CEP-50/CASS-21334: Server negotiates authenticator per client connection#4773

Open

jcshepherd wants to merge 31 commits intoapache:trunkfrom

jcshepherd:jcshepherd/21334/trunk

Commits on Apr 6, 2026

Enable IAuthenticator to declare supported and alterable role options (CASSANDRA-20834 for CEP-50)
jcshepherd
committed
Factoring out assumption of a single authenticator node-wide (CASSANDRA-20834)
jcshepherd
committed
Merging down from trunk and feature branch.
jcshepherd
committed
Reverting DatabaseDescriptor.applyGuardrails() to private, switching to DatabaseDescriptor.unsafeDaemonInitialization() in AuthConfigTest to enable each test to run against the appropriate auth con…
jcshepherd
committed
ParameterizedClass.toString() has consistent form whether or not there are parameters
jcshepherd
committed
Add configuration parsing and evaluation to configure negotiated authentication
jcshepherd
committed
Use normalized (lowercase, Locale.ROOT charset) for equals() and hashCode() computations
jcshepherd
committed
Implement configuration for authenticator negotiation as well as the basic negotiation mechanism
jcshepherd
committed
Support authenticator negotiation parameters in OPTIONS, SUPPORTED and STARTUP messages
jcshepherd
committed
Correcting test configuration to specify the default authenticator as an object, not a list, and adding notes on why it matters. Still a sharp edge ...
jcshepherd
committed
Correct default_authenticator specification from list-style toobject-style
jcshepherd
committed
ClientState.isOrdinaryUser() avoids checks on authentication being enabled during node initialization, when all clients are system/internal
jcshepherd
committed
ServerConnection uses per-client authenticator for the authentication handshake, client super- and anonymous-user determination is made based on the authenticator used by the client, not the node's…
jcshepherd
committed
Grrr ... Whitespace cleanup on the previous commit
jcshepherd
committed
CassandraDaemon handles auth setup during node initialization, instead of StorageService. Auth setup includes ensuring all negotiable authenticators are initialized.
jcshepherd
committed
Missed from previous commit: JMX AuthorizationProxy calls CassandraDaemon to set up auth
jcshepherd
committed
Missed from previous commit: d-test AuthTest calls CassandraDaemon to set up auth
jcshepherd
committed
DatabaseDescriptor's global authenticator now called defaultAuthenticator. Test updates to initialize client state and use a marker class to distinguish between authenticator returned by default vs…
jcshepherd
committed
DatabaseDescriptor.isAuthenticationRequired() indicates if any configured authenticator requires authentication. ClientState disallows anonymous (unauthenticated) users from assuming super user pri…
jcshepherd
committed
AuthConfig enforces the require_authentication flag for negotiated authentication, and validates authorizer compatibility with the authentication configuration
jcshepherd
committed
Additional test configuration files for AuthConfigTest
jcshepherd
committed
Correcting test description
jcshepherd
committed
Adding dtests that exercise a non-negotiating client against a server with and without auth negotiation enabled
jcshepherd
committed
Removing duplicate, unused code in OptionsMessage - currently handled in InitConnectionHandler
jcshepherd
committed
Addressing checkstyle complaints
jcshepherd
committed

Commits on Apr 24, 2026

Commits on Apr 27, 2026

Commits on Apr 28, 2026

Further self-review: changes mostly for readability and a bit moore conciseness
jcshepherd
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CEP-50/CASS-21334: Server negotiates authenticator per client connection#4773

CEP-50/CASS-21334: Server negotiates authenticator per client connection#4773
jcshepherd wants to merge 31 commits intoapache:trunkfrom
jcshepherd:jcshepherd/21334/trunk

Commits on Apr 6, 2026

Enable IAuthenticator to declare supported and alterable role options (CASSANDRA-20834 for CEP-50)

Factoring out assumption of a single authenticator node-wide (CASSANDRA-20834)

Merging down from trunk and feature branch.

Reverting DatabaseDescriptor.applyGuardrails() to private, switching to DatabaseDescriptor.unsafeDaemonInitialization() in AuthConfigTest to enable each test to run against the appropriate auth con…

ParameterizedClass.toString() has consistent form whether or not there are parameters

Add configuration parsing and evaluation to configure negotiated authentication

Use normalized (lowercase, Locale.ROOT charset) for equals() and hashCode() computations

Implement configuration for authenticator negotiation as well as the basic negotiation mechanism

Support authenticator negotiation parameters in OPTIONS, SUPPORTED and STARTUP messages

Correcting test configuration to specify the default authenticator as an object, not a list, and adding notes on why it matters. Still a sharp edge ...

Correct default_authenticator specification from list-style toobject-style

ClientState.isOrdinaryUser() avoids checks on authentication being enabled during node initialization, when all clients are system/internal

ServerConnection uses per-client authenticator for the authentication handshake, client super- and anonymous-user determination is made based on the authenticator used by the client, not the node's…

Grrr ... Whitespace cleanup on the previous commit

CassandraDaemon handles auth setup during node initialization, instead of StorageService. Auth setup includes ensuring all negotiable authenticators are initialized.

Missed from previous commit: JMX AuthorizationProxy calls CassandraDaemon to set up auth

Missed from previous commit: d-test AuthTest calls CassandraDaemon to set up auth

DatabaseDescriptor's global authenticator now called defaultAuthenticator. Test updates to initialize client state and use a marker class to distinguish between authenticator returned by default vs…

DatabaseDescriptor.isAuthenticationRequired() indicates if any configured authenticator requires authentication. ClientState disallows anonymous (unauthenticated) users from assuming super user pri…

AuthConfig enforces the require_authentication flag for negotiated authentication, and validates authorizer compatibility with the authentication configuration

Additional test configuration files for AuthConfigTest

Correcting test description

Adding dtests that exercise a non-negotiating client against a server with and without auth negotiation enabled

Removing duplicate, unused code in OptionsMessage - currently handled in InitConnectionHandler

Addressing checkstyle complaints

Commits on Apr 24, 2026

Merge branch 'trunk' into jcshepherd/21334/trunk

Deleting duplicate methods introduced by merge error

Commits on Apr 27, 2026

Commenting out new authentication_negotiation configuration and provided reasonable default values

Self-review corrections: simplifying AuthConfig, implementing password cache in PasswordAuthenticator as a singleton, minor code and comment clean-up elsewhere

Making checkstyle happy again

Commits on Apr 28, 2026

Further self-review: changes mostly for readability and a bit moore conciseness