About DSE Unified Authentication

DSE Unified Authentication facilitates connectivity to three primary backend authentication and authorization services: DSE Authenticator, DSE Role Manager, and DSE Authorizer.

DSE Authenticator

DSE Authenticator supports validating user identity against any of the following authentication schemes:

  • Internal: Connections provide credentials for a role that has an internally stored password. Ensure the dse.yaml configuration file enables the internal_default setting before DSE initializes. See Setting up logins and users.

  • LDAP: Connections provide LDAP credentials. DSE passes the credentials for verification to LDAP. See Defining an LDAP scheme.

  • Kerberos: Connections provide a Kerberos ticket. DSE is configured as a Service Principal (see Setting up Kerberos) and passes the tickets to the Key Distribution Service (KDS) for verification. See Defining a Kerberos scheme.

A connection request specifies a Simple Authentication and Security Layer (SASL) mechanism such as PLAIN, DIGEST-MD5, GSSAPI, or others. The PLAIN mechanism applies to both LDAP and Internal authentication schemes. DSE Authenticator uses a Kerberos scheme for both DIGEST-MD5 and GSSAPI mechanisms.

When a connection request specifies an authentication mechanism, DSE Authenticator validates the user request against its supported schemes. When no default mechanism is specified, DSE uses the Internal authentication scheme.

When a connection request specifies a PLAIN mechanism, DSE Authenticator first tries to validate using the authentication scheme defined in the default_scheme field of the dse.yaml configuration file. If the validation fails, then DSE Authenticator attempts to authenticate against schemes defined in the other_schemes field in the order they are defined.


PLAIN mechanism

Configuration file settings are default_scheme = kerberos, other_schemes=ldap,internal. A connection request specifies a PLAIN mechanism (non-Kerberos). DSE Authenticator checks the default_scheme but ignores the Kerberos authentication, despite it being the default setting. The first authentication validation attempt uses LDAP, and then Internal if LDAP fails.

During the validation of a PLAIN mechanism, DSE Authenticator ignores any defined scheme that is not Internal or LDAP.

GSSAPI mechanism

Configuration file settings are default_scheme = internal, other_schemes=ldap,kerberos. A connection request specifies a GSSAPI mechanism (Kerberos). DSE Authenticator only uses Kerberos authentication, ignoring all other schemes.

It is possible to authenticate users without implementing access control using the DSE Authenticator; however, authentication is required for authorization and role management.

DSE Role Manager

DSE Role Manager assigns roles using one of the following modes:

  • Internal: One-to-one mapping using an internally stored password. Requires a role for each account. A DSE tool sets a salted hash password.

  • LDAP: One-to-many mapping. Assigns DSE roles that match the user’s LDAP groups. Passwords are stored in the LDAP server.

    For LDAP role management, DSE disables role nesting. You cannot use GRANT to assign a role to another role.

DSE Authorizer

DSE Authorizer analyzes the request against the role permissions on each affected resource before allowing the request to be executed.

Set and remove permissions on database resources with GRANT and REVOKE.

To enable support for row-level access control, which allow permissions to be granted by filtering on a partition column, set authorization_options.row_level_access_control to true. For more, see Enabling DSE Unified Authentication and Setting up Row Level Access Control (RLAC).

What’s next?

Steps for new deployment

Enable DSE Unified Authentication on a new deployment.

Steps for production environments

Enable DSE Unified Authentication without downtime when implementing in a production or otherwise existing DSE environment.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com