You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@cassandra.apache.org by "Yifan Cai (Jira)" <ji...@apache.org> on 2026/10/22 18:45:00 UTC

[jira] [Commented] (CASSSIDECAR-501) Introduce Server-Side Configuration to Enforce Allowed Credential Modes

    [ https://issues.apache.org/jira/browse/CASSSIDECAR-501?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130477#comment-18130477 ] 

Yifan Cai commented on CASSSIDECAR-501:
---------------------------------------

+1

> Introduce Server-Side Configuration to Enforce Allowed Credential Modes
> -----------------------------------------------------------------------
>
>                 Key: CASSSIDECAR-501
>                 URL: https://issues.apache.org/jira/browse/CASSSIDECAR-501
>             Project: Sidecar for Apache Cassandra
>          Issue Type: Improvement
>          Components: Bulk Analytics
>            Reporter: Bernardo Botella Corbi
>            Assignee: Bernardo Botella Corbi
>            Priority: Normal
>             Fix For: 0.5
>
>          Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> The Sidecar relies on client-side payload selection for credential types (introduced in CASSSIDECAR-415). Cluster operators cannot block users from passing insecure STATIC keys if they want to enforce IAM-only configurations across a multi-tenant platform.
> The proposal is to add a validation policy config block to sidecar.yaml (e.g., allowed_credential_types). If a user attempts to submit a restore job with a disabled credential method, the Sidecar server should instantly reject it with an HTTP 400 or HTTP 403 error.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org