Overall, the proposal looks good. I have the following implementation-related question: Today, one TCP connection → one ClientState → one AuthenticatedUser for the connection's lifetime, shared across all concurrently in-flight requests (multiplexed by stream ID). With the proposal, a single connection can carry concurrent requests for different target identities. Is the target identity resolved per-request without ever mutating the shared ClientState, or could two concurrent requests race and cross-contaminate each other's effective identity?
Jaydeep On Fri, Jul 24, 2026 at 2:38 PM David Capwell <[email protected]> wrote: > Hi everyone, > > We'd like to propose CEP-64: Proxy Execution Support [1] for adoption > by the community. This feature adds a new PROXY permission to > Cassandra which allows operators to give permission to impersonate > different users. > > Proxy architectures are now a standard part of modern Cassandra > deployments, yet today they force operators into an unacceptable > choice: forward raw end-user credentials (creating leakage risk and > breaking with mTLS/SSO), or collapse everyone into a single service > account (losing per-user authorization and meaningful audit trails). > Neither option supports production requirements for both a proxy layer > and genuine per-user access control. > > This CEP closes that gap by letting a trusted proxy role execute > requests on behalf of specific end-users, with Cassandra enforcing the > target user's permissions and recording both the proxy and > effective-user identities. The result is the operational benefits of > proxies — simplified connectivity, topology hiding, transparent > migrations — without sacrificing security or auditability. > > The CEP is linked here: > > https://cwiki.apache.org/confluence/spaces/CASSANDRA/pages/440305049/CEP-64+Proxy+Execution+Support > > Looking forward to the discussion of this CEP here on the dev list. > > Thanks! > > [1] > https://cwiki.apache.org/confluence/spaces/CASSANDRA/pages/440305049/CEP-64+Proxy+Execution+Support >
