[Feature Request] Ability to refresh auth token

[asarkar]

To help us understand your issue, please specify important details, primarily:

• Neo4j version: AWS Neptune
• Neo4j Mode: N/A
• Driver version: All
• Operating system: Linux

We're using openCypher with AWS Neptune and want to use the neo4j driver with the bolt protocol. We are generating an AWS V4 signature and passing it in as a basic auth to the driver. The request is signed using temporary credentials that expires in 5 minutes.

Unfortunately, it seems that the authentication token is cached at connection creation time.

# Determine auth details
if not auth:
    self.auth_dict = {}
elif isinstance(auth, tuple) and 2 <= len(auth) <= 3:
    from neo4j import Auth
    self.auth_dict = vars(Auth("basic", *auth))
else:
    try:
        self.auth_dict = vars(auth)
    except (KeyError, TypeError):
        raise AuthError("Cannot determine auth details from %r" % auth)

Thus, if the max_connection_lifetime is set to less than 5 minutes, requests start failing after 5 minutes because the signature is no longer valid.

self = <neo4j.io._common.InitResponse object at 0x7f41eb9dc750>
metadata = {'code': '"BoltProtocol.unexpectedException"', 'message': '"Unexpected server exception \'Signature expired: 20221018T003343Z is now earlier than 20221018T003344Z (20221018T003844Z - 5 min.)\'"'}

    def on_failure(self, metadata):
        code = metadata.get("code")
        if code == "Neo.ClientError.Security.Unauthorized":
            raise Neo4jError.hydrate(**metadata)
        else:
            raise ServiceUnavailable(
>               metadata.get("message", "Connection initialisation failed")
            )
E           neo4j.exceptions.ServiceUnavailable: "Unexpected server exception 'Signature expired: 20221018T003343Z is now earlier than 20221018T003344Z (20221018T003844Z - 5 min.)'"

The Javascript driver also has the same issue.

But the Java driver provides a way to avoid this problem by exposing a toMap method, that is called to obtain the token. While the cached token is returned by default, this method can be overridden in a subclass as shown here.

We would like the Python driver to also provide an option not to cache the auth token and regenerate it on demand.

[germangamboa95]

@asarkar we also ran into this issue, and we fixed it by forking and adding support for it in the javascript on neo4j/neo4j-javascript-driver#993

with that said. Neptune is a piece of shit, and I recommend using an excel spreadsheet before trying to go down that path.