[
https://issues.apache.org/jira/browse/CASSANDRA-1237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12893699#action_12893699
]
Stu Hood commented on CASSANDRA-1237:
-------------------------------------
> the approach of pluggable authenticators to PAM
> we want to push that into the authenticator rather than hard-coding it
> somewhere
I feel like you're mixing up 'authentication' with
'permissions/authorization'... the reasoning behind this ticket is that
backends like PAM aren't designed to provide storage for permissions. Folke's
JAAS example is a great example of authentication (and what he coded will still
apply post 1237), but I haven't seen any JAAS/PAM backends that implement
permissions storage.
> Wouldn't it be reasonable to create another interface (IAuthority or
> whatever) and off-load how access levels are persisted
I think that would be a mistake, without a working backend that filled the
interface. Then, imagine how that backend might fill that interface, and I
expect you'll come up with either storing the permissions in their own
Keyspace, storing them in a backend specific manner, or attaching them as
metadata to the keyspace. The first option is an alternative that should only
be implemented once, and therefore shouldn't have an interface. The second
could be handled by the IAuthenticator, and is what we have now. The third
option is what is implemented here.
> Store AccessLevels externally to IAuthenticator
> -----------------------------------------------
>
> Key: CASSANDRA-1237
> URL: https://issues.apache.org/jira/browse/CASSANDRA-1237
> Project: Cassandra
> Issue Type: Bug
> Components: Core
> Reporter: Stu Hood
> Assignee: Stu Hood
> Fix For: 0.7 beta 1
>
> Attachments:
> 0001-Consolidate-KSMetaData-mutations-into-copy-methods.patch,
> 0002-Thrift-and-Avro-interface-changes.patch,
> 0003-Add-user-and-group-access-maps-to-Keyspace-metadata.patch,
> 0004-Remove-AccessLevel-return-value-from-login-and-retur.patch,
> 0005-Move-per-thread-state-into-a-ClientState-object-1-pe.patch,
> 0006-Apply-access.properties-to-keyspaces-during-an-upgra.patch,
> sample-usage.patch
>
>
> Currently, the concept of authentication (proving the identity of a user) is
> mixed up with permissions (determining whether a user is able to
> create/read/write databases). Rather than determining the permissions that a
> user has, the IAuthenticator should only be capable of authenticating a user,
> and permissions (specifically, an AccessLevel) should be stored consistently
> by Cassandra.
> The primary goal of this ticket is to separate AccessLevels from
> IAuthenticators, and to persist a map of User->AccessLevel along with:
> * EDIT: Separating the addition of 'global scope' permissions into a separate
> ticket
> * each keyspace, where the AccessLevel continues to have its current meaning
> ----
> In separate tickets, we would like to improve the AccessLevel structure so
> that it can store role/permission bits independently, rather than being level
> based.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
