Was this page helpful?
Caution
You're viewing documentation for an unstable version of ScyllaDB Enterprise. Switch to the latest stable version.
Authentication is the process where login accounts and their passwords are verified, and the user is allowed access into the database. Authentication is done internally within ScyllaDB and is not done with a third party. Users and passwords are created with roles using a CREATE ROLE
statement. This procedure enables Authentication on the ScyllaDB servers using a transit state, allowing clients to work with or without Authentication at the same time. In this state, you can update the clients (application using ScyllaDB/Apache Cassandra drivers) one at the time. Once all the clients are using Authentication, you can enforce Authentication on all ScyllaDB nodes as well. If you would rather perform a faster authentication procedure where all clients (application using ScyllaDB/Apache Cassandra drivers) will stop working until they are updated to work with Authentication, refer to Enable Authentication.
This procedure allows you to enable authentication on a live ScyllaDB cluster without downtime.
Update the authenticator
parameter in scylla.yaml
for all the nodes in the cluster: Change authenticator: AllowAllAuthenticator
to authenticator: com.scylladb.auth.TransitionalAuthenticator
.
authenticator: com.scylladb.auth.TransitionalAuthenticator
Run the nodetool drain command (ScyllaDB stops listening to its connections from the client and other nodes).
Restart the nodes one by one to apply the effect.
sudo systemctl restart scylla-server
docker exec -it some-scylla supervisorctl restart scylla
(without restarting some-scylla container)
Login with the default superuser credentials and create an authenticated user with strong password.
For example:
cqlsh -ucassandra -pcassandra
cassandra@cqlsh> CREATE ROLE scylla WITH PASSWORD = '123456' AND LOGIN = true AND SUPERUSER = true;
cassandra@cqlsh> LIST ROLES;
name |super
----------+-------
cassandra |True
scylla |True
Optionally, assign the role to your user. For example:
cassandra@cqlsh> GRANT scylla TO myuser
Login with the new user created and drop the superuser cassandra.
cqlsh -u scylla -p 123456
scylla@cqlsh> DROP ROLE cassandra;
scylla@cqlsh> LIST ROLES;
name |super
----------+-------
scylla |True
Update the authenticator
parameter in scylla.yaml
for all the nodes in the cluster: Change authenticator: com.scylladb.auth.TransitionalAuthenticator
to authenticator: PasswordAuthenticator
.
authenticator: PasswordAuthenticator
Restart the nodes one by one to apply the effect.
sudo systemctl restart scylla-server
docker exec -it some-scylla supervisorctl restart scylla
(without restarting some-scylla container)
Verify that all the client applications are working correctly with authentication enabled.
This procedure allows you to disable authentication on a live ScyllaDB cluster without downtime. Once disabled, you will have to re-enable authentication where required.
Update the authenticator
parameter in scylla.yaml
for all the nodes in the cluster: Change authenticator: PasswordAuthenticator
to authenticator: com.scylladb.auth.TransitionalAuthenticator
.
authenticator: com.scylladb.auth.TransitionalAuthenticator
Restart the nodes one by one to apply the effect.
sudo systemctl restart scylla-server
Update the authenticator
parameter in scylla.yaml
for all the nodes in the cluster: Change authenticator: com.scylladb.auth.TransitionalAuthenticator
to authenticator: AllowAllAuthenticator
.
authenticator: AllowAllAuthenticator
Restart the nodes one by one to apply the effect.
sudo systemctl restart scylla-server
docker exec -it some-scylla supervisorctl restart scylla
(without restarting some-scylla container)
Verify that all the client applications are working correctly with authentication disabled.
Was this page helpful?