search

neo4j / neo4j-go-driver

Neo4j Bolt Driver for Go
Apache License 2.0
490 stars 69 forks source link

ADR 024: mTLS for 2FA #573

Closed StephenCathcart closed 6 months ago

StephenCathcart commented 6 months ago

Enables mutual TLS for 2-factor authentication.

Static client certificate provider:

password := "thepassword1"
provider, err := auth.NewStaticClientCertificateProvider(auth.ClientCertificate{
    CertFile: "path/to/cert.pem",
    KeyFile:  "path/to/key.pem",
    Password: &password,
})
if err != nil {
    log.Fatalf("Failed to load certificate: %v", err)
}
_, _ = neo4j.NewDriverWithContext("bolt://localhost:7687", neo4j.BasicAuth("neo4j", "password", ""), func(config *config.Config) {
    config.ClientCertificateProvider = provider
})

Rotating client certificate provider:

password := "thepassword1"
provider, err := auth.NewRotatingClientCertificateProvider(auth.ClientCertificate{
    CertFile: "path/to/cert.pem",
    KeyFile:  "path/to/key.pem",
    Password: &password,
})
if err != nil {
    log.Fatalf("Failed to load certificate: %v", err)
}
_, _ = neo4j.NewDriverWithContext("bolt://localhost:7687", neo4j.BasicAuth("neo4j", "password", ""), func(config *config.Config) {
    config.ClientCertificateProvider = provider
})
// Some time later we update the certificate
provider.UpdateCertificate(auth.ClientCertificate{
    CertFile: "path/to/new_cert.pem",
    KeyFile:  "path/to/new_key.pem",
    Password: &password,
})
StephenCathcart commented 6 months ago

[Go] mTLS as second factor driver implementations