Security functions
Cypher 25 only

Security functions are used to evaluate user attributes in the condition of an attribute-based access control (ABAC) auth rule.

The functions on this page cannot be called directly in queries. They can only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command. For more information about defining auth rules and more extensive examples, see Operations Manual → Attribute-based access control.

abac.native.user_tags()
Cypher 25 onlyIntroduced in Neo4j 2026.06

Details

Syntax

abac.native.user_tags()

Description

Returns the list of tags for the native user.

Returns

LIST<STRING>
Considerations

abac.native.user_tags() cannot be called directly in queries. It can only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command.

The function returns an empty list if the user has no tags.

When evaluating the function in conjunction with external authentication, the function will return an empty list if the native user is not found (unless dbms.security.require_local_user is set to true, in which case the absence of a native user will prevent the user from authenticating).
Example 1. abac.native.user_tags()

The following auth rule grants its role when the native user has the admin tag.

Query
CREATE AUTH RULE nativeAdminRule
SET CONDITION 'admin' IN abac.native.user_tags()

abac.oidc.user_attribute()
Cypher 25 onlyIntroduced in Neo4j 2026.03

Details

Syntax

abac.oidc.user_attribute(claimKey)

Description

Returns the value of the specified user attribute from the OIDC claims. Returns null if the attribute is not present.

Arguments

Name

Type

Description

claimKey

STRING

The key of the OIDC claim whose value is returned.

Returns

ANY
Considerations

abac.oidc.user_attribute() cannot be called directly in queries. It can only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command.

The returned value can be an arbitrarily nested map object that represents the value of the user’s claimKey claim.

null is returned if the specified attribute is not present in the user’s OIDC claims.
Example 2. abac.oidc.user_attribute()

The following auth rule grants its role when the department claim in the user’s OIDC token is equal to sales.

Query
CREATE AUTH RULE salesRule
SET CONDITION abac.oidc.user_attribute('department') = 'sales'