{"id":15056901,"url":"https://github.com/instaclustr/cassandra-kerberos","last_synced_at":"2025-04-10T04:56:13.260Z","repository":{"id":43652618,"uuid":"150053811","full_name":"instaclustr/cassandra-kerberos","owner":"instaclustr","description":"GSS-API authenticator plugin for Apache Cassandra","archived":false,"fork":false,"pushed_at":"2023-07-06T23:51:48.000Z","size":113,"stargazers_count":5,"open_issues_count":7,"forks_count":2,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-24T06:11:30.782Z","etag":null,"topics":["auth","authentication","cassandra","cassandra-kerberos","driver","gssapi-authentication","kerberos","keytab","netapp-public","plugin","principal","security","service"],"latest_commit_sha":null,"homepage":"https://instaclustr.com","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/instaclustr.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-09-24T04:24:44.000Z","updated_at":"2023-12-08T03:21:24.000Z","dependencies_parsed_at":"2024-06-21T17:32:13.963Z","dependency_job_id":"ab8b3e87-50d6-42d9-8ef3-6df651e42a80","html_url":"https://github.com/instaclustr/cassandra-kerberos","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instaclustr%2Fcassandra-kerberos","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instaclustr%2Fcassandra-kerberos/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instaclustr%2Fcassandra-kerberos/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instaclustr%2Fcassandra-kerberos/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/instaclustr","download_url":"https://codeload.github.com/instaclustr/cassandra-kerberos/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248161261,"owners_count":21057554,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auth","authentication","cassandra","cassandra-kerberos","driver","gssapi-authentication","kerberos","keytab","netapp-public","plugin","principal","security","service"],"created_at":"2024-09-24T21:58:00.156Z","updated_at":"2025-04-10T04:56:13.234Z","avatar_url":"https://github.com/instaclustr.png","language":"Java","funding_links":[],"categories":["Packages"],"sub_categories":["Tools"],"readme":"== Cassandra Kerberos Authenticator\n\n_A GSSAPI authentication provider for Apache Cassandra_\n\nimage:https://circleci.com/gh/instaclustr/cassandra-kerberos.svg?style=svg[\"Instaclustr\",link=\"https://circleci.com/gh/instaclustr/cassandra-kerberos\"]\n\nThis authenticator plugin is intended to work with the\nhttps://github.com/instaclustr/cassandra-java-driver-kerberos[Cassandra Java Driver Kerberos Authenticator]\nplugin for the https://github.com/datastax/java-driver[Cassandra Java driver].\n\nSupported versions:\n\n* 2.2\n* 3.0\n* 3.11\n* 4.0\n* 4.1\n\nNOTE: CQLSH integration works only with Cassandra 4.1 and above.\n\nWARNING: if you install / configure this authenticator, with open source Cassandra of version less than 4.1, you will not be able to connect through CQL shell anymore as this functionality is not\nimplemented in CQL shell yet. This authenticator is meant to be used only in connection with Java applications\nfor which you need to setup your driver to use https://github.com/instaclustr/cassandra-java-driver-kerberos[Kerberos Java driver], also from Instaclustr.\n\n=== Build\n\nTo build the project, just run `mvn clean install`.\n\nThe project is organised into modules, each module per major Cassandra version.\nYou will find in `target` of each module for respective Cassandra version:\n\n* JAR\n* DEB package\n* RPM package\n\n=== Environment set-up\n\n1. Ensure that the following pre-requisite systems are configured:\n\n- A unique DNS record is created for each node (use `hostname -f` on each node to verify that the DNS FQDN is configured)\n- A reverse DNS record is created for each node, matching the `broadcast_rpc_address`\n- A Kerberos 5 KDC server is available\n- Kerberos client libraries are installed on each Cassandra node\n- An NTP client is installed \u0026 configured on each Cassandra node. Ideally the Cassandra nodes sync\nwith the same time source as the KDC in order to minimise potential time-sync issues.\n- If using Oracle Java, ensure that the https://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html[Java Cryptographic Extensions Unlimited Strength Jurisdiction Policy Files]\nare installed (not necessary when using OpenJDK or other JRE implementations)\n\n2. Ensure that the value of http://cassandra.apache.org/doc/latest/configuration/cassandra_config_file.html#rpc-address[rpc_address]\n(and optionally http://cassandra.apache.org/doc/latest/configuration/cassandra_config_file.html#broadcast-rpc-address[broadcast_rpc_address], if using)\nin the `cassandra.yaml` config file is not set to `localhost`. Reverse-DNS records must be created to match the `broadcast_rpc_address`.\nThis enables clients to resolve the Kerberos service principal's hostname from the IP address.