Authorization in Cassandra 

Authorization in Cassandra is disabled by default. This grants all permissions to all roles. But disabling authorization is not used in production deployment. Cassandra has role based access control and using this we can configure proper access profile and schema access limitations.

To enable authorization we must enable authorizer in cassandra.yaml file.

By default:

After enabling authorization:

Now restart the node using the following command:

ndoetool drain; nodetool stopdaemon; cassandra

Once we enable authorization we have to start creating roles. 

Let's create a dba role, which has to have all the permissions on all the keyspaces.

Create an sales_admin role, which has to have all permissions on that particular keysapce.

Create an read_only role, which has to have only select access on all the keyspace.

High level roles as place holder for all roles.

create role 'dba_role' with login=false;

create role 'sales_admin' login=false;

create role 'read_only' with login=false;

--Granting all permissions to 'dba_role' role.

grant all permissions on all keyspaces to 'dba_role';

grant all permissions on all functions to 'dba_role';

grant all permissions on all roles to 'dba_role';

--Granting select,create & modify to sales_admin.

grant select on keyspace sales to 'sales_admin';

grant create on keyspace sales to 'sales_admin';

grant modify on keyspace sales to 'sales_admin';

--Real only access on all keypspaces.

grant select on all keypspaces to 'read_only';

Let's say a dba joined a organization:

>> Creating Role create role KKR with password='password' and login=true;

>> Granting permissions  grant 'dba_role' to KKR;

>> Listing permissions list all permissions of KKR;

Let's say a keyspace admin joined a organization:

>> Creating Role create role Kanthi with password='password' and login='true';

>> Granting Permission  grant 'sales_admin' to Kanthi;

>> Listing permissions list all permissions of Kanthi;

Read_only user

>> Creating a read_only user

>> Granting permissions to read_only  grant 'read_only' to Kanthi Rekha;

The above roles must be created in system_auth keyspace.