Neo4j Role-Based Access: Missing Password Expiration Enforcement

Role-Based Access Control in Neo4j

Neo4j 4.x and 5.x expose predefined roles such as read, write, and admin, and allow custom roles to be defined. The goal is to apply least‑privilege authentication while ensuring that users cannot continue to authenticate with a password that has surpassed an acceptable age.

Current Constraints

Passwords are stored internally using PBKDF2 and the internal user store offers no configuration flag to enforce password expiration. Authentication failures are logged, but the engine does not revoke roles or terminate sessions when a password becomes stale. Consequently, administrators must rely on manual password changes or auxiliary scripts to enforce expiry.

Unresolved Decision Points

To implement expiry logic, one could augment the internal store with a custom table that records password_last_set timestamps, or create a stored procedure that throws an error when a login attempt occurs with an outdated password. Each approach introduces trade‑offs: additional storage, query overhead, and potential gaps if external tooling is not kept current. Moreover, it is unclear whether future Neo4j releases will add native support for password expiration.

Questions

1. Which mechanisms can be used to track and enforce password age in Neo4j 5.x?
2. Which custom procedures can reject expired credentials during login?
3. Can expiry checks be integrated into the authentication pipeline without relying on external tools?