You are viewing a plain text version of this content. The canonical link for it is here.
Posted to pr@cassandra.apache.org by "jcshepherd (via GitHub)" <gi...@apache.org> on 2025/08/15 22:12:13 UTC
[PR] Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN… [cassandra]
jcshepherd opened a new pull request, #4319:
URL: https://github.com/apache/cassandra/pull/4319
…DRA-20834)
Implementing DatabaseDescriptor.isAuthenticationRequired() and removing calls made to DatabaseDescriptor.getAuthenticator() from code that needs to know whether the node is enforcing authentication or not. Prerequisite to enabling per-connection authenticator selection (CEP-50).
https://cwiki.apache.org/confluence/display/CASSANDRA/CEP-50%3A+Authentication+Negotiation
https://issues.apache.org/jira/browse/CASSANDRA-20834
Patch by jcshepherd@; reviewed by TBD
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For additional commands, e-mail: pr-help@cassandra.apache.org
Re: [PR] Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN… [cassandra]
Posted by "jcshepherd (via GitHub)" <gi...@apache.org>.
jcshepherd commented on code in PR #4319:
URL: https://github.com/apache/cassandra/pull/4319#discussion_r2283366403
##########
src/java/org/apache/cassandra/auth/NetworkPermissionsCache.java:
##########
@@ -36,7 +36,7 @@ public NetworkPermissionsCache(INetworkAuthorizer authorizer)
DatabaseDescriptor::getRolesCacheActiveUpdate,
authorizer::authorize,
authorizer.bulkLoader(),
- () -> DatabaseDescriptor.getAuthenticator().requireAuthentication());
+ DatabaseDescriptor::isAuthenticationRequired);
Review Comment:
The intent of this PR, illustrated here, is to remove the assumption that a node will be configured with a single authenticator. (The dependency shows up in a couple other ways, which will be addressed with other PRs.) With CEP-50, a node may be configured with multiple authenticators, and decide at connection time which authenticator a given connection will use. In a future change, DatabaseDescriptor will have logic to determine if at least one configured authenticator requires authentication, but for now it's just passing the call through to its configured authenticator.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For additional commands, e-mail: pr-help@cassandra.apache.org
Re: [PR] Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN… [cassandra]
Posted by "jcshepherd (via GitHub)" <gi...@apache.org>.
jcshepherd commented on code in PR #4319:
URL: https://github.com/apache/cassandra/pull/4319#discussion_r2283368714
##########
src/java/org/apache/cassandra/config/DatabaseDescriptor.java:
##########
@@ -1969,6 +1969,15 @@ public static void setAuthenticator(IAuthenticator authenticator)
DatabaseDescriptor.authenticator = authenticator;
}
+ /**
+ * Indicates if this node uses an authenticator that requires authentication.
+ */
+ public static boolean isAuthenticationRequired()
+ {
+ return DatabaseDescriptor.getAuthenticator().requireAuthentication();
+ }
+
Review Comment:
This simple delegation will be replaced once support for configuring multiple authenticators is added.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For additional commands, e-mail: pr-help@cassandra.apache.org
Re: [PR] Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN… [cassandra]
Posted by "jcshepherd (via GitHub)" <gi...@apache.org>.
jcshepherd closed pull request #4319: Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN…
URL: https://github.com/apache/cassandra/pull/4319
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For additional commands, e-mail: pr-help@cassandra.apache.org
Re: [PR] Implementing isAuthenticationRequired() in DatabaseDescriptor (CASSAN… [cassandra]
Posted by "jcshepherd (via GitHub)" <gi...@apache.org>.
jcshepherd commented on PR #4319:
URL: https://github.com/apache/cassandra/pull/4319#issuecomment-3229996237
I'm going to close this pull request and come back again in a bit with something more "complete". This PR is complete on its own in the sense of being a self-contained change but I think it's too surgical for it to be obvious what the real intent is (which is to remove the assumption of a node having a single configured authenticator). I'll submit a separate pull request with the full set of changes needed to do that, and I think that'll make it easier to understand the impact. Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@cassandra.apache.org
For additional commands, e-mail: pr-help@cassandra.apache.org