[
https://issues.apache.org/jira/browse/CASSANDRA-21334?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111051#comment-18111051
]
Bohdan Siryk commented on CASSANDRA-21334:
------------------------------------------
Hi [~jshepherd], thanks for your response. Now I see what's the point - a
possibility to use a custom improved implementation of an auth method in C*
without breaking clients. It sounds good.
However, as you mentioned, the AUTHENTICATE response still contains the class
name of the selected authenticator. This means that when a driver is configured
with multiple authentication mechanisms, it would still need to somehow map the
class names returned by the server to the corresponding client-side
authenticator implementations. In other words, the driver is still tied to
server implementation details (class names).
It would be good if the server could explicitly provide the mapping between its
authentication mechanisms and authentication modes. Something like this
SUPPORTED = { 'AUTHENTICATORS' = ['MutualTLS:MutualTlsAuthenticator',
'Password:org.example.auth.CustomPasswordAuthenticator'] }. The driver could
then parse this information and determine the mapping between the client-side
authentication mechanisms it supports and the corresponding server-side
implementations. But this would expose what authenticators are configured on a
server side.
Also, I was thinking about making a server to return an authentication mode in
AUTHENTICATE response when authentication negotiation is supported by both
server and client, but this might break existing authenticator implementations
on a client side that somehow validates returned authenticator class like Go
driver does for example.
> Server negotiates authenticator per client connection
> -----------------------------------------------------
>
> Key: CASSANDRA-21334
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21334
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: Legacy/Core
> Reporter: Joel Shepherd
> Assignee: Joel Shepherd
> Priority: Normal
> Fix For: 7.x
>
>
> This is the main server-side implementation of CEP-50, enabling users to
> configure authentication negotiation and the server to negotiation an
> authenticator with the client for each connection, while allowing clients
> that don't support authentication to connect as they always have.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
