JarCasting
JarCasting JarCasting

Cassandra Kerberos Authenticator Base Module

Base plugin artifact for Apache Cassandra to authenticate via GSS-API

License

License
Categories

Categories

Cassandra Data Databases
GroupId

GroupId

com.instaclustr
ArtifactId

ArtifactId

cassandra-kerberos-base
Last Version

Last Version

1.0.0
Release Date

Release Date
Type

Type

jar
Description

Description

Cassandra Kerberos Authenticator Base Module
Base plugin artifact for Apache Cassandra to authenticate via GSS-API
Project Organization

Project Organization

Instaclustr

Download cassandra-kerberos-base

Filename Size
cassandra-kerberos-base-1.0.0.pom
cassandra-kerberos-base-1.0.0.jar 15 KB
cassandra-kerberos-base-1.0.0-sources.jar 7 KB
cassandra-kerberos-base-1.0.0-javadoc.jar 39 KB
Browse

How to add to project

<!-- https://jarcasting.com/artifacts/com.instaclustr/cassandra-kerberos-base/ -->
<dependency>
    <groupId>com.instaclustr</groupId>
    <artifactId>cassandra-kerberos-base</artifactId>
    <version>1.0.0</version>
</dependency>
// https://jarcasting.com/artifacts/com.instaclustr/cassandra-kerberos-base/
implementation 'com.instaclustr:cassandra-kerberos-base:1.0.0'
// https://jarcasting.com/artifacts/com.instaclustr/cassandra-kerberos-base/
implementation ("com.instaclustr:cassandra-kerberos-base:1.0.0")
'com.instaclustr:cassandra-kerberos-base:jar:1.0.0'
<dependency org="com.instaclustr" name="cassandra-kerberos-base" rev="1.0.0">
  <artifact name="cassandra-kerberos-base" type="jar" />
</dependency>
@Grapes(
@Grab(group='com.instaclustr', module='cassandra-kerberos-base', version='1.0.0')
)
libraryDependencies += "com.instaclustr" % "cassandra-kerberos-base" % "1.0.0"
[com.instaclustr/cassandra-kerberos-base "1.0.0"]

Dependencies

provided (1)

Group / Artifact Type Version
org.apache.cassandra : cassandra-all jar 3.11.9

Project Modules

There are no modules declared in this project.

Cassandra Kerberos Authenticator

A GSSAPI authentication provider for Apache Cassandra

Instaclustr

This authenticator plugin is intended to work with the Cassandra Java Driver Kerberos Authenticator plugin for the Cassandra Java driver.

Supported versions:

  • 2.2

  • 3.0

  • 3.11

  • 4.0

Warning
if you install / configure this authenticator, with open source Cassandra, for now, you will not be able to connect through CQL shell anymore as this functionality is not implemented in CQL shell yet. This authenticator is meant to be used only in connection with Java applications for which you need to setup your driver to use Kerberos Java driver, also from Instaclustr.

Build

To build the project, just run mvn clean install.

The project is organised into modules, each module per major Cassandra version. You will find in target of each module for respective Cassandra version:

  • JAR

  • DEB package

  • RPM package

Environment set-up

  1. Ensure that the following pre-requisite systems are configured:

    • A unique DNS record is created for each node (use hostname -f on each node to verify that the DNS FQDN is configured)

    • A reverse DNS record is created for each node, matching the broadcast_rpc_address

    • A Kerberos 5 KDC server is available

    • Kerberos client libraries are installed on each Cassandra node

    • An NTP client is installed & configured on each Cassandra node. Ideally the Cassandra nodes sync with the same time source as the KDC in order to minimise potential time-sync issues.

    • If using Oracle Java, ensure that the Java Cryptographic Extensions Unlimited Strength Jurisdiction Policy Files are installed (not necessary when using OpenJDK or other JRE implementations)

  2. Ensure that the value of rpc_address (and optionally broadcast_rpc_address, if using) in the cassandra.yaml config file is not set to localhost. Reverse-DNS records must be created to match the broadcast_rpc_address. This enables clients to resolve the Kerberos service principal’s hostname from the IP address.

  3. Configure the /etc/krb5.conf Kerberos config file on each node (see here for further details). Below is an example krb5.conf for an EXAMPLE.COM Kerberos realm:

    [logging]
default = FILE:/var/log/krb5libs.log
[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
[realms]
 EXAMPLE.COM = {
  kdc = kdc.example.com
  admin_server = kdc.example.com
}
[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

  4. For each cassandra node, create a new Kerberos service principal (see here for further details) Note that the service name portion of the principal (cassandra, in this example) must be the same for each node in the cluster, and must also match the SASL protocol name specified when configuring the Cassandra Java driver Kerberos authenticator. The hostname portion of the principal (e.g. node1.mycluster.example.com) must match the DNS entry for each Cassandra node.

    kadmin -q "addprinc -randkey cassandra/[email protected]"
kadmin -q "addprinc -randkey cassandra/[email protected]"
kadmin -q "addprinc -randkey cassandra/[email protected]"

  5. Create a keytab for each newly created service principal (see here for further details)

    kadmin -q "ktadd -k /node1.keytab cassandra/[email protected]"
kadmin -q "ktadd -k /node2.keytab cassandra/[email protected]"
kadmin -q "ktadd -k /node3.keytab cassandra/[email protected]"

  6. Copy the corresponding keytab file to the Cassandra configuration directory on each node, and set the appropriate access controls

    scp kdc.example.com:/node1.keytab /etc/cassandra/node1.keytab
chown cassandra:cassandra /etc/cassandra/node1.keytab
chmod 400 /etc/cassandra/node1.keytab

Install & configure the Kerberos authenticator

  1. Copy the cassandra-krb5.properties file to the Cassandra configuration directory on each node (e.g. /etc/cassandra/conf or /etc/cassandra, based on OS). Set service_principal and keytab to correspond to the service principals and keytabs created in the previous steps.

    service_principal=cassandra/[email protected]
keytab=node1.keytab
qop=auth

  2. Copy the authenicator jar to the Cassandra lib directory (e.g. /usr/share/cassandra/lib/)

  3. Set the authenticator option in the cassandra.yaml config file.

    authenticator: com.instaclustr.cassandra.auth.KerberosAuthenticator

You may control where to fetch the configuration file from by system property set upon Cassandra startup, for example -Dcassandra.krb5.config=/path/to/conf.properties

In case you are using packages, JAR and conf file is installed into the right place automatically.

In case you are Please see status for Instaclustr support status of this project

com.instaclustr

Instaclustr

Versions

Version
1.0.0