[
https://issues.apache.org/jira/browse/CASSANDRA-21334?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110864#comment-18110864
]
Joel Shepherd commented on CASSANDRA-21334:
-------------------------------------------
Hi Bohdan - I'm really excited to hear you're looking at the driver-side work:
thanks for doing that. :)
(1) You're correct; the CEP needs an addendum on that point.
(2) This also needs an addendum, but a debate might be more useful at this
point (nothing is written in stone). As written, the CEP proposes following the
current model where the server AUTHENTICATE message specifies the authn method
to use by passing the driver the fully-qualified class name of the server-side
authenticator, by having the driver and server use fully-qualified class names
for negotiation as well. There are two problems with this: (1) The driver has
an operational dependency on internal implementation details of the server, (2)
From what I could see, most drivers simply ignore the authenticator specified
in AUTHENTICATE and attempt to authenticate with whatever mechanism they're
configured with. Using authentication mode for negotiation somewhat decoupled
negotiation from the server internal details, and also allows for the
possibility of a server using an improved version of its auth method without
disrupting negotiation with the driver. It's a step in a better direction.
However (IIRC) AUTHENTICATE still uses the fully qualified class name for
compatibility, so the client is required to understand both which of its
authenticators map to a given authn mode, and how the server-side authenticator
maps to the one on the driver side (which drivers should have understood
beforehand but for most of them this will be new).
Like I said, I'm happy to debate the approach. It may be adding complexity for
very little added benefit. Happy to take feedback on it.
Thanks – Joel.
> Server negotiates authenticator per client connection
> -----------------------------------------------------
>
> Key: CASSANDRA-21334
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21334
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: Legacy/Core
> Reporter: Joel Shepherd
> Assignee: Joel Shepherd
> Priority: Normal
> Fix For: 7.x
>
>
> This is the main server-side implementation of CEP-50, enabling users to
> configure authentication negotiation and the server to negotiation an
> authenticator with the client for each connection, while allowing clients
> that don't support authentication to connect as they always have.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
