Enable HCD unified authentication

HCD Unified Authentication facilitates connectivity to three primary backend authentication and authorization services. HCD Unified Authentication uses the following services:

HCD Authenticator: Provides authentication using internal password authentication, LDAP pass-through authentication, and OpenID Connect (OIDC).
HCD Role Manager: Assigns roles by mapping user names to role names, or by looking up group membership in LDAP and mapping group names to role names.
HCD Authorizer: Provides access to control for database objects.

By default, HCD Authenticator and HCD Authorizer are disabled. Authenticators other than AdvancedAuthenticator are not supported.

Prerequisites

Complete the following before enabling authentication:

For external authentication methods, such as LDAP, ensure that the service is active and available.

HCD cannot start if a configured authentication service isn’t available.
Change the replication factor for the system_auth and hcd_security keyspaces to 3 or 5 for each datacenter.
When enabling authentication in a live cluster, upgrade drivers and configure applications to provide credentials. Consider using the transitional mode to allow connections using the anonymous role.

Configure Unified Authentication

Make the following changes on each node:

Locate the cassandra.yaml configuration file.

The location of the cassandra.yaml file depends on your installation type.
- Package installations: /etc/hcd/cassandra/cassandra.yaml
- Tarball installations: INSTALLATION_LOCATION/resources/cassandra/conf/cassandra.yaml
In the cassandra.yaml file, verify that HCD Unified Authentication and Authorization features are configured:
1. Verify that authenticator is set to AdvancedAuthenticator:
  
  authenticator: com.datastax.cassandra.auth.AdvancedAuthenticator
2. Verify that authorizer is set to AdvancedAuthorizer:
  
  authorizer: com.datastax.cassandra.auth.AdvancedAuthorizer
3. Verify that role_manager is set to AdvancedRoleManager:
  
  role_manager: com.datastax.cassandra.auth.AdvancedRoleManager

In the cassandra.yaml file, uncomment the authenticator.parameters section, and then configure the corresponding settings for your environment.

Be sure to preserve spacing when uncommenting lines.

authenticator:
  class_name: com.datastax.cassandra.auth.AdvancedAuthenticator
  parameters:
    enabled: true
    default_scheme: internal
    additional_schemes: oidc, ldap
    plain_text_without_ssl: warn

Field Required or optional Description

class_name

Required

Must be set to com.datastax.cassandra.auth.AdvancedAuthenticator.

parameters.enabled

Required

Must be set to true to enable Unified Authentication.

When true, allows authentication using the default_scheme and additional_schemes.

default_scheme

Required

Specifies the authentication scheme to use when the scheme isn’t defined in the connection:

internal: HTTP basic authentication using internal login roles and passwords. No additional configuration required.
ldap: Plain text authentication using pass-through LDAP authentication. Requires additional configuration, as explained in Define an LDAP scheme.

For HCD to start up, the external service referenced in the ldap_options must be accessible.
oidc: OpenID Connect authentication using modern identity providers. Requires additional configuration, as explained in Configure OpenID Connect (OIDC) authentication.

additional_schemes

Optional, Recommended

Additional authentication schemes to support alongside the default scheme.

If you plan to use only LDAP or OIDC, include the internal scheme in additional_schemes so you can access the default cassandra role and complete the initial RBAC setup. After you create a new superuser role, you can remove internal from additional_schemes.

plain_text_without_ssl

Optional

Handling of plain text connection requests.

If you haven’t created a new superuser role yet, make sure authorization_options.scheme_permissions is set to false.

authorization_options.scheme_permissions: true requires EXECUTE permission for the authorized scheme. Only enable this option after you create a non-default superuser role and disable the default cassandra role.

Configure JMX authentication to allow authenticated nodetool operations.
Restart HCD.
Use cqlsh to do the following:
- Create a non-default superuser role and disable the default cassandra role, if you haven’t done so already.
- Create non-superuser roles and grant permissions.
Repeat for all nodes in the cluster.

Enable HCD unified authentication

Prerequisites

Configure Unified Authentication

Was this helpful?

Give Feedback