\n\n3. Configure the `/etc/krb5.conf` Kerberos config file on each node (see http://web.mit.edu/kerberos/www/krb5-latest/doc/admin/conf_files/krb5_conf.html[here] for further details). Below is an example `krb5.conf` for an `EXAMPLE.COM` Kerberos realm:\n\n    [logging]\n    default = FILE:/var/log/krb5libs.log\n    [libdefaults]\n     default_realm = EXAMPLE.COM\n     dns_lookup_realm = false\n     dns_lookup_kdc = false\n    [realms]\n     EXAMPLE.COM = {\n      kdc = kdc.example.com\n      admin_server = kdc.example.com\n    }\n    [domain_realm]\n     .example.com = EXAMPLE.COM\n     example.com = EXAMPLE.COM\n\n4. For each cassandra node, create a new Kerberos service principal (see http://web.mit.edu/kerberos/www/krb5-latest/doc/admin/admin_commands/kadmin_local.html#add-principal[here] for further details)\nNote that the service name portion of the principal (`cassandra`, in this example) must be the same for\neach node in the cluster, and must *also* match the SASL protocol name specified when configuring\nthe https://github.com/instaclustr/cassandra-java-driver-kerberos[Cassandra Java driver Kerberos authenticator].\nThe hostname portion of the principal (e.g. `node1.mycluster.example.com`) must match the DNS entry for each Cassandra node.\n\n    kadmin -q \"addprinc -randkey cassandra/node1.mycluster.example.com@EXAMPLE.COM\"\n    kadmin -q \"addprinc -randkey cassandra/node2.mycluster.example.com@EXAMPLE.COM\"\n    kadmin -q \"addprinc -randkey cassandra/node3.mycluster.example.com@EXAMPLE.COM\"\n\n5. Create a keytab for each newly created service principal (see http://web.mit.edu/kerberos/www/krb5-latest/doc/admin/admin_commands/kadmin_local.html#ktadd[here] for further details)\n\n    kadmin -q \"ktadd -k /node1.keytab cassandra/node1.mycluster.example.com@EXAMPLE.COM\"\n    kadmin -q \"ktadd -k /node2.keytab cassandra/node2.mycluster.example.com@EXAMPLE.COM\"\n    kadmin -q \"ktadd -k /node3.keytab cassandra/node3.mycluster.example.com@EXAMPLE.COM\"\n\n6. Copy the corresponding keytab file to the Cassandra configuration directory on each node, and set the appropriate access controls\n\n     scp kdc.example.com:/node1.keytab /etc/cassandra/node1.keytab\n     chown cassandra:cassandra /etc/cassandra/node1.keytab\n     chmod 400 /etc/cassandra/node1.keytab\n\n\n=== Install \u0026 configure the Kerberos authenticator\n\n1. Copy the `cassandra-krb5.properties` file to the Cassandra configuration directory on each node (e.g. `/etc/cassandra/conf` or `/etc/cassandra`, based on OS).\nSet `service_principal` and `keytab` to correspond to the service principals and keytabs created in the previous steps.\n\n    service_principal=cassandra/node1.mycluster.example.com@EXAMPLE.COM\n    keytab=node1.keytab\n    qop=auth\n\n2. Copy the authenicator jar to the Cassandra `lib` directory (e.g. `/usr/share/cassandra/lib/`)\n\n3. Set the http://cassandra.apache.org/doc/latest/configuration/cassandra_config_file.html#authenticator[authenticator]\noption in the `cassandra.yaml` config file.\n\n    authenticator: com.instaclustr.cassandra.auth.KerberosAuthenticator\n\nYou may control where to fetch the configuration file from by system property set upon Cassandra startup, for example `-Dcassandra.krb5.config=/path/to/conf.properties`\n\nIn case you are using packages, JAR and conf file is installed into the right place automatically.\n\n=== CQLSH\n\nTo set up CQLSH, you need to insert and modify accordingly your `cqlshrc` file. To successfully log in, you need to\nhave a valid ticket. How to obtain it is outside this document, but you should see the output similar to this:\n\n----\n[auth_provider]\nmodule=cassandra.auth\nclassname=SaslAuthProvider\nservice=cassandra\nkeytab=/etc/cassandra/cassandra.keytab\nmechanism=GSSAPI\nqop=auth\n----\n\nAfter successful login, you should have a ticket granted:\n\n----\n[root@node1 ~]# klist\nTicket cache: KEYRING:persistent:0:0\nDefault principal: root@EXAMPLE.COM\n\nValid starting       Expires              Service principal\n04/01/2022 15:57:59  04/02/2022 15:39:42  cassandra/node1.example.com@EXAMPLE.COM\n04/01/2022 15:39:42  04/02/2022 15:39:42  krbtgt/EXAMPLE.COM@EXAMPLE.COM\n----\n\nIf you are logged in as root in shell, it will try to log you in Cassandra as root as well, so you need to have\nthe corresponding role in Cassandra before you authenticate. Create your roles beforehand in order to log in after you switch to KerberosAuthenticator in `cassandra.yaml`.\n\nIn case you are\nPlease see https://www.instaclustr.com/support/documentation/announcements/instaclustr-open-source-project-status/[status] for Instaclustr support status of this project\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstaclustr%2Fcassandra-kerberos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finstaclustr%2Fcassandra-kerberos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstaclustr%2Fcassandra-kerberos/lists"}