Configure HCD Unified Authentication in a live cluster
To implement HCD Unified Authentication in an existing deployment (a live cluster) without downtime or interrupted access, use transitional modes to temporarily support applications and users that don’t have an authenticated role:
-
Update all applications to provide credentials and ensure that they use the latest version of a supported Apache Cassandra driver.
When using
authentication.transitional_mode, you can provide a blank username and password to log in with theanonymousrole.When authentication and authorization are disabled, the credentials portion of the connection request is ignored. After authentication is enabled all connections must provide credentials.
-
On each node, enable authentication and authorization in transitional mode:
-
Set
authentication.transitional_modetopermissivein thecassandra.yamlfile. -
Set
authorization.transitional_modetonormalin thecassandra.yamlfile.
For more information, see Enable HCD Unified Authentication.
-
-
Enable logging so you can verify that applications are authenticating successfully.
-
Perform a rolling restart of all nodes in the cluster.
Nodes are vulnerable to malicious activity following this restart. Anybody can access the system using the default
cassandrarole with passwordcassandra. DataStax recommends using firewall rules to isolate the cluster until you disable thecassandrarole. -
After all nodes restart, use
cqlshto replace thecassandrarole with a non-default superuser role. -
Use the new superuser role to configure additional roles and assign permissions.
-
Monitor audit logs to verify that all applications can access nodes and have the permissions required to execute requests.
-
In the
cassandra.yamlfile, disabletransitional_mode, and then configure specific authentication schemes, such as LDAP, if needed. -
Perform a rolling restart of the cluster.
