[jira] [Commented] (CASSANDRA-17457) User password strength

["Jackson Fleming (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CASSANDRA-17457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17606525#comment-17606525 ] 

Jackson Fleming commented on CASSANDRA-17457:
---------------------------------------------

Just an update on this, with my day to day job being hectic my work colleague [~smiklosovic] has been driving this change and preparing the CEP for reviews. We are nearly at that point to socialise our solution to this issue.

 

I'm going to re-assign this to him, since it's the actual state of this issue that he's working on it.

> User password strength
> ----------------------
>
>                 Key: CASSANDRA-17457
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-17457
>             Project: Cassandra
>          Issue Type: Improvement
>          Components: Feature/Authorization
>            Reporter: Berenguer Blasi
>            Assignee: Jackson Fleming
>            Priority: Normal
>              Labels: low-hanging-fruit
>             Fix For: 4.x
>
>
> Currently we can create a user with a very insecure password such as 'A'.
> _CREATE ROLE coach WITH PASSWORD = 'A' AND LOGIN = true;_
>  
> As we can see there are no restrictions on length, characters, etc We should discuss and adopt some best practices in this area. A warning would be the preference instead of erroring out. Historically this has been left to be dealt by LDAP or other auth systems so we can't error out.
> Newcomers:
> - We should add warnings when a weak password is provided on DCL CQL. The {{validate}} method looks like a good place at face value. Fell free to analyze and suggest otherwise. See {{ClientWarn}} usages for examples.
> - We should add junit methods for the newly created warnings



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org