- DataStax Enterprise 2.0 Documentation (PDF)
- DataStax Enterprise 1.0 Documentation (PDF)
- DataStax Community Documentation
- OpsCenter Documentation (PDF)
- Cassandra 1.0 (PDF)
- Introduction to Apache Cassandra
- Getting Started with Cassandra and DataStax Community Edition
- Understanding the Cassandra Architecture
- Installing and Initializing a Cassandra Cluster
- Understanding the Cassandra Data Model
- Managing and Accessing Data in Cassandra
- Configuration
- Operations
- References
- Troubleshooting Guide
- Getting Started with DataStax Enterprise and Analytics
- Cassandra 0.8
- Cassandra 0.7
- Cassandra 0.6
Apache Cassandra 1.0 Documentation
Authentication and Authorization Configuration¶
Note
The SimpleAuthenticator and SimpleAuthority classes have been moved to the example directory of the Apache Cassandra project repository as of release 1.0. They are no longer available in the packaged and binary distributions. They never provided actual security, and in their current state are only meant as examples.
Using authentication and authorization requires configuration changes in cassandra.yaml and two additional files: one for assigning users and their permissions to keyspaces and column families, and the other for assigning passwords to those users. These files are named access.properties and passwd.properties, respectively, and are located in the examples directory of the Apache Cassandra project repository. To test simple authentication, you can move these files to the conf directory.
To set up simple authentication and authorization
- Edit cassandra.yaml, setting org.apache.cassandra.auth.SimpleAuthenticator as the authenticator value. The default value of AllowAllAuthenticator is equivalent to no authentication.
- Edit access.properties, adding entries for users and their permissions to read and write to specified keyspaces and column families. See access.properties below for details on the correct format.
- Make sure that users specified in access.properties have corresponding entries in passwd.properties. See passwd.properties below for details and examples.
- After making the required configuration changes, you must specify the properties files when starting Cassandra with the flags -Dpasswd.properties and -Daccess.properties. For example:
cd <install_location>
sh bin/cassandra -f -Dpasswd.properties=conf/passwd.properties -Daccess.properties=conf/access.properties
access.properties¶
This file contains entries in the format KEYSPACE[.COLUMNFAMILY].PERMISSION=USERS where
- KEYSPACE is the keyspace name.
- COLUMNFAMILY is the column family name.
- PERMISSION is one of <ro> or <rw> for read-only or read-write respectively.
- USERS is a comma delimited list of users from passwd.properties.
For example, to control access to Keyspace1 and give jsmith and Elvis read-only permissions while allowing dilbert full read-write access to add and remove column families, you would create the following entries:
Keyspace1.<ro>=jsmith,Elvis Presley
Keyspace1.<rw>=dilbert
To provide a finer level of access control to the Standard1 column family in Keyspace1, you would create the following entry to allow the specified users read-write access:
Keyspace1.Standard1.<rw>=jsmith,Elvis Presley,dilbert
The access.properties file also contains a simple list of users who have permissions to modify the list of keyspaces:
<modify-keyspaces>=jsmith
passwd.properties¶
This file contains name/value pairs in which the names match users defined in access.properties and the values are user passwords. Passwords are in clear text unless the passwd.mode=MD5 system property is provided.
jsmith=havebadpass
Elvis Presley=graceland4ever
dilbert=nomoovertime
© 2012 DataStax Inc.All Rights Reserved
