Skip to content

Add the ability to Refresh Auth Token Credentials #891

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Add the ability to Refresh Auth Token Credentials #891

wants to merge 1 commit into from

Conversation

vkagamlyk
Copy link

Add the ability to Refresh Auth Token Credentials

Currently when credentials expire, driver will continue trying to connect with the outdated credentials. There is no ability to update or refresh login credentials (See #834).

This PR introduces the ability to pass an optional credentials_refresher function to an authToken object which will change credentials as they become obsolete.

There are no breaking changes introduced in this PR.

There is a test which uses a simple credentials_refresher to validate that these modifications do not break serialization.

Intended use

auth_token = basic_auth("some_login", "ignored")
auth_token.add_credentials_refresher(credentials_refresher)
self.driver = GraphDatabase.driver(uri, auth=auth_token, encrypted=True)

I'm a first-time contributor and have just signed the CLA

@vkagamlyk vkagamlyk mentioned this pull request Jan 17, 2023
Closed
@robsdedude
Copy link
Member

robsdedude commented Jan 23, 2023 •
edited
Loading

HI and thank you very much for taking the time to work on this PR.

I am really sorry, but I have to close this PR. We've been working on a more general solution for this and other use-cases. There is no estimate yet as to when it will be released but you can see its current state here: #890

This is planned across all official drivers. Again, I'm sorry for this. Consider contacting us before starting to work a feature PR to help avoid such unlucky situations.

Also, for future reference, please check the CONTRIBUTING.md as we have a CLA we need our contributors to sign, as well as a pre-commit set-up specific to the Python driver. No need for any actions right now, but for hopefully future PRs.

@robsdedude robsdedude closed this Jan 23, 2023
@robsdedude robsdedude mentioned this pull request Apr 12, 2023
Merged
robsdedude added a commit that referenced this pull request Apr 12, 2023
@robsdedude
Introduce auth rotation and session auth support (#890)
6002a8c 
# ADR 012: re-authentication

This PR introduces two new auth mechanics for different use-cases
1) Auth Rotation
2) Session Auth (a.k.a. user switching)

**Note that all APIs introduced in this PR are previews**
See https://github.com/neo4j/neo4j-python-driver/wiki/preview-features


## 1) Auth Rotation
This is used for auth tokens that is expected to expire (e.g., SSO).

A `neo4j.auth_management.AuthManager` instance 
(or `neo4j.auth_management.AsyncAuthManager` for async driver) may be passed
to the driver instead of a static auth token.

```python
import neo4j
from neo4j.auth_management import AuthManager


class MyManager(AuthManager):
    ...  # see API dos for details


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687", 
    auth=MyManager(),
) as driver:
    ...
```

The easiest way to get started is using the provided `AuthManager`
implementation. For example:

```python
import neo4j
from neo4j.auth_management import (
    AuthManagers,
    ExpiringAuth,
)


def auth_provider():
    # some way to getting a token
    sso_token = get_sso_token()
    # assume we know our tokens expire every 60 seconds
    expires_in = 60
    return ExpiringAuth(
        auth=neo4j.bearer_auth(sso_token),
        # Include a little buffer so that we fetch a new token
        # *before* the old one expires
        expires_in=expires_in - 10
    )


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687",
    auth=AuthManagers.temporal(auth_provider)
) as driver:
    ... 
```

**Note**  
This API is explicitly *not* designed for switching users.
In fact, the token returned by each manager must always belong to the same
identity. Switching identities using the `AuthManager` is undefined behavior.


## 2) Session Auth
For the purpose of switching users, `Session`s can be configured with a static
auth token. This is very similar to impersonation in that all work in the
session will be executed in the security context of the user associated with
the auth token. The major difference is that impersonation does not require or
verify authentication information of the target user, however it requires
the impersonating user to have the permission to impersonate.

**Note**
This requires Bolt protocol version 5.3 or higher (Neo4j DBMS 5.8+).

```python
import neo4j


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687",
    auth=("user1", "password1"),
) as driver:
    with driver.session(database="neo4j") as session:
        ...  # do some work as user1
    with driver.session(database="neo4j",
                        auth=("user2", "password2")) as session:
        ...  # do some work as user2
```


## References
Depends on:
 * neo4j-drivers/testkit#539

Related PRs:
 * #891

Issues:
 * closes #834
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@vkagamlyk @robsdedude