[CASSANDRA-18857] Allow CQL client certificate authentication to work without sending an AUTHENTICATE request

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.1
• Component/s: Feature/Encryption
• Change Category: Operability
• Complexity: Normal
• Platform: All
• Impacts: Security

Source Control Link

https://github.com/apache/cassandra/commit/c09d0d929baeaa02f3438313c7979ccf6b4b3c5a

Test and Documentation Plan

Test included in PR:

• AuthenticationTest tests existing code path that ensures AUTHENTICATE request is sent in response to STARTUP with PasswordAuthenticator
• EarlyCertificateAuthenticationTest which validates authentication path where certificate is provided (or not) with MutualTlsAuthenticator.
• MutualTlsWithPasswordFallbackAuthenticatorEarlyCertificateAuthenticationTest additionally validates authentication path where certificate is optionally provided with credentials.

• Assignee: Andy Tolbert
• Reporter: Andy Tolbert

Authors

Andy Tolbert

Reviewers

Abe Ratnofsky, Dinesh Joshi, Francisco Guerrero, Jyothsna Konisa

• Created: 15/Sep/23 21:31
• Updated: 31/Jan/24 01:06
• Resolved: 31/Jan/24 01:06

Description

Currently when using MutualTlsAuthenticator or MutualTlsWithPasswordFallbackAuthenticator a client is prompted with an AUTHENTICATE message to which they must respond with an AUTH_RESPONSE (e.g. a user name and password). This shouldn't be needed as the role can be identified using only the certificate.

To address this, we could add the capability to authenticate early in processing of a STARTUP message if we can determine that both the configured authenticator supports certificate authentication and a client certificate was provided. If the certificate can be authenticated, a READY response is returned, otherwise an ERROR is returned.

This change can be done done in a fully backwards compatible way and requires no protocol or driver changes; I will supply a patch shortly!

Issue Links

• Dependency: CASSANDRA-18811 Set right client auth for creating SSL context in mTLS optional mode
• links to: GitHub Pull Request #2969