com.datastax.oss.driver.api.core.auth

Interface Authenticator

All Known Subinterfaces:

SyncAuthenticator

All Known Implementing Classes:

BaseDseAuthenticator, DseGssApiAuthProviderBase.GssApiAuthenticator, PlainTextAuthProviderBase.PlainTextAuthenticator

public interface Authenticator

Handles SASL authentication with Cassandra servers.

Each time a new connection is created and the server requires authentication, a new instance of this class will be created by the corresponding AuthProvider to handle that authentication. The lifecycle of that new Authenticator will be:

1. the initialResponse() method will be called. The initial return value will be sent to the server to initiate the handshake.
2. the server will respond to each client response by either issuing a challenge or indicating that the authentication is complete (successfully or not). If a new challenge is issued, the authenticator's evaluateChallenge(java.nio.ByteBuffer) method will be called to produce a response that will be sent to the server. This challenge/response negotiation will continue until the server responds that authentication is successful (or an AuthenticationException is raised).
3. When the server indicates that authentication is successful, the onAuthenticationSuccess(java.nio.ByteBuffer) method will be called with the last information that the server may optionally have sent.

The exact nature of the negotiation between client and server is specific to the authentication mechanism configured server side.

Note that, since the methods in this interface will be invoked on a driver I/O thread, they all return asynchronous results. If your implementation performs heavy computations or blocking calls, you'll want to schedule them on a separate executor, and return a CompletionStage that represents their future completion. If your implementation is fast, lightweight and does not perform blocking operations, it might be acceptable to run it on I/O threads directly; in that case, implement SyncAuthenticator instead of this interface.

Method Summary

Modifier and Type	Method and Description
CompletionStage<ByteBuffer>	evaluateChallenge(ByteBuffer challenge) Evaluate a challenge received from the server.
CompletionStage<ByteBuffer>	initialResponse() Obtain an initial response token for initializing the SASL handshake.
CompletionStage<Void>	onAuthenticationSuccess(ByteBuffer token) Called when authentication is successful with the last information optionally sent by the server.

Method Detail

initialResponse

@NonNull
CompletionStage<ByteBuffer> initialResponse()

Obtain an initial response token for initializing the SASL handshake.

Returns:

a completion stage that will complete with the initial response to send to the server (which may be null). Note that, if the returned byte buffer is writable, the driver will clear its contents immediately after use (to avoid keeping sensitive information in memory); do not reuse the same buffer across multiple invocations. Alternatively, if the contents are not sensitive, you can make the buffer read-only and safely reuse it.

evaluateChallenge

@NonNull
CompletionStage<ByteBuffer> evaluateChallenge(@Nullable
                                                       ByteBuffer challenge)

Evaluate a challenge received from the server. Generally, this method should return null when authentication is complete from the client perspective.

Parameters:

challenge - the server's SASL challenge.

Returns:

a completion stage that will complete with the updated SASL token (which may be null to indicate the client requires no further action). Note that, if the returned byte buffer is writable, the driver will clear its contents immediately after use (to avoid keeping sensitive information in memory); do not reuse the same buffer across multiple invocations. Alternatively, if the contents are not sensitive, you can make the buffer read-only and safely reuse it.

onAuthenticationSuccess

@NonNull
CompletionStage<Void> onAuthenticationSuccess(@Nullable
                                                       ByteBuffer token)

Called when authentication is successful with the last information optionally sent by the server.

Parameters:

token - the information sent by the server with the authentication successful message. This will be null if the server sends no particular information on authentication success.

Returns:

a completion stage that completes when the authenticator is done processing this response.