About DSE Unified Authentication

Describes supported authentication and authorization methods.

DSE Unified Authentication facilitates connectivity to three primary backend authentication and authorization services. DSE Unified Authentication uses the following services:
  • DSE Authenticator supports validating user identity against any of the following authentication schemes:
    • Internal: Connections provide credentials for a role that has an internally stored password, no additional configuration is required, see Setting up logins and users.
    • LDAP: Connections provide LDAP credentials and DSE passes the credentials for verification to LDAP, see Defining an LDAP scheme.
      Important: Starting in DSE 6.0.13, DSE supports automatic polling of authenticated LDAP servers via DNS Service Discovery (DNS-SD). In the dse.yaml LDAP configuration, when the list of auth'd servers is refreshed, the updated list is applied automatically to the DSE LDAP Authenticator. DSE uses server-record lookup to dynamically locate an LDAP server host, instead of users having to hardcode a single specific LDAP server host.
    • Kerberos: Connections provide a Kerberos ticket, DSE is configured as a Service Principal (see Setting up Kerberos) and passes the tickets to KDS for verification, see Defining a Kerberos scheme

    When a connection request specifies an authentication scheme, DSE Authenticator validates the user against the selected scheme first. If no scheme is specified in the connection request or the validation fails, DSE Authenticator first tries the and then each scheme defined in .

    Important: It is possible to authenticate users without implementing access control using the DSE Authenticator, however authentication is required for authorization and role management.
  • DSE Role Manager assigns roles using one of the following modes:
    • Internal: 1-1 mapping using an internally stored password. Requires a role for each account.
    • LDAP: 1- many mapping. Assigns DSE roles that match the user's LDAP groups.
      Note: For LDAP role management, DSE disables role nesting; you cannot use to assign a role to another role.

  • DSE Authorizer analyzes the request against the role permissions on each affected resource before allowing the request to be executed.

    Set and remove permissions on database resources with the CQL commands and .

    Tip: Enable support for row-level access control, which allow permissions to be granted by filtering on a partition column, by setting authorization_options row_level_access_control to true, see Enabling DSE Unified Authentication, see Setting up Row Level Access Control (RLAC).