Skip to content

Conversation

@bigmontz
Copy link
Contributor

@bigmontz bigmontz commented Aug 9, 2023

⚠️ This API is released as preview.

Currently, the AuthTokenManager is designed to handle token expiration only. The AuthTokenManager interface only has methods to receive notifications on security errors related to token expiration: AuthTokenManager.onTokenExpired. The provided implementation neo4j.expirationBasedAuthTokenManager is built to support only token expiration. However, we also want to cater for password rotation scenarios.

Factory Method Changes

Expiration based and bearer tokens

The method neo4j.expirationBasedAuthTokenManager was renamed and moved to neo4j.authTokenManagers.bearer.

import neo4j, { AuthToken } from 'neo4j-driver'

/**
 * Method called whenever the driver needs to refresh the token.
 *
 * The refresh will happen if the driver is notified by the server
 * about a token expiration or if the `Date.now() > tokenData.expiry`
 *
 * Important, the driver will block all the connections creation until
 * this function resolves the new auth token.
 */
async function fetchAuthTokenFromMyProvider () {
   const bearer: string = await myProvider.getBearerToken()
   const token: AuthToken = neo4j.auth.bearer(bearer)
   const expiration: Date = myProvider.getExpiryDate()  
   return {
      token,
      // if expiration is not provided, 
      // the driver will only fetch a new token when a failure happens
      expiration 
   }
}

const driver = neo4j.driver(
    'neo4j://localhost:7687', 
    neo4j.authTokenManagers.bearer({ 
        tokenProvider: fetchAuthTokenFromMyProvider 
    })
)

Password rotation and basic auth

neo4j.authTokenManagers.basic was added to handle password rotation with AuthTokenManager.

import neo4j, { AuthToken } from 'neo4j-driver'

/**
* Method called whenever the driver needs to refresh the token.
*
* Important, the driver will block all the connections creation until
* this function resolves the new auth token.
*/
async function fetchMyUserAndPassword () {
  const { user, password } = await myProvider.getUserAndPassword()
  return neo4j.auth.basic(user, password)  
}

const driver = neo4j.driver(
   'neo4j://localhost:7687', 
   neo4j.authTokenManagers.basic({ 
       tokenProvider: fetchMyUserAndPassword 
   })
)

Development checklist

  • Update AuthTokenManager interface
  • Change expirationBasedAuthTokenManager factory name to authTokenManagers.bearer
  • Add authTokenManagers.basic factory
  • Adapt testkit-backend

⚠️ This API is released as preview.

@bigmontz bigmontz force-pushed the 5.x-password-rotation branch from bb25000 to 565b0c2 Compare August 10, 2023 12:26
@bigmontz bigmontz marked this pull request as ready for review August 15, 2023 10:57
Currently, the AuthTokenManager is designed to handle token expiration only. The AuthTokenManager interface only has methods to receive notifications on security errors related to token expiration: AuthTokenManager.onTokenExpired.
The provided implementation `neo4j.expirationBasedAuthTokenManager` is built to support only token expiration. However, we also want to cater for password rotation scenarios.
@bigmontz bigmontz force-pushed the 5.x-password-rotation branch from 44b4c5d to a0dd159 Compare August 22, 2023 13:10
@bigmontz bigmontz merged commit 0a1b20e into neo4j:5.0 Aug 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants