You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The `ldap.configuration` file in `conf` directory does not need to be changed and with the above `docker run`, it will work out of the box. You just
142
-
have to put it in `$CASSANDRA_CONF` or set respective configuration propery as described above.
146
+
The `ldap.configuration` file in the `conf` directory does not need to be changed, and with the above `docker run` it will work out of the box. You just
147
+
have to put it in `$CASSANDRA_CONF` or set respective configuration property as described above.
143
148
144
-
## How it works
149
+
## How It Works
145
150
146
-
LDAPAuthenticator currently supports plain text authorisation requests only in the form of a username and password.
151
+
LDAPAuthenticator currently supports plain text authorization requests only in the form of a username and password.
147
152
This request is made to the LDAP server over plain text, so you should be using client encryption on the Cassandra
148
153
side and secure ldap (ldaps) on the LDAP side.
149
154
150
155
Credentials are sent from your client to the Cassandra server and then tested against the LDAP server for
151
156
authentication using a specified service account. This service account should be configured in the `ldap.properties`
152
-
file using the `service_dn` and `service_password` properties. If `service_dn` is set, such role will be created in database,
157
+
file using the `service_dn` and `service_password` properties. If `service_dn` is set, such a role will be created in database,
153
158
when not already present, upon node's start.
154
159
155
-
`service_dn` account which will be automatically created will be super user in Cassandra.
160
+
`service_dn` account, which will be automatically created, will be super user in Cassandra.
156
161
157
-
All "normal" roles are not affectedthey behave exactly as you are used to.
162
+
All "normal" roles are not affected—they behave exactly as you are used to.
158
163
159
-
If LDAP server connection is lost or there is other communication error while talking to LDAP server,
160
-
operator has still a possibility to log in via `cassandra` user as usually and until LDAP server is not back again,
161
-
users meant to be authenticated against LDAP server will not be able to log in but all "normal" users will be able to
164
+
If the LDAP server connection is lost or there is another communication error while talking to LDAP server,
165
+
the operator still has a possibility of logging in via `cassandra` user as usual, and until the LDAP server is not back again;
166
+
Users meant to be authenticated against the LDAP server will not be able to log in but all "normal" users will be able to
162
167
login and the disruption of LDAP communication will not affect their ability to do so as they live in Cassandra natively.
163
168
164
169
In case there are two logins of same name (e.g. `admin` in LDAP and `admin` in C*),
165
170
in order to distinguish them, if you want to login with LDAP user, you have to
166
-
specify its full account name, e.g
171
+
specify its full account name, e.g.
167
172
168
173
cqlsh -u cn=admin,dn=example,dn=org
169
174
170
-
In case user specifies just `admin` as login name (or any other name, for that matter), it will try to
171
-
authenticate against database first and if not successful, against LDAP, adding all details (cn= etc ...) to username automatically.
175
+
In case a user specifies just `admin` as login name (or any other name, for that matter), it will try to
176
+
authenticate against database first and if not successful against LDAP, adding all details (cn= etc. ...) to username automatically.
172
177
173
-
It is possible to delete administration role (e.g. role `cassandra`) but if one does that, all administration operations are possible to
174
-
be done only via LDAP account. In case LDAP is down, operator would not have any control over DB as `cassandra` is not present anymore.
175
-
In such case, it is recommended to create another admin-like user with strong password _before_ `cassandra` role is deleted. Plugin is internally creating new roles
176
-
when somebody from LDAP logs in and it is not in DB yet - for this functionality, there needs to be some admin-like user which writes them `system_auth.roles` table.
177
-
If you delete `cassandra` user, there is suddenly not such user. You have to restart node and specify this property
178
+
It is possible to delete administration role (e.g. role `cassandra`) but if one does that, all administration operations are only able to
179
+
be done via LDAP account. In case LDAP is down, the operator would not have any control over DB as `cassandra` is not present anymore.
180
+
In such case, it is recommended to create another admin-like user with a strong password _before_ the `cassandra` role is deleted. A plugin is internally creating new roles
181
+
when somebody from LDAP logs in and it is not in DB yet. For this functionality, there needs to be some admin-like user which writes them `system_auth.roles` table.
182
+
If you delete `cassandra` user, there is suddenly not such user. You have to restart node and specify this property:
178
183
179
184
-Dcassandra.ldap.admin.user=dba
180
185
181
186
Where `dba` is _new_ superuser which is able to write to `system_auth.roles` and acts as Cassandra admin.
182
187
183
188
## Further Information
184
189
- See blog by Kurt Greaves ["Apache Cassandra LDAP Authentication"](https://www.instaclustr.com/apache-cassandra-ldap-authentication/)
185
-
- Please see https://www.instaclustr.com/support/documentation/announcements/instaclustr-open-source-project-status/ for Instaclustr support status of this project
190
+
- Please see https://www.instaclustr.com/support/documentation/announcements/instaclustr-open-source-project-status/ for Instaclustr support status of this project
0 commit comments