to authorized users, by assigning users to specific roles with a particular set of privileges granted to them. Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism. It is possible to grant or deny access, or use a combination of the two. The user will be able to access the resource if they have a GRANT (allowlist) and do not have a DENY (denylist) relevant to that resource. All other combinations of GRANT and DENY will result in the matching path being inaccessible. What this means in practice depends on whether we are talking about a read privilege or a write privilege:

 

Refer to the Role Based Access Control documentation for how to implement RBAC to your project.

 

Monitoring & Metrics Integration - Aura

Monitoring of your Aura instances are conducted on the Aura Console.  Review the Aura documentation for Monitoring, Advanced Metrics & Metrics Integration.

Backup and Restore - Aura

The Backup and Restore functions are available through the Aura Console.  The detailed options for Backup, Export & Restore are described in the Aura Documentation.  Note that we refer to backups as Snapshots of the database.

 

Backup and Restore functions are also available through the Aura API.

 

The retention of your backups are dependent on your subscription level.  Review the documentation for details.  Contact your Onboarding Manager if you have any questions.

Security - Self-Managed

Review the Operations Manual for Security to cover the topics:

• Securing extensions

• SSL Framework

• Browser credentials handling

 

In addition, validate your security configuration by reviewing the Security checklist and ensuring the appropriate level of security for your application after neo4j is deployed.

Performance Configuration and Monitoring - Self-Managed

Review the Operations Manual for Performance to cover the topics:

• Memory configuration — How to configure memory settings for efficient operations.

• Index configuration — How to configure indexes.

• Garbage collector — How to configure the Java Virtual Machine’s garbage collector.

• Bolt thread pool configuration — How to configure the Bolt thread pool.

• Linux file system tuning — How to configure the Linux file system.

• Disks, RAM and other tips — Disks, RAM and other tips.

• Statistics and execution plans — How schema statistics and execution plans affect Cypher query performance.

• Space reuse — Data deletion and storage space reuse.

Backup and Restore - Self-Managed

Review the Operations Manual for Backup & Restore to cover these topics:

• Backup and restore planning — What to consider when designing your backup and restore strategy.

• Backup modes — The supported backup modes.

• Back up an online database — How to back up an online database.

• Aggregate a database backup chain - How to aggregate a backup chain into a single backup.

• Inspect the metadata of a database backup file — How to inspect the metadata of a database backup file.

• Restore a database backup — How to restore a database backup in a live Neo4j deployment.

• Back up an offline database — How to back up an offline database.

• Restore a database dump — How to restore a database dump in a live Neo4j deployment.

• Copy a database store — How to copy data store from an existing database to a new database.

 

Also consider this section regarding Disaster Recovery.

Monitoring & Logs - Self-Managed

Neo4j provides mechanisms for continuous analysis through the output of metrics as well as the inspection and management of currently-executing queries.

 

Logs can be harvested for continuous analysis, or for specific investigations. Facilities are available for producing security event logs as well as query logs. The query management functionality is provided for specific investigations into query performance. Monitoring features are also provided for ad-hoc analysis of a Causal Cluster.

 

Review the Operations Manual for Monitoring to cover these topics:

• Monitor the logs

• Metrics

• Manage queries

• Manage connections

• Manage background jobs

• Monitor the state of individual databases

 

Useful links

• Neo4j Ops Manager  

• Tutorials & Examples