tolbertam commented on code in PR #2969:
URL: https://github.com/apache/cassandra/pull/2969#discussion_r1446255110
##########
src/java/org/apache/cassandra/auth/IAuthenticator.java:
##########
@@ -145,5 +167,18 @@ public interface SaslNegotiator
* @throws AuthenticationException
*/
public AuthenticatedUser getAuthenticatedUser() throws
AuthenticationException;
+
+ /**
+ * Whether its determined if this negotiator requires certificates.
This is used in conjunction with
+ * {@link #supportsEarlyCertificateAuthentication()} in determining if
authentication can be done with
+ * client certificates when handling a Startup message.
+ *
+ * If <code>true</code>, will attempt to authenticate while handling a
Startup, otherwise will not attempt
+ * there and defer authentication to when handling an AuthResponse
message.
+ */
+ default boolean requiresCertificateAuthentication()
Review Comment:
The main reason for the differentiation is if
`requiresCertificateAuthentication` is set to true, we can prevent sending an
`AUTHENTICATE` response to the client when a certificate is missing, allowing
the error to happen earlier in the process.
If we didn't have this when using `MtlSAuthenticator`, If a client had a
missing certificate C* would send an `AUTHENTICATE` back to the client, which
would cause a different error flow. e.g. instead of getting a clear error back
from Cassandra (`No certificate present on connection`), the client gets
prompted for an authenticator, which it will likely not have configured and the
driver will throw a less specific error for.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
