Security functions
Cypher 25 only

Security functions are used to evaluate user attributes in the condition of an attribute-based access control (ABAC) auth rule.

The functions on this page cannot be called directly in queries. They can only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command. For more information about defining auth rules and more extensive examples, see Operations Manual → Attribute-based access control.

abac.native.user_tags()
Cypher 25 onlyIntroduced in Neo4j 2026.06

Details

Syntax

abac.native.user_tags()

Description

Returns the list of tags for the native user.

Returns

LIST<STRING>
Considerations

abac.native.user_tags() cannot be called directly in queries. Prior to Neo4j 2026.10 it could only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command.

As of Neo4j 2026.10, abac.native.user_tags() can also be used in an IN predicate of the WHERE clause of a property-based privilege GRANT command, in addition to its existing use in auth rule conditions. This allows a single privilege to grant different users different data access based on their tags, as long as the native provider is configured for ABAC. For more information, see the Operations Manual → Grant a property-based privilege using native user tags.

The function returns an empty list if the user has no tags.

When evaluating the function in conjunction with external authentication, the function will return an empty list if the native user is not found (unless dbms.security.require_local_user is set to true, in which case the absence of a native user will prevent the user from authenticating).
Example 1. abac.native.user_tags()

The following auth rule grants its role when the native user has the admin tag.

Grant a role using native user tags
CREATE AUTH RULE nativeAdminRule
SET CONDITION 'admin' IN abac.native.user_tags()
Grant a property-based privilege using native user tags
GRANT READ {*} ON GRAPH * FOR (n:Document)
WHERE n.classification IN abac.native.user_tags() TO regularUsers

abac.oidc.user_attribute()
Cypher 25 onlyIntroduced in Neo4j 2026.03

Details

Syntax

abac.oidc.user_attribute(claimKey)

Description

Returns the value of the specified user attribute from the OIDC claims. Returns null if the attribute is not present.

Arguments

Name

Type

Description

claimKey

STRING

The key of the OIDC claim whose value is returned.

Returns

ANY
Considerations

abac.oidc.user_attribute() cannot be called directly in queries. It can only be used in the condition of a CREATE AUTH RULE or ALTER AUTH RULE command.

The returned value can be an arbitrarily nested map object that represents the value of the user’s claimKey claim.

null is returned if the specified attribute is not present in the user’s OIDC claims.
Example 2. abac.oidc.user_attribute()

The following auth rule grants its role when the department claim in the user’s OIDC token is equal to sales.

Query
CREATE AUTH RULE salesRule
SET CONDITION abac.oidc.user_attribute('department') = 'sales'