@ThreadSafe public class DseGssApiAuthProvider extends Object implements com.datastax.oss.driver.api.core.auth.AuthProvider
AuthProvider
that provides GSSAPI authenticator instances for clients to connect to DSE
clusters secured with DseAuthenticator
.
To activate this provider an auth-provider
section must be included in the driver
configuration, for example:
dse-java-driver { auth-provider { class = com.datastax.dse.driver.internal.core.auth.DseGssApiAuthProvider login-configuration { principal = "user principal here ex cassandra@DATASTAX.COM" useKeyTab = "true" refreshKrb5Config = "true" keyTab = "Path to keytab file here" } } }
java.security.auth.login.config
system
property or by adding a login.config.url.n
entry in the java.security
properties file. Alternatively a login-configuration section can be included in the driver
configuration.
See the following documents for further details:
kinit
to obtain a ticket and populate the cache before connecting. JAAS config:
DseClient { com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true renewTGT=true; };
DseClient { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="/path/to/file.keytab" principal="user@MYDOMAIN.COM"; };
"dse"
".
Important: the SASL protocol name should match the username of the Kerberos
service principal used by the DSE server. This information is specified in the dse.yaml file by
the service_principal
option under the kerberos_options
section, and may vary from one DSE installation to another – especially if you installed
DSE with an automated package installer.
For example, if your dse.yaml file contains the following:
kerberos_options:
...
service_principal: cassandra/my.host.com@MY.REALM.COM
The correct SASL protocol name to use when authenticating against this DSE server is "cassandra
".
Should you need to change the SASL protocol name, use one of the methods below:
dse-java-driver { auth-provider { class = com.datastax.dse.driver.internal.core.auth.DseGssApiAuthProvider service = "alternate" } }
dse.sasl.service
system property when starting
your application, e.g. -Ddse.sasl.service=cassandra
.
dse.sasl.service
system property.
Should internal sasl properties need to be set such as qop. This can be accomplished by including a sasl-properties in the driver config, for example:
dse-java-driver { auth-provider { class = com.datastax.dse.driver.internal.core.auth.DseGssApiAuthProvider sasl-properties { javax.security.sasl.qop = "auth-conf" } } }
Modifier and Type | Field and Description |
---|---|
static String |
DEFAULT_SASL_SERVICE_NAME
The default SASL service name used by this auth provider.
|
static String |
SASL_SERVICE_NAME_PROPERTY
The name of the system property to use to specify the SASL service name.
|
Constructor and Description |
---|
DseGssApiAuthProvider(com.datastax.oss.driver.api.core.context.DriverContext context) |
Modifier and Type | Method and Description |
---|---|
void |
close() |
static Configuration |
fetchLoginConfiguration(Map<String,String> options)
Creates a configuration that depends on the given keytab file for authenticating the given
user.
|
com.datastax.oss.driver.api.core.auth.Authenticator |
newAuthenticator(SocketAddress host,
String serverAuthenticator) |
void |
onMissingChallenge(SocketAddress host) |
public static final String DEFAULT_SASL_SERVICE_NAME
public static final String SASL_SERVICE_NAME_PROPERTY
public DseGssApiAuthProvider(com.datastax.oss.driver.api.core.context.DriverContext context)
@NonNull public com.datastax.oss.driver.api.core.auth.Authenticator newAuthenticator(@NonNull SocketAddress host, @NonNull String serverAuthenticator) throws com.datastax.oss.driver.api.core.auth.AuthenticationException
newAuthenticator
in interface com.datastax.oss.driver.api.core.auth.AuthProvider
com.datastax.oss.driver.api.core.auth.AuthenticationException
public void onMissingChallenge(@NonNull SocketAddress host)
onMissingChallenge
in interface com.datastax.oss.driver.api.core.auth.AuthProvider
public void close() throws Exception
close
in interface AutoCloseable
Exception
public static Configuration fetchLoginConfiguration(Map<String,String> options)
Copyright © 2017–2019. All rights reserved.