apache / apache/cassandra-gocql-driver
Authentication failed with Datastax Cassandra and LDAP+internal dual authentication
- Dominant language
- Go
- Stars
- 2.7k
- Forks
- 658
- PR merge metrics
- No merged PRs in 30d
Description
Please answer these questions before submitting your issue. Thanks!
### What version of Cassandra are you using?
Datastax 6.8.9 with Cassandra 3.11
### What version of Gocql are you using?
v0.0.0-20220224095938-0eacd3183625
### What version of Go are you using?
1.15
### What did you do?
Doing a simple connection, as show below. But what I observed is in Datastax Cassandra if ldap and interal dual authentication scheme is on. If the default scheme is ldap and authentication failed, it doesn't fall to internal authentication even the user is valid, therefore login fails.
However, if i disable ldap, i'm able to connect with same user using internal authentication scheme.
So my expectation is if ldap auth fail, the internal scheme should be forced for authentication.
```
cluster := gocql.NewCluster("localhost")
cluster.Authenticator = gocql.PasswordAuthenticator{
Username: "cassandra",
Password: "cassandra",
}
cluster.Consistency = gocql.LocalQuorum
session, _ := cluster.CreateSession()
```
### What did you expect to see?
Successful login
### What did you see instead?
gocql: unable to create session control: unable to connect to initial hosts: Failed to login. Please re-try.
---
If you are having connectivity related issues please share the following additional information
### Describe your Cassandra cluster
please provide the following information
- output of `nodetool status`
- output of `SELECT peer, rpc_address FROM system.peers`
- rebuild your application with the `gocql_debug` tag and post the output
Contributor guide
Research direction
Start with the connection setup shown in the report, especially cluster.CreateSession, and reproduce the login against Datastax Cassandra configured for LDAP plus internal authentication. Done means valid internal credentials can establish a session when LDAP is the default and rejects them, using the reported GoCQL and Go versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cassandra, go
- Domain
- authentication, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100