{"id":16880062,"url":"https://github.com/anderseknert/cassandra-opa-authorizer-poc","last_synced_at":"2026-05-20T04:48:52.116Z","repository":{"id":109366999,"uuid":"402434350","full_name":"anderseknert/cassandra-opa-authorizer-poc","owner":"anderseknert","description":"OPA proof of concept authorizer for Apache Cassandra","archived":false,"fork":false,"pushed_at":"2021-09-02T13:44:00.000Z","size":60,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-14T20:50:41.554Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anderseknert.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-09-02T13:39:17.000Z","updated_at":"2021-09-03T11:01:56.000Z","dependencies_parsed_at":"2023-04-26T08:01:02.883Z","dependency_job_id":null,"html_url":"https://github.com/anderseknert/cassandra-opa-authorizer-poc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fcassandra-opa-authorizer-poc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fcassandra-opa-authorizer-poc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fcassandra-opa-authorizer-poc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fcassandra-opa-authorizer-poc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anderseknert","download_url":"https://codeload.github.com/anderseknert/cassandra-opa-authorizer-poc/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244538595,"owners_count":20468746,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T15:57:08.752Z","updated_at":"2026-05-20T04:48:47.092Z","avatar_url":"https://github.com/anderseknert.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cassandra OPA Authorizer POC\n\nOpen Policy Agent (OPA) Authorizer for Apache Cassandra Proof of Concept.\n\nThis repository contains POC code to implement a [custom authorizer](https://cassandra.apache.org/doc/latest/cassandra/operating/security.html#authorization) calling out to OPA for authorization decisions.\n\nThe proof of concept didn't turn out to my liking, as the Cassandra [authorizer interface](https://github.com/apache/cassandra/blob/12078910549c6c6e9474f8efb3ef274fa7de8209/src/java/org/apache/cassandra/auth/IAuthorizer.java) \ndoesn't really allow for the authorizer to make _decisions_. Rather, the authorizer accepts as input the user (including\nroles) and the resource being accessed or modified, but not the actual **action** attempted. Instead, the responsibility \nof the authorizer is to return a set of permissions applicable to the user/resource combination. This works well if the \n\"authorizer\" is something like a database table, listing applicable grants for a user on any given resource. It is \nhowever not well suited for a model where the authorizer makes the actual authorization _decision_, like how OPA \nnormally operates. \n\nWhile we could certainly have OPA return a set of permissions (like `ALTER`, `DROP`, etc) based on \nany given user and resource name, this doesn't utilize the power of OPA as a decision engine, but would more resemble an\nin-memory database for permissions. Another consequence of this is that decision logging (one of OPA's super powers) \ncan't actually log decisions, but would only be able to list requests like \"User X attempted something with resource Y\".\nThis can be seen when enabling decision logging in OPA, and inspecting the `input` object:\n\n```json\n{\n  \"resource\": {\n    \"level\": \"table\",\n    \"name\": \"data/test_keyspace2/emp\",\n    \"parent\": {\n      \"level\": \"keyspace\",\n      \"name\": \"data/test_keyspace2\",\n      \"parent\": {\n        \"level\": \"root\",\n        \"name\": \"data\",\n        \"parent\": null\n      }\n    }\n  },\n  \"user\": {\n    \"name\": \"testing\",\n    \"roles\": [\n      \"roles/testing\"\n    ]\n  }\n}\n```\n\nSince neither the resource nor the user contains the action performed, we can't make an informed decision on whether to\nallow or deny the request.\n\n## Conclusion\n\nWhile Apache Cassandra in its current version (4.0) provides an extensible authorization mechanism, it is not well \nsuited for a decision engine like OPA. Had the action performed been included in the request to the authorizer, OPA (and\nother decision engines) would have been an interesting option for externalized authorization.\n\n## Install and run the POC authorizer\n\n1. `./gradlew shadowJar \u0026\u0026 cp build/libs/cassandra-opa-authorizer-1.0-SNAPSHOT-all.jar \"${CASSANDRA_DIR}/lib/\"`\n2. Edit the `cassandra.yaml` configuration file to include the following values:\n\n```yaml\nauthenticator: PasswordAuthenticator\nauthorizer: com.eknert.cassandra.OpaAuthorizer\n```\n3. Start Cassandra\n4. Start OPA with decision logging enabled: `opa run --server --log-format text --set decision_logs.console=true`\n5. As a non-superuser, do any action requiring authorization, like creating a keyspace, a table, etc:\n\n```cassandraql\nCREATE KEYSPACE test_keyspace\nWITH replication = {'class':'SimpleStrategy', 'replication_factor' : 1};\n```\n6. Inspect data provided from the authorizer in the OPA decision log.\n\nNOTE that the POC authorizer currently ignores the response from OPA - had we wanted to continue working under this \nmodel we would have our OPA policy return a set of permissions, which we would have the authorizer read in and convert\ninto \"real\" permissions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanderseknert%2Fcassandra-opa-authorizer-poc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanderseknert%2Fcassandra-opa-authorizer-poc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanderseknert%2Fcassandra-opa-authorizer-poc/lists"}