Authentication scheme resources
When using multiple authentication schemes, you might want to enforce specific authentication schemes for certain roles. For example, you might want to require LDAP authentication for users managed in Active Directory.
To do this, use GRANT EXECUTE to bind a role to a specific authentication scheme, or allow the role to use all authentication schemes.
Once enabled, the role can only be assigned to a user who has authenticated against the required authentication scheme.
For example, if a role requires LDAP authentication (LDAP SCHEME), the role cannot be assigned to a user who authenticated with an internal username and password (INTERNAL SCHEME).
Prerequisites
To enforce an authentication scheme for a role, authorization_options.scheme_permissions must be set to true in cassandra.yaml.
The location of the cassandra.yaml file depends on your installation type.
-
Package installations:
/etc/hcd/cassandra/cassandra.yaml -
Tarball installations:
INSTALLATION_LOCATION/resources/cassandra/conf/cassandra.yaml
Once enabled, roles must be associated with an authentication scheme before being assigned to a user.
Authentication scheme resource objects
Resource objects for authentication schemes include the following:
-
ALL AUTHENTICATION SCHEMES: Parent resource that comprises all specific authentication schemes. -
LDAP SCHEME: Resource representing the LDAP authentication scheme. Child of theALL AUTHENTICATION SCHEMESresource. -
INTERNAL SCHEME: Resource representing the internal authentication scheme. Child of theALL AUTHENTICATION SCHEMESresource.
Synopsis
GRANT EXECUTE
ON <scheme>
TO <role_name>;Options
-
<role_name>: The name of the role to modify. -
<scheme>: The authorized authentication scheme for the role. Specify one of the following:-
ALL AUTHENTICATION SCHEMES: Allows any authentication scheme. -
LDAP SCHEME: Requires LDAP authentication forGRANT ROLE. -
INTERNAL SCHEME: Requires internal username and password authentication forGRANT ROLE.
-
