Cassandra for Oracle DBA’s Part 9 : Creating Users & Granting Privileges

Create User in cassandra involve to change the parameter in cassandra.yaml and authentication mode.

# Authentication backend, implementing IAuthenticator; used to identify users

# Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthenticator,

# PasswordAuthenticator}.

# DSE also provides a Kerberos authenticator for external authentication.

#

# - AllowAllAuthenticator performs no checks - set it to disable authentication.

# - PasswordAuthenticator relies on username/password pairs to authenticate

#   users. It keeps usernames and hashed passwords in system_auth.credentials table.

#   Please increase system_auth keyspace replication factor if you use this authenticator.

# - com.datastax.bdp.cassandra.auth.KerberosAuthenticator For external authentication

#   through Kerberos. Additional configuration is required in dse.yaml

authenticator: PasswordAuthenticator

# Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthorizer,

# - AllowAllAuthorizer allows any action to any user - set it to disable authorization.

authorizer: CassandraAuthorizer

# Will be disabled automatically for AllowAllAuthorizer.

Once the parameter is set, create user as follows using cqlsh

cqlsh> CREATE USER boone WITH PASSWORD 'Niner75' NOSUPERUSER;

cqlsh> select * from system_auth.users;

 name      | super

-----------+-------

  spillman | False

     boone | False

 cassandra |  True

     akers |  True

(4 rows)

cqlsh>

################

Granting privileges

#################

cqlsh:PortfolioDemo>

cqlsh> grant all on keyspace "PortfolioDemo" to akers;

cqlsh> grant all on keyspace "PortfolioDemo" to akers,boone,spillman;

Bad Request: line 1:46 missing EOF at ','

cqlsh> grant all on keyspace "PortfolioDemo" to boone,spillman;

Bad Request: line 1:46 missing EOF at ','

cqlsh> grant all on keyspace "PortfolioDemo" to boone;

cqlsh> grant all on keyspace "PortfolioDemo" to spillman;

cqlsh>