Configure DSE Unified Authentication in a live cluster
To implement DSE Unified Authentication in an existing deployment (a live cluster) without downtime or interrupted access, use transitional modes to temporarily support applications and users that don’t have an authenticated role:
-
Update all applications to provide credentials and ensure that they use the latest version of a supported Apache Cassandra driver.
When using
authentication.transitional_mode, you can provide a blank username and password to log in with theanonymousrole.When authentication and authorization are disabled, the credentials portion of the connection request is ignored. After authentication is enabled all connections must provide credentials.
-
On each node, enable authentication and authorization in transitional mode in the
dse.yamlfile:-
Set
authentication_optionsandtransitional_modetopermissive. -
Set
authorization_optionsandauth_transitional_modetonormal.For more information, see Enable DSE Unified Authentication.
-
-
Enable logging so you can verify that applications are authenticating successfully.
-
Perform a rolling restart of all nodes in the cluster.
Nodes are vulnerable to malicious activity following this restart. Anybody can access the system using the default
cassandrarole with passwordcassandra. DataStax recommends using firewall rules to isolate the cluster until you disable thecassandrarole. -
After all nodes restart, use
cqlshto replace thecassandradefault role with a non-default superuser role. -
Use the new superuser role to configure roles and assign permissions.
-
Monitor audit logs to verify that all applications can access nodes and have the permissions required to execute requests.
-
In the
dse.yamlfile, disabletransitional_mode, and then configure specific authentication schemes, such as LDAP, if needed. -
Perform a rolling restart of the cluster.
