You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Andy Tolbert (Jira)" <ji...@apache.org> on 2023/12/06 19:45:00 UTC
[jira] [Commented] (CASSANDRA-18857) Allow CQL client certificate authentication to work without sending an AUTHENTICATE request
[ https://issues.apache.org/jira/browse/CASSANDRA-18857?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17793913#comment-17793913 ]
Andy Tolbert commented on CASSANDRA-18857:
------------------------------------------
Apologies for the late follow up here. Realized that for this to fully work [CASSANDRA-18811] is needed. I've created a [pull request|https://github.com/apache/cassandra/pull/2969] that I will update as soon as [CASSANDRA-18811] lands in trunk.
> Allow CQL client certificate authentication to work without sending an AUTHENTICATE request
> -------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-18857
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18857
> Project: Cassandra
> Issue Type: Improvement
> Components: Feature/Encryption
> Reporter: Andy Tolbert
> Priority: Normal
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Currently when using {{MutualTlsAuthenticator}} or {{MutualTlsWithPasswordFallbackAuthenticator}} a client is prompted with an {{AUTHENTICATE}} message to which they must respond with an {{AUTH_RESPONSE}} (e.g. a user name and password). This shouldn't be needed as the role can be identified using only the certificate.
> To address this, we could add the capability to authenticate early in processing of a {{STARTUP}} message if we can determine that both the configured authenticator supports certificate authentication and a client certificate was provided. If the certificate can be authenticated, a {{READY}} response is returned, otherwise an {{ERROR}} is returned.
> This change can be done done in a fully backwards compatible way and requires no protocol or driver changes; I will supply a patch shortly!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org