org.apache.cassandra.auth.IInternodeAuthenticator Maven / Gradle / Ivy
Show all versions of cassandra-all Show documentation
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.cassandra.auth;
import java.net.InetAddress;
import java.security.cert.Certificate;
import org.apache.cassandra.exceptions.ConfigurationException;
public interface IInternodeAuthenticator
{
/**
* Decides whether or not a peer is allowed to connect to this node.
* If this method returns false, the socket will be immediately closed.
*
* @param remoteAddress ip address of the connecting node.
* @param remotePort port of the connecting node.
* @return true if the connection should be accepted, false otherwise.
* @deprecated See CASSANDRA-17661
*/
@Deprecated(since = "5.0")
default boolean authenticate(InetAddress remoteAddress, int remotePort)
{
return false;
}
/**
* Decides whether a peer is allowed to connect to this node.
* If this method returns false, the socket will be immediately closed.
*
* Default implementation calls authenticate method by IP and port method
*
* 1. If it is IP based authentication ignore the certificates & connectionType parameters in the implementation
* of this method.
* 2. For certificate based authentication like mTLS, server's identity for outbound connections is verified by the
* trusted root certificates in the outbound_keystore. In such cases this method may be overridden to return true
* when certificateType is OUTBOUND, as the authentication of the server happens during SSL Handshake.
*
* @param remoteAddress ip address of the connecting node.
* @param remotePort port of the connecting node.
* @param certificates peer certificates
* @param connectionType If the connection is inbound/outbound connection.
* @return true if the connection should be accepted, false otherwise.
*/
default boolean authenticate(InetAddress remoteAddress, int remotePort,
Certificate[] certificates, InternodeConnectionDirection connectionType)
{
return authenticate(remoteAddress, remotePort);
}
/**
* Validates configuration of IInternodeAuthenticator implementation (if configurable).
*
* @throws ConfigurationException when there is a configuration error.
*/
void validateConfiguration() throws ConfigurationException;
/**
* Setup is called once upon system startup to initialize the IAuthenticator.
*
* For example, use this method to do any required initialization of the class.
*/
default void setupInternode()
{
}
/**
* Enum that represents connection type of internode connection.
*
* INBOUND - called after connection established, with certificate available if present.
* OUTBOUND - called after connection established, with certificate available if present.
* OUTBOUND_PRECONNECT - called before initiating a connection, without certificate available.
* The outbound connection will be authenticated with the certificate once a redirected connection is established.
* This is an extra check that can be used to detect misconfiguration before reconnection, or ignored by returning true.
*/
enum InternodeConnectionDirection
{
INBOUND,
OUTBOUND,
OUTBOUND_PRECONNECT
}
}