[
https://issues.apache.org/jira/browse/CASSSIDECAR-501?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bernardo Botella Corbi updated CASSSIDECAR-501:
-----------------------------------------------
Change Category: Operability
Complexity: Normal
Fix Version/s: 0.5
Priority: Normal (was: Major)
Status: Open (was: Triage Needed)
https://github.com/apache/cassandra-sidecar/pull/386
> Introduce Server-Side Configuration to Enforce Allowed Credential Modes
> -----------------------------------------------------------------------
>
> Key: CASSSIDECAR-501
> URL: https://issues.apache.org/jira/browse/CASSSIDECAR-501
> Project: Sidecar for Apache Cassandra
> Issue Type: Improvement
> Components: Bulk Analytics
> Reporter: Bernardo Botella Corbi
> Assignee: Bernardo Botella Corbi
> Priority: Normal
> Fix For: 0.5
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The Sidecar relies on client-side payload selection for credential types
> (introduced in CASSSIDECAR-415). Cluster operators cannot block users from
> passing insecure STATIC keys if they want to enforce IAM-only configurations
> across a multi-tenant platform.
> The proposal is to add a validation policy config block to sidecar.yaml
> (e.g., allowed_credential_types). If a user attempts to submit a restore job
> with a disabled credential method, the Sidecar server should instantly reject
> it with an HTTP 400 or HTTP 403 error.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
