[jira] [Commented] (CASSANDRA-14497) Add Role login cache

["Sam Tunnicliffe (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CASSANDRA-14497?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16586078#comment-16586078 ] 

Sam Tunnicliffe commented on CASSANDRA-14497:
---------------------------------------------

Sorry for taking so long to respond [~jay.zhuang]...
{quote}1. Why do we need login?
{quote}
Permissions can be grouped together by assigning them to roles, which can then be granted to other roles. {{LOGIN}} is the way to differentiate these logical roles from ones which represent 'real' database users.
{quote}2. Should login check be part of authN or authZ
{quote}
Both login and superuser privs are part of authz really. They can be thought of as permissions which aren't linked to a particular resource in the authz hierarchy and for this reason they're defined and managed purely at the role level.

FWIW, this is mostly based on the postgres approach ([https://www.postgresql.org/docs/current/static/role-attributes.html]), though some role-level attributes they define *can* be easily modelled as C* permissions (e.g. role creation) or don't apply to us (replication permission).

bq.So would it be better to have canLogin, isSuper information in CredentialsCache (maybe we should change the cache name)?
Each of the various auth caches have what amounts to a 1:1 relationship with a (pluggable) component of the auth subsystem. The `IAuthenticator` impl is responsible purely for validating credentials and so for the `CredentialsCache`. The `IAuthorizer` handles permissions, the `INetworkAuthorizer`, DC access rights etc. The components are intended to be granular enough to allow different implementations to be swapped in independently (though of course, this isn't perfect). We could compose the caches differently so that they interact with multiple components, but that seems complicated and a bit unnecessary.

IMO, the important thing to address in this issue is that the current `RolesCache` implementation just doesn't contain all of the frequently used role-level info, which means we have to hit the actual role manager far too often.

> Add Role login cache
> --------------------
>
>                 Key: CASSANDRA-14497
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-14497
>             Project: Cassandra
>          Issue Type: Improvement
>          Components: Auth
>            Reporter: Jay Zhuang
>            Assignee: Sam Tunnicliffe
>            Priority: Major
>              Labels: security
>             Fix For: 4.0
>
>
> The [{{ClientState.login()}}|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/service/ClientState.java#L313] function is used for all auth message: [{{AuthResponse.java:82}}|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/transport/messages/AuthResponse.java#L82]. But the [{{role.canLogin}}|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L521] information is not cached. So it hits the database every time: [{{CassandraRoleManager.java:407}}|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L407]. For a cluster with lots of new connections, it's causing performance issue. The mitigation for us is to increase the {{system_auth}} replication factor to match the number of nodes, so [{{local_one}}|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L488] would be very cheap. The P99 dropped immediately, but I don't think it is not a good solution.
> I would purpose to add {{Role.canLogin}} to the RolesCache to improve the auth performance.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org