[
https://issues.apache.org/jira/browse/CASSANDRA-21546?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102202#comment-18102202
]
Aparna Naik commented on CASSANDRA-21546:
-----------------------------------------
Thanks Stefan and Francisco.. this makes sense to me. I've rebased my branch on
top of `frankgh/CASSANDRA-21546`, so it now includes:
- `IRoleManager.defaultRoleInitializer()` as the composition seam, so it is not
nested under role_manager.parameters config..
- `password_hash` as an alternative to plaintext password in
PasswordDefaultRoleInitializer
- Redaction of password/hash values in `ParameterizedClass#toString()`
I agree with the composition approach over having inheritance here and keeping
`default_role_initializer` top-level will avoid the `Map<String,String>`
flattening problem too..
One thing I noticed while reviewing the diff was that
`AuthConfigTest#testDefaultRoleInitializerWrongTypeRejectedWithoutInitializing`
(the wrong-type-rejection test from my original patch) seems to have dropped
out during the rewrite.
Was that intentional, or did it fall out incidentally? Happy to add it back if
it's just an oversight.
> Support pluggable default role initialization (avoid hardcoded superuser
> password)
> ----------------------------------------------------------------------------------
>
> Key: CASSANDRA-21546
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21546
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Aparna Naik
> Assignee: Aparna Naik
> Priority: Normal
>
> Cassandra's first-boot bootstrap hardcodes the creation of a cassandra
> superuser role with a default password (cassandra). Every new cluster starts
> with this guessable credential exposed until an operator manually rotates or
> drops it, and deployments that already use mutual TLS have no way to
> bootstrap a superuser identity without also creating this password-based one.
> This ticket will make the default role bootstrap pluggable via a new
> IDefaultRoleInitializer interface and default_role_initializer config option.
> The existing password-based behavior will be the default implementation for
> backward compatibility, and it will add a MutualTlsDefaultRoleInitializer
> that instead maps a client certificate identity to the superuser role, so no
> password credential needs to exist at all.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
