Authentication¶

Quick overview¶

advanced.auth-provider in the configuration.
disabled by default. Use plain-text credentials or write a custom provider.
can also be defined programmatically: CqlSession.builder().withAuthCredentials or CqlSession.builder().withAuthProvider.

Cassandra’s binary protocol supports SASL-based authentication. To use it, you must provide an auth provider that will authenticate with the server every time a new connection gets established.

This can be done in two ways:

In the configuration¶

Define an auth-provider section in the configuration:

datastax-java-driver {
  advanced.auth-provider {
    class = ...
  }
}

The auth provider must be configured before opening a session, it cannot be changed at runtime.

Plain text¶

PlainTextAuthProvider supports simple username/password authentication (intended to work with the server-side PasswordAuthenticator). The credentials can be changed at runtime, they will be used for new connection attempts once the configuration gets reloaded.

datastax-java-driver {
  advanced.auth-provider {
    class = PlainTextAuthProvider
    username = cassandra
    password = cassandra
  }
}

Custom¶

You can also write your own provider; it must implement AuthProvider and declare a public constructor with a DriverContext argument.

datastax-java-driver {
  advanced.auth-provider {
    class = com.mycompany.MyCustomAuthProvider
    ... // any custom options your provider might use
  }
}

Programmatically¶

You can also pass an authenticator instance while building the session:

CqlSession session =
    CqlSession.builder()
        .withAuthProvider(new MyCustomAuthProvider())
        .build();

The driver also offers a simple, built-in plain text authentication provider: ProgrammaticPlainTextAuthProvider. The following is equivalent to using PlainTextAuthProvider in the configuration:

AuthProvider authProvider = new ProgrammaticPlainTextAuthProvider("user", "pass");

CqlSession session =
    CqlSession.builder()
        .withAuthProvider(authProvider)
        .build();

For convenience, the credentials can be passed directly:

CqlSession session =
    CqlSession.builder()
        .withAuthCredentials("user", "pass")
        .build();

One downside of the driver’s built-in authentication providers is that the credentials are stored in clear text in memory; this means they are vulnerable to an attacker who is able to perform memory dumps. If this is not acceptable for you, consider writing your own AuthProvider implementation; PlainTextAuthProviderBase is a good starting point.

This base class supports standard SASL PLAIN authentication only. DSE proxy authentication and GSSAPI, including BaseDseAuthenticator, were removed; see the 4.19.2.3 upgrade notes.

Was this page helpful?

ScyllaDB Java Driver is available under the Apache v2 License. ScyllaDB Java Driver is a fork of DataStax Java Driver. See Copyright here.