Configure SaslauthdAuthenticator
--------------------------------

ScyllaDB can outsource authentication to a third-party utility named `saslauthd <https://linux.die.net/man/8/saslauthd>`_, which, in turn,supports many different authentication mechanisms.
ScyllaDB accomplishes this by providing a custom authenticator named SaslauthdAuthenticator.
This procedure explains how to install and configure it.
Once configured, any login to ScyllaDB is authenticated with the SaslauthdAuthenticator.

**Procedure**

#. Install saslauthd.  The easiest way is via a Linux package, if your package manager supports it.
   Choose a package according to your distro.

   .. tabs::

      .. group-tab:: rpm-based distros

         Use the ``cyrus-sasl`` package

      .. group-tab:: deb-based distros

         Use the ``sasl2-bin`` package


#. Enable the saslauthd service. Run:

   .. code-block:: shell

      systemctl enable saslauthd.service

#. Configure saslauthd: choose the authentication mechanism (e.g., LDAP or PAM) and set the appropriate mechanism-specific parameters by following the `saslauthd documentation <https://linux.die.net/man/8/saslauthd>`_.

#. After every configuration change, restart the saslauthd service.

   .. code-block:: shell

      systemctl restart saslauthd.service

#. Test your configuration using the `testsaslauthd <https://linux.die.net/man/8/testsaslauthd>`_ command. Verify you see a success message.
   If not, verify that the user name and password are correct and then look at the saslauthd logs ( run ``dmesg -H``, and look for ``LOG_AUTH``) to diagnose problems.

#. Find the mux file (saslauthd’s Unix domain socket) and note its full path.

   .. tabs::

      .. group-tab:: rpm-based distros

         Usually, it is /run/saslauthd/mux

      .. group-tab:: deb-based distros

         Usually, it is /var/run/sasl2/mux

#. Once saslauthd is correctly configured and running, you modify the scylla.yaml configuration file, so communication can begin. Modify the following entries:

   * ``authenticator: com.scylladb.auth.SaslauthdAuthenticator``
   * ``saslauthd_socket_path: /path/to/the/mux``

#. Restart the ScyllaDB server.  From now on, ScyllaDB will authenticate all login attempts via saslauthd.

   .. include:: /rst_include/scylla-commands-restart-index.rst

#. Create ScyllaDB roles which **match** the same roles in the LDAP server. To create a role, refer to the :ref:`CQL Reference <cql-security>` and the :doc:`RBAC example <rbac-usecase>`.
