Configure DSE Unified Authentication in a new cluster
Use this process to implement DSE Unified Authentication in a new deployment.
|
Only use this process for new deployments. For existing DSE deployments, see Configure DSE Unified Authentication in a live cluster. Additional steps and planning are required to avoid downtime when implementing Unified Authentication in a live cluster. |
-
Configure system settings for DSE Unified Authentication.
-
Configure the desired authentication and authorization methods (schemes) on each node:
-
Internally stored passwords: No additional configuration is required to create internal roles with passwords.
-
External LDAP: See Defining an LDAP Scheme.
-
Kerberos: See Define a Kerberos scheme.
-
-
This requires changes to the
cassandra-env.shfornodetoolanddsetoolto run against an authentication-enabled cluster. The location of thecassandra-env.shfile depends on the type of installation:-
Package installations:
/etc/dse/cassandra/cassandra-env.sh -
Tarball installations:
INSTALL_DIRECTORY/resources/cassandra/conf/cassandra-env.sh
-
-
Nodes are vulnerable to malicious activity following this restart. Anybody can access the system using the default
cassandrarole with passwordcassandra. DataStax recommends using firewall rules to isolate the cluster until you disable thecassandrarole. -
After all nodes restart, use
cqlshto replace thecassandradefault role with a non-default superuser role. -
Use the new superuser role to configure additional roles and assign permissions.
-
Enable and monitor audit logs to verify that all applications can access nodes and have the permissions required to execute requests.
-
After enabling authentication and authorization, you must provide credentials to run DSE tools, such as CQL shell and
nodetool.Make sure all applications use the latest version of a compatible Cassandra driver. Unsupported drivers and earlier versions don’t support Unified Authentication.
For Apache Spark™ component connections, DSE provides internal authentication support for connecting Spark to DSE nodes, but it doesn’t handle authentication between Spark components.
