cassandra-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Ariel Weisberg (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CASSANDRA-11471) Add SASL mechanism negotiation to the native protocol
Date Thu, 02 Mar 2017 16:37:45 GMT

    [ https://issues.apache.org/jira/browse/CASSANDRA-11471?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15892559#comment-15892559
] 

Ariel Weisberg commented on CASSANDRA-11471:
--------------------------------------------

* Please add a unit test for {{CommonNameCertificateAuthenticator}}
* [Only if encryption is optional?|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-ab99d4b775ea620e439db41d18353541R123]
Basically because the authenticator can only work if the certificates are there? It seems
like this can NPE?
* It seems like this adds the capability to allow you to select a mechanism, but the authenticators
don't actually select multiple mechanisms only one is supported?
* {{NegotiatingSaslNegotiator.setupOnCompletedNegotiation()}} appears to have no implementations?
* [Debug is on all the time so this may be a bit much|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-ef1e335e8d51911f09bcc735b0632c5cR218]
* [Same debug issue|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-5c1697b2ca600e9e034b27ac03b0129dR43]
* [Same debug issue|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-ef1e335e8d51911f09bcc735b0632c5cR205]
* [Extra line|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-f4a806982d4fb565a8ceb5476cfb5978R84]
* [Extra line|https://github.com/apache/cassandra/compare/trunk...benbromhead:11471#diff-f4a806982d4fb565a8ceb5476cfb5978R71]

For the driver and protocol change you should create a subtask here https://datastax-oss.atlassian.net/browse/JAVA-1361

> Add SASL mechanism negotiation to the native protocol
> -----------------------------------------------------
>
>                 Key: CASSANDRA-11471
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-11471
>             Project: Cassandra
>          Issue Type: Sub-task
>          Components: CQL
>            Reporter: Sam Tunnicliffe
>            Assignee: Ben Bromhead
>              Labels: client-impacting
>         Attachments: CASSANDRA-11471
>
>
> Introducing an additional message exchange into the authentication sequence would allow
us to support multiple authentication schemes and [negotiation of SASL mechanisms|https://tools.ietf.org/html/rfc4422#section-3.2].

> The current {{AUTHENTICATE}} message sent from Client to Server includes the java classname
of the configured {{IAuthenticator}}. This could be superceded by a new message which lists
the SASL mechanisms supported by the server. The client would then respond with a new message
which indicates it's choice of mechanism.  This would allow the server to support multiple
mechanisms, for example enabling both {{PLAIN}} for username/password authentication and {{EXTERNAL}}
for a mechanism for extracting credentials from SSL certificates\* (see the example in [RFC-4422|https://tools.ietf.org/html/rfc4422#appendix-A]).
Furthermore, the server could tailor the list of supported mechanisms on a per-connection
basis, e.g. only offering certificate based auth to encrypted clients. 
> The client's response should include the selected mechanism and any initial response
data. This is mechanism-specific; the {{PLAIN}} mechanism consists of a single round in which
the client sends encoded credentials as the initial response data and the server response
indicates either success or failure with no futher challenges required.
> From a protocol perspective, after the mechanism negotiation the exchange would continue
as in protocol v4, with one or more rounds of {{AUTH_CHALLENGE}} and {{AUTH_RESPONSE}} messages,
terminated by an {{AUTH_SUCCESS}} sent from Server to Client upon successful authentication
or an {{ERROR}} on auth failure. 
> XMPP performs mechanism negotiation in this way, [RFC-3920|http://tools.ietf.org/html/rfc3920#section-6]
includes a good overview.
> \* Note: this would require some a priori agreement between client and server over the
implementation of the {{EXTERNAL}} mechanism.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

Mime
View raw message