mirror of
https://github.com/scylladb/scylladb.git
synced 2026-04-21 17:10:35 +00:00
a3db540142
Fixes #10099 Adds the com.scylladb.auth.CertificateAuthenticator type. If set as authenticator, will extract roles from TLS authentication certificate (not wire cert - those are server side) subject, based on configurable regex. Example: scylla.yaml: authenticator: com.scylladb.auth.CertificateAuthenticator auth_superuser_name: <name> auth_certificate_role_queries: - source: SUBJECT query: CN=([^,\s]+) client_encryption_options: enabled: True certificate: <server cert> keyfile: <server key> truststore: <shared trust> require_client_auth: True In a client, then use a certificate signed with the <shared trust> store as auth cert, with the common name <name>. I.e. for cqlsh set "usercert" and "userkey" to these certificate files. No user/password needs to be sent, but role will be picked up from auth certificate. If none is present, the transport will reject the connection. If the certificate subject does not contain a recongnized role name (from config or set in tables) the authenticator mechanism will reject it. Otherwise, connection becomes the role described.
63 lines
1.6 KiB
C++
63 lines
1.6 KiB
C++
/*
|
|
* Copyright (C) 2022-present ScyllaDB
|
|
*
|
|
*/
|
|
|
|
/*
|
|
* SPDX-License-Identifier: AGPL-3.0-or-later
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <boost/regex.hpp>
|
|
#include "auth/authenticator.hh"
|
|
|
|
namespace cql3 {
|
|
|
|
class query_processor;
|
|
|
|
} // namespace cql3
|
|
|
|
namespace service {
|
|
class migration_manager;
|
|
}
|
|
|
|
namespace auth {
|
|
|
|
extern const std::string_view certificate_authenticator_name;
|
|
|
|
class certificate_authenticator : public authenticator {
|
|
enum class query_source;
|
|
std::vector<std::pair<query_source, boost::regex>> _queries;
|
|
public:
|
|
certificate_authenticator(cql3::query_processor&, ::service::migration_manager&);
|
|
~certificate_authenticator();
|
|
|
|
future<> start() override;
|
|
future<> stop() override;
|
|
|
|
std::string_view qualified_java_name() const override;
|
|
|
|
bool require_authentication() const override;
|
|
|
|
authentication_option_set supported_options() const override;
|
|
authentication_option_set alterable_options() const override;
|
|
|
|
future<authenticated_user> authenticate(const credentials_map& credentials) const override;
|
|
future<std::optional<authenticated_user>> authenticate(session_dn_func) const override;
|
|
|
|
future<> create(std::string_view role_name, const authentication_options& options) const override;
|
|
future<> alter(std::string_view role_name, const authentication_options& options) const override;
|
|
future<> drop(std::string_view role_name) const override;
|
|
|
|
future<custom_options> query_custom_options(std::string_view role_name) const override;
|
|
|
|
const resource_set& protected_resources() const override;
|
|
|
|
::shared_ptr<sasl_challenge> new_sasl_challenge() const override;
|
|
private:
|
|
};
|
|
|
|
}
|
|
|