v5.19.0 - Feedback wanted on mTLS for 2FA

[robsdedude]

mTLS

In version 5.19.0, we introduce mutual TLS (client-side certificates) as a second authentication factor (2FA).

Example Usage

import neo4j
from neo4j.auth_management import (
    ClientCertificateProviders, 
    ClientCertificate,
)


URL = "neo4j+s://localhost:7687"
AUTH = ("neo4j", "pass")


def main():
    cert_provider = ClientCertificateProviders.static(
        ClientCertificate(
            # path to public certificate to load
            "path/to/cert.pem",
            # path to private key to load
            "path/to/key.pem",
            # password to decrypt private key (can be a function or string)
            # see also Python's ssl.SSLContext.load_cert_chain()
            lambda: "password",
        )
    )
    # See the API docs for ClientCertificateProviders.rotating and more details
    # in general.
    
    with neo4j.GraphDatabase.driver(
        URL,
        auth=AUTH,
        client_certificate=cert_provider,
    ) as driver:
        with driver.session() as session:
            result = session.run("RETURN 'now with mTLS 🔒'")
            for record in result:
                print(record)
    

if __name__ == '__main__':
    main()

Feedback wanted

This new API is currently marked as preview. What it means is that we are eagerly waiting for your feedback. Does it work well in your scenario? Do you wish there was more?

Let us know so we can correct course in the next releases!

[robsdedude]

In version 5.24.0, the neo4j.auth_management.RotatingClientCertificateProvider was made an abstract class. This means it can no longer be instantiated directly. Please use the factory method neo4j.auth_management.RotatingClientCertificateProvider.rotating instead.

Analogously for the async APIs.

[robsdedude]

With version 5.27.0, this feature is now stabilized.