DataStax Enterprise 3.0 Documentation

Managing object permissions using internal authorization

You use familiar relational database GRANT/REVOKE paradigm to grant or revoke permissions to access Cassandra data. A superuser grants initial permissions, and subsequently a user may or may not be given the permission to grant/revoke permissions. Object permission management is independent of authentication (works with Kerberos or Cassandra).

Accessing system resources

Read access to these system tables is implicitly given to every authenticated user because the tables are used by most Cassandra tools:

  • system.schema_keyspace
  • system.schema_columns
  • system.schema_columnfamilies
  • system.local
  • system.peers

Configuration

To configure internal authorization for managing object permissions:

  1. Specify the authorizer in the cassandra.yaml by uncommenting this option:

    authorizer: com.datastax.bdp.cassandra.auth.CassandraAuthorizer

    You can use any authenticator except AllowAll.

  2. Configure the dse_auth keyspace replication factor.

  3. Fetching permissions can be an expensive operation. If necessary, adjust the validity period for permissions caching by setting the permissions_validity_in_ms option in the cassandra.yaml. You can also disable permission caching by setting this option to 0.

CQL 3 supports the following authorization statements, which are described in the CQL alphabetical security command reference: