Skip to content

Commit 53303b1

Browse files
committed
polished docs
1 parent ec18977 commit 53303b1

File tree

1 file changed

+43
-38
lines changed

1 file changed

+43
-38
lines changed

README.adoc

Lines changed: 43 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
# Instaclustr LDAP Authenticator
22

3+
_LDAP Authenticator for Apache Cassandra_
4+
35
image:https://circleci.com/gh/instaclustr/cassandra-ldap.svg?style=svg["Instaclustr",link="https://circleci.com/gh/instaclustr/cassandra-ldap"]
46

7+
- Website: https://www.instaclustr.com/
8+
- Documentation: [https://www.instaclustr.com/support/documentation/)
9+
510
This is a pluggable authentication implementation for Apache Cassandra, providing a way to authenticate
6-
and create users based on a configured LDAP server. This implementation purely provides authentication only.
7-
Role management must be performed through the usual Cassandra role management, CassandraAuthorizer.
11+
and create users based on a configured LDAP server. This implementation provides authentication only.
12+
Role management must be performed through the usual Cassandra role management CassandraAuthorizer.
813
See **How it works** for more details.
914

10-
## Project structure & building
15+
## Project Structure and Building
1116

12-
This project consists of 5 modules, `base` module is a module which all other implementation modules
13-
depend on. It contains core implementation necessary so all concrete modules are just reusing it.
17+
This project consists of 5 modules; the `base` module is the module on which all other implementation modules
18+
depend. It contains core implementation which is necessary as all concrete modules are reusing it.
1419

15-
`base` module depends on Cassandra dependency of version 3.0.18 but its scope is `provided` as
20+
The `base` module depends on Cassandra dependencyversion 3.0.18 but its scope is `provided` as
1621
these classes will be present when such plugin as a whole is put on a class path of Cassandra in runtime.
1722

1823
There are four implementation modules:
@@ -22,7 +27,7 @@ There are four implementation modules:
2227
* cassandra-3.11 - builds against version 3.11.8
2328
* cassandra-4.0 - builds against version 4.0-beta2
2429
25-
Project is built like:
30+
Project is built as:
2631

2732
```
2833
$ mvn clean install
@@ -34,25 +39,25 @@ This does _not_ invoke integration tests. For integration tests to run, please s
3439
$ mvn clean install -Pit
3540
```
3641

37-
Integration tests will expect a Docker installation present (or a way to connect to one), there
38-
is a Docker container started with LDAP server running against which an integration test, per module,
42+
Integration tests will expect a Docker installation to be present (or a way to connect to one). There
43+
is a Docker container started with the LDAP server running against which an integration test, per module,
3944
is started.
4045

41-
## Configuration of plugin
46+
## Configuration of Plugins
4247

43-
After build, respective JAR to place to Cassandra `CLASSPATH` (e.g. by placing it to `libs` directory
44-
of Cassandra installation) is located in `target` directory of each build as `casandra-ldap-{c* version}.jar`.
45-
This JAR already contains artifact from `base` so you do not need to take care of it - one JAR is enough.
46-
You may the most probably use a plugin built against a respective version for other Cassandra
47-
versions of the same minor release so you might use 3.11.8 plugin for 3.11.4, for example.
48+
After build, the respective JAR to place to Cassandra `CLASSPATH` (e.g. by placing it to `libs` directory
49+
of Cassandra installation) is located in the `target` directory of each build as `casandra-ldap-{c* version}.jar`.
50+
This JAR already contains artifacts from `base` so you do not need to take care of it-one JAR is enough.
51+
You may at most probably use a plugin built against a respective version for other Cassandra
52+
versions of the same minor release, so you might use 3.11.8 plugin for 3.11.4, for example.
4853

49-
The configuration is ridden by configuration file and system property you need to start Cassandra with
54+
The configuration is ridden by a configuration file and system properties which you need to start Cassandra with
5055
to point that plugin to a configuration file to read properties from.
5156

5257
The system property is `-Dcassandra.ldap.properties.file=/path/to/configiration.properties`. If
5358
not set, it will try to resolve `$CASSANDRA_CONF/ldap.properties`.
5459

55-
The content of the configuration file is as following:
60+
The content of the configuration file is as follows:
5661

5762

5863
|===
@@ -87,13 +92,13 @@ If is *strongly* recommended to use `NetworkTopologyStrategy` for your `system_a
8792

8893

8994
Please be sure that `system_auth` keyspace uses `NetworkTopologyStrategy` with number of replicas equal to number of nodes in DC. If it is not
90-
the case, you can alter your keyspace like:
95+
the case, you can alter your keyspace as follows:
9196

9297
ALTER KEYSPACE system_auth WITH replication = {'class': 'NetworkTopologyStrategy', 'dc1': '3'} AND durable_writes = true;
9398

9499
After this, repair `system_auth` keyspace so it all propagates to other nodes.
95100

96-
They you need to restart your cluster in a rolling fashion. For each node, you need to put this configuration
101+
You need to restart your cluster in a rolling fashion. For each node, you need to add one of these configurations
97102
into `cassandra.yaml` for each node:
98103

