[
https://issues.apache.org/jira/browse/CASSANDRA-21334?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110198#comment-18110198
]
Bohdan Siryk commented on CASSANDRA-21334:
------------------------------------------
I tried to add experimental support for this CEP to Go driver, and I spotted a
couple of things that are worth noting:
1. According to the CEP server should expect a string list of supported
authenticators by a client, but current implementation of the server expects a
list with a single string that should contain comma separated auth classes (1).
It is never mentioned in the CEP so this should be change.
2. Authentication negotiation process goes not through *authentication classes*
passed to STARTUP message, but *authentication modes* (2). I went through CEP,
but I didn't find any details - my understanding is that the driver should send
STARTUP message with AUTHENTICATORS = ["AuthClass1.class", "AuthClass2.class",
...] and a server choose preferred. Authentication mode is a mean for
observability to determine which authentication mechanism was used to
authenticate a client if authenticator supports multiple authentication modes
(e.g. MutualTlsWithPasswordFallbackAuthenticator). So, my question is this
intended to rely on auth mode instead of an auth class? If so, then why do we
have to rely on this? Doesn't this feature supposed to replace authenticators
with built-in fallback authentication mechanisms like
MutualTlsWithPasswordFallbackAuthenticator?
(1) -
https://github.com/jcshepherd/cassandra-trunk/blob/ca72b2e79cec8424450340c31dc65ceb0b492fab/src/java/org/apache/cassandra/transport/messages/StartupMessage.java#L141
(2) -
https://github.com/jcshepherd/cassandra-trunk/blob/ca72b2e79cec8424450340c31dc65ceb0b492fab/src/java/org/apache/cassandra/auth/AuthenticatorNegotiator.java#L49-L70
> Server negotiates authenticator per client connection
> -----------------------------------------------------
>
> Key: CASSANDRA-21334
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21334
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: Legacy/Core
> Reporter: Joel Shepherd
> Assignee: Joel Shepherd
> Priority: Normal
> Fix For: 7.x
>
>
> This is the main server-side implementation of CEP-50, enabling users to
> configure authentication negotiation and the server to negotiation an
> authenticator with the client for each connection, while allowing clients
> that don't support authentication to connect as they always have.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
