[CASSANDRA-19946] Allow configuration parameters for IAuthorizer, INetworkAuthorizer, and IRoleManager

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.0.2, 5.1
• Component/s: Feature/Authorization
• Change Category: Operability
• Complexity: Low Hanging Fruit
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/2dea5c75882ee2caaaac0ae5b84f9d6b66c46b2e

Test and Documentation Plan

Changes enable parameters for custom authorization implementations. Default auth implementations are unchanged.

• Assignee: Tiago L. Alves
• Reporter: Tiago L. Alves

Authors

Tiago L. Alves

Reviewers

Michael Semb Wever, Stefan Miklosovic

• Created: 23/Sep/24 17:06
• Updated: 16/Oct/24 12:05
• Resolved: 09/Oct/24 12:02

Description

The implementation of custom authentication / authorization can be achieved by implementing IAuthenticator, IAuthorizer, IRoleManager, and other interfaces and configured in cassandra.yaml.

IAuthenticator implementations, for instance, can additionally read extra configuration parameters via a map of strings defined in cassandra.yaml.

Examples of valid configurations are:

authenticator: com.example.auth.CustomAuthenticator

or

authenticator:
  class_name : com.example.auth.CustomAuthenticator
  parameters :
    param1 : value1
    param2 : value2

This enables a C* admin to conveniently define and parameterize it's own custom Authenticator directly in cassandra.yaml.

This parameterization is currently enabled for Authenticator and CIDRAuthorizer implementations only and is missing for Authorizer, RoleManager, and NetworkAuthorizer.

To enable a C* admin to set and parameterize custom authentication/authorization implementations we should enable parametrization of all Authorizer, RoleManager, and NetworkAuthorizer implementations. This can be achieved by instantiating all auth-related implementations via ParameterizedClass.

From an user point of view, configuring existent authenticators/authorizators will have no visible changes.

Issue Links

• is related to: CASSANDRA-20002 Add latest test config for dynamic_remote batchlog_endpoint_strategy and new auth parameterizedClass maps
• links to: GitHub Pull Request #3564
• links to: GitHub Pull Request #3600