[
https://issues.apache.org/jira/browse/CASSANDRA-1237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12893730#action_12893730
]
Eric Evans commented on CASSANDRA-1237:
---------------------------------------
bq. ...the reasoning behind this ticket is that backends like PAM aren't
designed to provide storage for permissions.
PAM is a bad example here, and there are plenty of other (more relevant)
services and frameworks that do, (think LDAP, radius, tacacs, etc).
bq. I think that would be a mistake, without a working backend that filled the
interface.
Right, you'd need at least the equivalent of SimpleAuthenticator.
bq. Then, imagine how that backend might fill that interface, and I expect
you'll come up with either storing the permissions in their own Keyspace,
storing them in a backend specific manner, or attaching them as metadata to the
keyspace. The first option is an alternative that should only be implemented
once, and therefore shouldn't have an interface. The second could be handled by
the IAuthenticator, and is what we have now. The third option is what is
implemented here.
If authorization should be pluggable (I've argued that is should be), then
"backend specific" is the only option that makes sense.
> Store AccessLevels externally to IAuthenticator
> -----------------------------------------------
>
> Key: CASSANDRA-1237
> URL: https://issues.apache.org/jira/browse/CASSANDRA-1237
> Project: Cassandra
> Issue Type: Bug
> Components: Core
> Reporter: Stu Hood
> Assignee: Stu Hood
> Fix For: 0.7 beta 1
>
> Attachments:
> 0001-Consolidate-KSMetaData-mutations-into-copy-methods.patch,
> 0002-Thrift-and-Avro-interface-changes.patch,
> 0003-Add-user-and-group-access-maps-to-Keyspace-metadata.patch,
> 0004-Remove-AccessLevel-return-value-from-login-and-retur.patch,
> 0005-Move-per-thread-state-into-a-ClientState-object-1-pe.patch,
> 0006-Apply-access.properties-to-keyspaces-during-an-upgra.patch,
> sample-usage.patch
>
>
> Currently, the concept of authentication (proving the identity of a user) is
> mixed up with permissions (determining whether a user is able to
> create/read/write databases). Rather than determining the permissions that a
> user has, the IAuthenticator should only be capable of authenticating a user,
> and permissions (specifically, an AccessLevel) should be stored consistently
> by Cassandra.
> The primary goal of this ticket is to separate AccessLevels from
> IAuthenticators, and to persist a map of User->AccessLevel along with:
> * EDIT: Separating the addition of 'global scope' permissions into a separate
> ticket
> * each keyspace, where the AccessLevel continues to have its current meaning
> ----
> In separate tickets, we would like to improve the AccessLevel structure so
> that it can store role/permission bits independently, rather than being level
> based.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
