[CASSANDRA-17334] Pre hashed passwords in CQL

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 4.1-alpha1, 4.1
• Component/s: Feature/Authorization
• Change Category: Operability
• Complexity: Normal
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/30ad754d7e95501ffa916bf986e4cfda1aa5e441

Test and Documentation Plan

See PR

• Assignee: Berenguer Blasi
• Reporter: Berenguer Blasi

Authors

Berenguer Blasi

Reviewers

Andres de la Peña

• Created: 02/Feb/22 09:49
• Updated: 06/Feb/23 03:43
• Resolved: 23/Mar/22 06:30

Description

As seen on CASSANDRA-16801 and friends we are working across the system with plain text passwords. These can be unintentionally revealed by intermediate systems. Allowing the use of hashed passwords should mitigate that. The idea is to add a new option HASHED PASSWORD for CREATE/ALTER ROLE/USER. Examples:

CREATE ROLE foo WITH login = true AND hashed password = '$2a$10$JSJEMFm6GeaW9XxT5JIheuEtPvat6i7uKbnTcxX3c1wshIIsGyUtG';
ALTER ROLE foo WITH hashed password = '$2a$10$JSJEMFm6GeaW9XxT5JIheuEtPvat6i7uKbnTcxX3c1wshIIsGyUtG';

To generate the password hash, there will be a new tool hash_password in resources/cassandra/bin

Based on original works from snazy

Issue Links

• is a child of: CASSANDRA-16801 PasswordObfuscator should not assume PASSWORD is the last item in the WITH clause
• is a parent of: CASSANDRA-17494 Pre hashed passwords in CQL docs
• is a parent of: CASSANDRA-17457 CEP-24 - Password validation/generation
• is related to: CASSANDRA-18237 Write documentation for hashed passwords
• links to: CASSANDRA-17334 PR trunk