Re: Cassandra access control

2009-12-02 Thread Ted Zlatanov
On Tue, 01 Dec 2009 16:58:50 -0600 Eric Evans eev...@rackspace.com wrote: EE On Tue, 2009-12-01 at 15:38 -0600, Ted Zlatanov wrote: I disagree, why would you want to forbid switching the keyspace? That's turning off a currently working feature. Also, connections are not free, especially

Re: Cassandra access control

2009-12-02 Thread Mark Robson
2009/12/2 Ted Zlatanov t...@lifelogs.com OK. So what should the API be? Just one method, as Robin suggested? void login( MapString, String credentials, String keyspace ) throws AuthenticationException, AuthorizationException In this model the backend would still have login() and

RE: Re: Cassandra access control

2009-12-02 Thread Coe, Robin
Once a connection is opened with credentials, then as long as I hold that connection open, I shouldn't need to pass auth checks with every transaction. On the other hand, if there was a way to use a token in lieu of credentials, to provide SSO capabilities to any node, then I could see their

Re: Cassandra access control

2009-12-02 Thread Eric Evans
On Wed, 2009-12-02 at 14:27 -0600, Ted Zlatanov wrote: On Wed, 02 Dec 2009 14:14:53 -0600 Eric Evans eev...@rackspace.com wrote: EE Did you maybe mean...? AuthenticationRequest required for the EE method (has to be), but the map is optional? Either way will work. With your suggestion

Re: Cassandra access control

2009-12-02 Thread Mark Robson
How about we make authentication optional, and have the protocol being stateful only if you want to authenticate? That way we don't break backwards compatibility or introduce extra complexity for people who don't need it. Mark

Re: Persistently increasing read latency

2009-12-02 Thread Ian Holsman
hmm. doesn't that leave the trunk in a bad position in terms of new development? you may go through times when a major feature lands and trunk is broken/buggy. or are you planning on building new features on a branch and then merging into trunk when it's stable? On Dec 3, 2009, at 5:32 AM,

Re: Cassandra access control

2009-12-02 Thread Jake Luciani
+1 this is nosql afterall. Sent from my iPhone On Dec 2, 2009, at 3:54 PM, Mark Robson mar...@gmail.com wrote: How about we make authentication optional, and have the protocol being stateful only if you want to authenticate? That way we don't break backwards compatibility or introduce

Re: Persistently increasing read latency

2009-12-02 Thread Jonathan Ellis
I'm only reporting what trunk is like right now, not what it will be in the future. Trunk has been buggy before and will be again, don't worry. :) On Wed, Dec 2, 2009 at 2:57 PM, Ian Holsman i...@holsman.net wrote: hmm. doesn't that leave the trunk in a bad position in terms of new

Re: Cassandra access control

2009-12-02 Thread Ted Zlatanov
On Wed, 2 Dec 2009 20:54:13 + Mark Robson mar...@gmail.com wrote: MR How about we make authentication optional, and have the protocol being MR stateful only if you want to authenticate? MR That way we don't break backwards compatibility or introduce extra MR complexity for people who don't

Re: Cassandra access control

2009-12-02 Thread Jonathan Ellis
It's really premature to be holding a vote based on first-impression opinions. 2009/12/2 Ted Zlatanov t...@lifelogs.com: On Wed, 2 Dec 2009 20:54:13 + Mark Robson mar...@gmail.com wrote: MR How about we make authentication optional, and have the protocol being MR stateful only if you want

RE: Cassandra access control

2009-12-02 Thread Coe, Robin
NoSQL doesn't mean no security. A production database engine has to protect its data. The trick is to make the auth framework fast enough that it doesn't adversely affect performance and robust enough that an application requesting data doesn't have to jump through hoops to get it.

Re: Cassandra access control

2009-12-02 Thread Ted Zlatanov
On Wed, 02 Dec 2009 14:35:09 -0600 Eric Evans eev...@rackspace.com wrote: EE On Wed, 2009-12-02 at 14:27 -0600, Ted Zlatanov wrote: On Wed, 02 Dec 2009 14:14:53 -0600 Eric Evans eev...@rackspace.com wrote: EE Did you maybe mean...? AuthenticationRequest required for the EE method (has to

Re: Cassandra access control

2009-12-02 Thread Ted Zlatanov
On Wed, 2 Dec 2009 15:23:23 -0600 Jonathan Ellis jbel...@gmail.com wrote: JE It's really premature to be holding a vote based on JE first-impression opinions. Somehow we have to make a decision on whether the API will be stateful or stateless. This affects more than just the auth code so I

Re: Cassandra access control

2009-12-02 Thread Eric Evans
On Wed, 2009-12-02 at 15:27 -0600, Ted Zlatanov wrote: EE Let's not do that; as Robin pointed out... EE ...there's no way to ensure immediate consistency of tokens across all EE nodes, it's probably not worth the effort of making Cassandra token EE aware, since an application would have to

Re: Cassandra access control

2009-12-02 Thread Jake Luciani
I like this bug/feature it gives another dimension to play with. Especially when keyspaces can be defined on the fly. Not a huge restriction though. Sent from my iPhone On Dec 2, 2009, at 4:22 PM, Jonathan Ellis jbel...@gmail.com wrote: What backwards compatibility are you concerned with

Re: Cassandra access control

2009-12-02 Thread Jake Luciani
Got it. On Dec 2, 2009, at 4:42 PM, Jonathan Ellis jbel...@gmail.com wrote: It doesn't have to be the outside world, just apps from different groups. Which is the whole (or at least, a major) reason we added multiple keyspaces. On Wed, Dec 2, 2009 at 3:38 PM, Jake Luciani jak...@gmail.com

Re: Cassandra access control

2009-12-02 Thread Ted Zlatanov
On Wed, 2 Dec 2009 15:32:35 -0600 Jonathan Ellis jbel...@gmail.com wrote: JE 2009/12/2 Ted Zlatanov t...@lifelogs.com: I'd still rather pass something back.  As I said, it allows backends to maintain state when it makes sense to do so and can alleviate the problem of redundant auth queries in