Configure HCD Unified Authentication in a new cluster
Use this process to implement HCD Unified Authentication in a new deployment.
|
Only use this process for new deployments. For existing HCD deployments, see Configure HCD Unified Authentication in a live cluster. Additional steps and planning are required to avoid downtime when implementing Unified Authentication in a live cluster. |
-
Configure system settings for HCD Unified Authentication.
-
Configuring authentication and authorization schemes:
-
Internally stored passwords: No additional configuration is required to create internal roles with passwords.
-
External LDAP: See Define an LDAP scheme.
-
-
This requires changes to the
cassandra-env.shfornodetoolto run against an authentication-enabled cluster.The location of this file depends on your installation type.
-
Package installations:
/etc/hcd/cassandra/cassandra-env.sh -
Tarball installations:
INSTALLATION_LOCATION/resources/cassandra/conf/cassandra-env.sh
-
-
Nodes are vulnerable to malicious activity following this restart. Anybody can access the system using the default
cassandrarole with passwordcassandra. DataStax recommends using firewall rules to isolate the cluster until you disable thecassandrarole. -
After all nodes restart, use
cqlshto replace thecassandradefault role with a non-default superuser role. -
Use the new superuser role to configure additional roles and assign permissions.
-
Enable and monitor audit logs to verify that all applications can access nodes and have the permissions required to execute requests.
-
After enabling authentication and authorization, you must provide credentials to run HCD tools, such as CQL shell and
nodetool.Make sure all applications use the latest version of a compatible Cassandra driver. Unsupported drivers and earlier versions don’t support HCD Unified Authentication.
For Apache Spark™ component connections, HCD provides internal authentication support for connecting Spark to HCD nodes, but it doesn’t handle authentication between Spark components.