99104
### Cassandra 2.2
@@ -138,48 +143,48 @@ For fast testing there is Debian OpenLDAP Docker container
138143

139144
docker run -e LDAP_ADMIN_PASSWORD=admin --rm -d -p 389:389 --name ldap1 osixia/openldap
140145

141-
The `ldap.configuration` file in `conf` directory does not need to be changed and with the above `docker run`, it will work out of the box. You just
142-
have to put it in `$CASSANDRA_CONF` or set respective configuration propery as described above.
146+
The `ldap.configuration` file in the `conf` directory does not need to be changed, and with the above `docker run` it will work out of the box. You just
147+
have to put it in `$CASSANDRA_CONF` or set respective configuration property as described above.
143148

144-
## How it works
149+
## How It Works
145150

146-
LDAPAuthenticator currently supports plain text authorisation requests only in the form of a username and password.
151+
LDAPAuthenticator currently supports plain text authorization requests only in the form of a username and password.
147152
This request is made to the LDAP server over plain text, so you should be using client encryption on the Cassandra
148153
side and secure ldap (ldaps) on the LDAP side.
149154

150155
Credentials are sent from your client to the Cassandra server and then tested against the LDAP server for
151156
authentication using a specified service account. This service account should be configured in the `ldap.properties`
152-
file using the `service_dn` and `service_password` properties. If `service_dn` is set, such role will be created in database,
157+
file using the `service_dn` and `service_password` properties. If `service_dn` is set, such a role will be created in database,
153158
when not already present, upon node's start.
154159

155-
`service_dn` account which will be automatically created will be super user in Cassandra.
160+
`service_dn` account, which will be automatically created, will be super user in Cassandra.
156161

157-
All "normal" roles are not affected they behave exactly as you are used to.
162+
All "normal" roles are not affectedthey behave exactly as you are used to.
158163

159-
If LDAP server connection is lost or there is other communication error while talking to LDAP server,
160-
operator has still a possibility to log in via `cassandra` user as usually and until LDAP server is not back again,
161-
users meant to be authenticated against LDAP server will not be able to log in but all "normal" users will be able to
164+
If the LDAP server connection is lost or there is another communication error while talking to LDAP server,
165+
the operator still has a possibility of logging in via `cassandra` user as usual, and until the LDAP server is not back again;
166+
Users meant to be authenticated against the LDAP server will not be able to log in but all "normal" users will be able to
162167
login and the disruption of LDAP communication will not affect their ability to do so as they live in Cassandra natively.
163168

164169
In case there are two logins of same name (e.g. `admin` in LDAP and `admin` in C*),
165170
in order to distinguish them, if you want to login with LDAP user, you have to
166-
specify its full account name, e.g
171+
specify its full account name, e.g.
167172

168173
cqlsh -u cn=admin,dn=example,dn=org
169174

170-
In case user specifies just `admin` as login name (or any other name, for that matter), it will try to
171-
authenticate against database first and if not successful, against LDAP, adding all details (cn= etc ...) to username automatically.
175+
In case a user specifies just `admin` as login name (or any other name, for that matter), it will try to
176+
authenticate against database first and if not successful against LDAP, adding all details (cn= etc. ...) to username automatically.
172177

173-
It is possible to delete administration role (e.g. role `cassandra`) but if one does that, all administration operations are possible to
174-
be done only via LDAP account. In case LDAP is down, operator would not have any control over DB as `cassandra` is not present anymore.
175-
In such case, it is recommended to create another admin-like user with strong password _before_ `cassandra` role is deleted. Plugin is internally creating new roles
176-
when somebody from LDAP logs in and it is not in DB yet - for this functionality, there needs to be some admin-like user which writes them `system_auth.roles` table.
177-
If you delete `cassandra` user, there is suddenly not such user. You have to restart node and specify this property
178+
It is possible to delete administration role (e.g. role `cassandra`) but if one does that, all administration operations are only able to
179+
be done via LDAP account. In case LDAP is down, the operator would not have any control over DB as `cassandra` is not present anymore.
180+
In such case, it is recommended to create another admin-like user with a strong password _before_ the `cassandra` role is deleted. A plugin is internally creating new roles
181+
when somebody from LDAP logs in and it is not in DB yet. For this functionality, there needs to be some admin-like user which writes them `system_auth.roles` table.
182+
If you delete `cassandra` user, there is suddenly not such user. You have to restart node and specify this property:
178183

179184
-Dcassandra.ldap.admin.user=dba
180185

181186
Where `dba` is _new_ superuser which is able to write to `system_auth.roles` and acts as Cassandra admin.
182187

183188
## Further Information
184189
- See blog by Kurt Greaves ["Apache Cassandra LDAP Authentication"](https://www.instaclustr.com/apache-cassandra-ldap-authentication/)
185-
- Please see https://www.instaclustr.com/support/documentation/announcements/instaclustr-open-source-project-status/ for Instaclustr support status of this project
190+
- Please see https://www.instaclustr.com/support/documentation/announcements/instaclustr-open-source-project-status/ for Instaclustr support status of this project

0 commit comments

Comments
 (0)