Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for AstraAuthenticator #123

Merged
merged 2 commits into from
Jan 24, 2024
Merged

Add support for AstraAuthenticator #123

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
96d23e4
Add support for AstraAuthenticator
absurdfarce Jan 19, 2024
ec21a02
Log if we see an unexpected authenticator but still return SASL as th…
absurdfarce Jan 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions proxycore/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,15 @@ type passwordAuth struct {
password string
}

const dseAuthenticator = "com.datastax.bdp.cassandra.auth.DseAuthenticator"
const passwordAuthenticator = "org.apache.cassandra.auth.PasswordAuthenticator"
const astraAuthenticator = "org.apache.cassandra.auth.AstraAuthenticator"

func (d *passwordAuth) InitialResponse(authenticator string) ([]byte, error) {
switch authenticator {
case "com.datastax.bdp.cassandra.auth.DseAuthenticator":
case dseAuthenticator:
return []byte("PLAIN"), nil
case "org.apache.cassandra.auth.PasswordAuthenticator":
case passwordAuthenticator, astraAuthenticator:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would make the "passwordAuthenticator" the default case so we don't run into these issues again in the future (see datastax/zdm-proxy#101 )

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm okay with returning a SASL auth process in the default case but I'd also argue for adding a log message which can record the authenticator if it isn't something we already know about (i.e. some known good SASL authenticator class). My rationale is that if we just return SASL and (for whatever reason) the authenticator in use isn't based on SASL we'll have other weird failures elsewhere which will make it harder to track back to the fact that we were using the wrong authenticator. A simple log message here saying "unexpected authenticator [blah], using SASL auth" if it's something else will help track down what's going on in those cases.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated. With the most recent commit I now see the following (if I artificially make PasswordAuthenticator an "unsupported" authenticator):

$ ./cql-proxy --astra-bundle '/path/to/myscb.zip' --username 'token' --password 'myastratoken'
{"level":"info","ts":1705955428.8055565,"caller":"proxycore/auth.go:48","msg":"Observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}                  
{"level":"info","ts":1705955429.0558403,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:06642708-043d-4e23-
a1a8-6a13a07b84d4"}                                                                                                                                                                                                  
{"level":"info","ts":1705955429.055905,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:6b2830d7-0f45-4eaf-9
2b9-d402dc658605"}                                                                                        
{"level":"info","ts":1705955429.0559106,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:fe706378-1299-4015-
9fca-d613a4cf8a07"}                                                                                       
{"level":"info","ts":1705955429.056024,"caller":"proxy/proxy.go:376","msg":"no local DC configured using DC from the first successful contact point","dc":"us-east-2"}
{"level":"info","ts":1705955429.2330513,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.2406676,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.300766,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.363725,"caller":"proxy/run.go:286","msg":"proxy is listening","address":"[::]:9042"}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice 👍

return d.makeToken(), nil
}
return nil, fmt.Errorf("unknown authenticator: %v", authenticator)
Expand Down
Loading