CassandraAuthorizer is a ScyllaDB authorization configuration that enforces permissions assigned to users or roles and denies operations they cannot perform. It replaces the permissive AllowAllAuthorizer when access control must be enforced. section 9.1.5
Use CassandraAuthorizer as the final stage of an authorization rollout:
- Start with AllowAllAuthorizer, which permits every action. section 9.1.5
- Use TransitionalAuthorizer during migration; it enforces defined permissions while allowing otherwise unconfigured access. section 9.1.5
- Switch to CassandraAuthorizer after permissions are fully configured, and increase system_auth replication to the cluster’s total node count. section 9.1.5
Enable authorization in a ScyllaDB container
Edit scylla.yaml, set authenticator: PasswordAuthenticator and authorizer: CassandraAuthorizer, copy the file back into the container, then drain and restart Scylla. Startup creates a default superuser record. section 10.6.1
# Authorization backend, implementing IAuthorizer; used to limit
# access/provide permissions
# Out of the box, Scylla provides org.apache.cassandra.auth.{
# AllowAllAuthorizer,CassandraAuthorizer}.
#
# - AllowAllAuthorizer allows any action to any user - set it to
# disable authorization.
# - CassandraAuthorizer stores permissions in system_auth.permissions
# table. Please increase system_auth keyspace replication factor if
# you use this authorizer.
# - com.scylladb.auth.TransitionalAuthorizer wraps around the
# CassandraAuthorizer, using it for authorizing permission
# management. Otherwise, it allows all. Use for upgrading clusters'
# auth.
# authorizer: AllowAllAuthorizer
Inspect the authorization backend configuration, including permission storage in system_auth.permissions and the transitional wrapper. section 9.1.5
