Enabling LDAP authentication

Configuring DataStax Enterprise to use an external LDAP server to enable LDAP authentication.

1. Open the cassandra.yaml file in a text editor and set the authenticator to com.datastax.bdp.cassandra.auth.LdapAuthenticator.
   The location of the cassandra.yaml file depends on the type of installation:

   Package installations	/etc/dse/cassandra/cassandra.yaml
   Tarball installations	install_location/resources/cassandra/conf/cassandra.yaml

   The location of the dse.yaml file depends on the type of installation:

   Installer-Services	/etc/dse/dse.yaml
   Package installations	/etc/dse/dse.yaml
   Installer-No Services	install_location/resources/dse/conf/dse.yaml
   Tarball installations	install_location/resources/dse/conf/dse.yaml

   authenticator: com.datastax.bdp.cassandra.auth.LdapAuthenticator

2. Open the dse.yaml file in a text editor and set the configuration for your LDAP server. The settings are only used if the authenticator is set to com.datastax.bdp.cassandra.auth.LdapAuthenticator in cassandra.yaml.

   Option	Description
   server_host	The host name of the LDAP server.
   server_port	The port on which the LDAP server listens. The default value is 389. The default SSL port for LDAP is 636.
   search_dn	The username of the user that is used to search for other users on the LDAP server.
   search_password	The password of the search_dn user.
   use_ssl	Set to true to enable SSL connections to the LDAP server. If set to true, you may need to change server_port to the SSL port of the LDAP server. The default value is false.
   use_tls	Set to true to enable TLS connections to the LDAP server. If set to true, you may need to change the server_port to the TLS port of the LDAP server. The default value is false.
   truststore_path	The path to the trust store for SSL certificates.
   truststore_password	The password to access the trust store.
   truststore_type	The type of trust store. The default value is jks.
   user_search_base	The search base for your domain, used to look up users. Set the ou and dc elements for your LDAP domain. Typically this is set to ou=users,dc=domain,dc=top level domain. For example, ou=users,dc=example,dc=com. Active Directory uses a different search base, typically CN=search,CN=Users,DC=Active Directory domain name,DC=internal. For example, CN=search,CN=Users,DC=example-sales,DC=internal.
   user_search_filter	The search filter for looking up usernames. The default setting is (uid={0}). When using Active Directory set the filter to (sAMAccountName={0}).
   search_validity_in_seconds	The duration period in milliseconds for the search cache. To disable the cache, set it to 0. The cache is disabled by default. Enabling a search cache reduces the number of requests sent to the LDAP server, improving performance. Changes in user data on the LDAP server will not be reflected during the cache period, however.
   credentials_validity_in_ms	The duration period in milliseconds for the credential cache. To disable the cache, set it to 0. The cache is disabled by default. With the cache enabled DataStax Enterprise will store the user credentials locally during the period set in credentials_validity_in_ms. Binding to a remote LDAP server takes time and resources, so enabling a credential cache will usually result in faster performance following the initial authentication phase. Changes in user credentials on the LDAP server, however, will not be reflected in DataStax Enterprise during the cache period.
   connection_pool	The configuration settings for the connection pool for making LDAP requests.
   max_active	The maximum number of active connections to the LDAP server. The default value is 8.
   max_idle	The maximum number of idle connections in the pool awaiting requests. The default value is 8.

   ldap_options:
       server_host: localhost
       server_port: 389
       search_dn: cn=Admin
       search_password: secret
       use_ssl: false
       use_tls: false
       truststore_path:
       truststore_password:
       truststore_type: jks
       user_search_base: ou=users,dc=example,dc=com
       user_search_filter: (uid={0})
       credentials_validity_in_ms: 0
       connection_pool:
           max_active: 8
           max_idle: 8

3. Repeat these steps on each node in the cluster.