7391c9419f
Before this change, it was ensured that a default superuser is created before serving CQL. However, the mechanism didn't wait for default password initialization, so effectively, for a short period, customer couldn't authenticate as the superuser properily. The purpose of this change is to improve the superuser initialization mechanism to wait for superuser default password, just as for the superuser creation. This change: - Introduce authenticator::ensure_superuser_is_created() to allow waiting for complete initialization of super user authentication - Implement ensure_superuser_is_created in password_authenticator, so waiting for superuser password initialization is possible - Implement ensure_superuser_is_create in transitional_authenticator, so the implementation from password_authenticator is used - Implement no-op ensure_superuser_is_create for other authenticators - Modify service::ensure_superuser_is_created to wait for superuser initialization in authenticator, just as it was implemented earlier for role_manager Fixes scylladb/scylladb#20566
68 lines
1.9 KiB
C++
68 lines
1.9 KiB
C++
/*
|
|
* Copyright (C) 2022-present ScyllaDB
|
|
*
|
|
*/
|
|
|
|
/*
|
|
* SPDX-License-Identifier: LicenseRef-ScyllaDB-Source-Available-1.0
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "auth/authenticator.hh"
|
|
#include <boost/regex_fwd.hpp> // IWYU pragma: keep
|
|
|
|
namespace cql3 {
|
|
|
|
class query_processor;
|
|
|
|
} // namespace cql3
|
|
|
|
namespace service {
|
|
class migration_manager;
|
|
class raft_group0_client;
|
|
}
|
|
|
|
namespace auth {
|
|
|
|
extern const std::string_view certificate_authenticator_name;
|
|
|
|
class certificate_authenticator : public authenticator {
|
|
enum class query_source;
|
|
std::vector<std::pair<query_source, boost::regex>> _queries;
|
|
public:
|
|
certificate_authenticator(cql3::query_processor&, ::service::raft_group0_client&, ::service::migration_manager&);
|
|
~certificate_authenticator();
|
|
|
|
future<> start() override;
|
|
future<> stop() override;
|
|
|
|
std::string_view qualified_java_name() const override;
|
|
|
|
bool require_authentication() const override;
|
|
|
|
authentication_option_set supported_options() const override;
|
|
authentication_option_set alterable_options() const override;
|
|
|
|
future<authenticated_user> authenticate(const credentials_map& credentials) const override;
|
|
future<std::optional<authenticated_user>> authenticate(session_dn_func) const override;
|
|
|
|
future<> create(std::string_view role_name, const authentication_options& options, ::service::group0_batch& mc) override;
|
|
future<> alter(std::string_view role_name, const authentication_options& options, ::service::group0_batch&) override;
|
|
future<> drop(std::string_view role_name, ::service::group0_batch&) override;
|
|
|
|
future<custom_options> query_custom_options(std::string_view role_name) const override;
|
|
|
|
const resource_set& protected_resources() const override;
|
|
|
|
::shared_ptr<sasl_challenge> new_sasl_challenge() const override;
|
|
|
|
virtual future<> ensure_superuser_is_created() const override {
|
|
return make_ready_future<>();
|
|
}
|
|
private:
|
|
};
|
|
|
|
}
|
|
|