Authentication and Authorization

curl -L -X POST 'http://localhost:8081/v1/auth' \
  -H 'Content-Type: application/json' \
  --data-raw '{
    "username": "cassandra",
    "password": "cassandra"
}'

{"authToken":"{auth-token}"}

git clone https://github.com/stargate/docker-images.git

cd <clone_location>/examples/stargate-jwt

./start_jwt.sh

 #!/bin/sh

 # Make sure cass-1, the seed node, is up before bringing up other nodes and stargate
 docker-compose up -d cass-1 (1)
 # Wait until the seed node is up before bringing up more nodes
 (docker-compose logs -f cass-1 &) | grep -q "Created default superuser role" (2)

 # Bring up the 2nd C* node
 docker-compose up -d cass-2
 (docker-compose logs -f cass-1 &) | grep -q "is now part of the cluster"
 # Bring up the 3rd C* node
 docker-compose up -d cass-3
 (docker-compose logs -f cass-1 &) | grep -q "is now part of the cluster"

 # Bring up keycloak for handling JWTs
 docker-compose up -d keycloak (3)

 # Bring up the stargate
 docker-compose up -d stargate-jwt (4)
 # Wait until stargate is up before bringing up the metrics tools
 echo ""
 echo "Waiting for stargate to start up..." (5)
 while [[ "$(curl -s -o /dev/null -w ''%{http_code}'' http://localhost:8082/health)" != "200" ]]; do
     printf '.'
     sleep 5
 done

 # this is where a cql script must be run to insert data and grant permissions
 docker run --rm -it -v /Users/lorina.poland/CLONES/stargate/docker-images/examples/stargate-jwt-auth/scripts:/scripts  \ (6)
 -v /Users/lorina.poland/CLONES/stargate/docker-images/examples/stargate-jwt-auth/cqlshrc:/.cassandra/cqlshrc  \
 --env CQLSH_HOST=host.docker.internal --env CQLSH_PORT=9045  nuvo/docker-cqlsh

version: '2'

  services:
    cass-1:  (1)
      image: cassandra:3.11.8 (2)
      container_name: cass-1
      networks:
        - backend (3)
      ports:
        - 9044:9042
      mem_limit: 2G
      environment: (4)
        - HEAP_NEWSIZE=128M
        - MAX_HEAP_SIZE=1024M
        - CASSANDRA_SEEDS=cass-1
        - CASSANDRA_CLUSTER_NAME=backend-cluster
    cass-2:
      image: cassandra:3.11.8
      container_name: cass-2
      networks:
        - backend
      mem_limit: 2G
      depends_on:
        - cass-1
      environment:
        - HEAP_NEWSIZE=128M
        - MAX_HEAP_SIZE=1024M
        - CASSANDRA_SEEDS=cass-1
        - CASSANDRA_CLUSTER_NAME=backend-cluster
    cass-3:
      image: cassandra:3.11.8
      container_name: cass-3
      networks:
        - backend
      mem_limit: 2G
      depends_on:
        - cass-1
      environment:
        - HEAP_NEWSIZE=128M
        - MAX_HEAP_SIZE=1024M
        - CASSANDRA_SEEDS=cass-1
        - CASSANDRA_CLUSTER_NAME=backend-cluster
    stargate-jwt:
      image: jwt-sg:latest (5)
      container_name: stargate-jwt
      depends_on:
        - cass-1
      networks:
        - backend
      ports:
        - 8080:8080
        - 8081:8081
        - 8082:8082
        - 8085:8085
        - 9045:9042
      mem_limit: 2G
      environment: (6)
        - JAVA_OPTS=-XX:+CrashOnOutOfMemoryError -Xmx750M -Xms64M -Dstargate.auth_id=AuthJwtService -Dstargate.auth.jwt_provider_url=http://keycloak:4444/auth/realms/stargate/protocol/openid-connect/certs
        - CLUSTER_NAME=backend-cluster
        - CLUSTER_VERSION=3.11
        - SEED=cass-1
        - RACK_NAME=rack1
        - DATACENTER_NAME=dc1
        - ENABLE_AUTH=true
        - SIMPLE_SNITCH=true
    keycloak:
      image: quay.io/keycloak/keycloak:11.0.2 (7)
      container_name: keycloak
      networks:
        - backend
      ports: (8)
        - 4444:4444
        - 9990:9990
      environment: (9)
        - JAVA_OPTS=-Djboss.http.port=4444
        - KEYCLOAK_USER=admin
        - KEYCLOAK_PASSWORD=admin
        - KEYCLOAK_IMPORT=/tmp/stargate-realm.json
      volumes: (10)
        - ./stargate-realm.json:/tmp/stargate-realm.json
  networks:
    backend:

# create role for demos
CREATE ROLE IF NOT EXISTS 'web_user' WITH PASSWORD = 'web_user' AND LOGIN = TRUE;

# create REST API example
CREATE KEYSPACE IF NOT EXISTS store WITH REPLICATION = {'class':'SimpleStrategy', 'replication_factor':'1'};

CREATE TABLE IF NOT EXISTS store.shopping_cart (userid text PRIMARY KEY, item_count int, last_update_timestamp timestamp);

INSERT INTO store.shopping_cart (userid, item_count, last_update_timestamp) VALUES ('9876', 2, toTimeStamp(toDate(now())));
INSERT INTO store.shopping_cart (userid, item_count, last_update_timestamp) VALUES ('1234', 5, toTimeStamp(toDate(now())));

GRANT MODIFY ON TABLE store.shopping_cart TO web_user;
GRANT SELECT ON TABLE store.shopping_cart TO web_user;

# create GraphQL example
CREATE KEYSPACE IF NOT EXISTS library WITH REPLICATION = {'class':'SimpleStrategy', 'replication_factor':'1'};

CREATE TABLE IF NOT EXISTS library.books (title text PRIMARY KEY, author text);
CREATE TABLE IF NOT EXISTS library.authors (name text PRIMARY KEY, title text);

GRANT MODIFY ON TABLE library.books TO web_user;
GRANT MODIFY ON TABLE library.authors TO web_user;
GRANT SELECT ON TABLE library.books TO web_user;
GRANT SELECT ON TABLE library.authors TO web_user;

TOKEN=$(curl -s --data "username=admin&password=admin&grant_type=password&client_id=admin-cli" http://localhost:4444/auth/realms/master/protocol/openid-connect/token | jq -r '.access_token') (1)

curl -L -X POST 'http://localhost:4444/auth/admin/realms/stargate/users' \
-H "Content-Type: application/json" \
-H "Authorization: bearer $TOKEN" \ (2)
--data-raw '{
    "username": "testuser1", (3)
    "enabled": true,
    "emailVerified": true,
    "attributes": {
        "userid": [
            "9876" (4)
        ],
        "role": [
            "web_user" (5)
        ]
    },
    "credentials": [
        {
            "type": "password",
            "value": "testuser1", (6)
            "temporary": "false"
        }
    ]
}'