ADR 024: mTLS for 2FA

[StephenCathcart]

Enables mutual TLS for 2-factor authentication.

Static client certificate provider:

password := "thepassword1"
provider, err := auth.NewStaticClientCertificateProvider(auth.ClientCertificate{
	CertFile: "path/to/cert.pem",
	KeyFile:  "path/to/key.pem",
	Password: &password,
})
if err != nil {
	log.Fatalf("Failed to load certificate: %v", err)
}
_, _ = neo4j.NewDriverWithContext("bolt://localhost:7687", neo4j.BasicAuth("neo4j", "password", ""), func(config *config.Config) {
	config.ClientCertificateProvider = provider
})

Rotating client certificate provider:

password := "thepassword1"
provider, err := auth.NewRotatingClientCertificateProvider(auth.ClientCertificate{
	CertFile: "path/to/cert.pem",
	KeyFile:  "path/to/key.pem",
	Password: &password,
})
if err != nil {
	log.Fatalf("Failed to load certificate: %v", err)
}
_, _ = neo4j.NewDriverWithContext("bolt://localhost:7687", neo4j.BasicAuth("neo4j", "password", ""), func(config *config.Config) {
	config.ClientCertificateProvider = provider
})
// Some time later we update the certificate
provider.UpdateCertificate(auth.ClientCertificate{
	CertFile: "path/to/new_cert.pem",
	KeyFile:  "path/to/new_key.pem",
	Password: &password,
})

[StephenCathcart]

[Go] mTLS as second factor driver implementations

[robsdedude]

🚂 🔐