# python-neo4j-utils (users)

## Overview

This script provides functionality to create/delete users, as well as to backup Neo4j native user and role files to S3 using a configurable set of parameters.

## Workflow

The script has functional defaults, but you may want to adjust the following parameters:

### Environment Variables
```
* Environment
* NEO4J_BACKUP_S3_BUCKET
* NEO4J_CLUSTER_DNS_NAME
* SERVICE_NAME
```

### Command-Line Arguments
```
* -a (action): create, addrole, delete, resetpassword
* -r (role): Neo4j role being assigned to user
* -u (user): name of user being created/deleted
# -n (newname): new name for user being renamed
```

where role is one of built-in roles: reader, editor, publisher, architect, admin

## Usage
```
python manage_neo4j_users.py -a create -u <username> -r <role>
python manage_neo4j_users.py -a delete -u <username>
python manage_neo4j_users.py -a resetpassword -u <username>
python manage_neo4j_users.py -a addrole -u <username> -r <role>
python manage_neo4j_users.py -a rename -u <username> -n <new_username>
``` 

## Secrets

By using the [Orchard's secrets manager wrapper library](https://github.com/theorchard/python-secrets-manager), we bind the script to hard formatting with respect to secret locations. Since the syntax always follows `${env}/${service_name}/SECRET_NAME`, adjust the `SERVICE_NAME` variable if you want to retrieve Neo4j secrets from another location.

All sensitive variables come from this secrets manager location, including the following:

```
* NEO4J_BACKUP_KMS_KEY_ID
* NEO4J_BACKUP_SSH_PRIVATE_KEY
* NEO4J_BACKUP_SSH_USER
* NEO4J_CONNECTION_USER
* NEO4J_CONNECTION_PASSWORD
```

## Backup

The backup component of this script uses SFTP to copy, archive, and upload user and roles files via key-based authentication. Ensure that SSH keys are correctly added to the destination cluster nodes.

These local backups are uploaded to a programmatically derived S3 location, of `NEO4J_BACKUP_S3_BUCKET/NEO4J_BACKUP_S3_PREFIX/NEO4J_CLUSTER_DNS_NAME.tar.gz`, using a KMS key ID stored in secrets manager. Ensure that object versioning is enabled in the destination S3 bucket, since the object name (deliberately) remains the same.

Set NEO4J_BACKUP_S3_BUCKET to control the destination bucket.