Configure SaslauthdAuthenticator¶

ScyllaDB can outsource authentication to a third-party utility named saslauthd, which, in turn,supports many different authentication mechanisms. ScyllaDB accomplishes this by providing a custom authenticator named SaslauthdAuthenticator. This procedure explains how to install and configure it. Once configured, any login to ScyllaDB is authenticated with the SaslauthdAuthenticator.

Procedure

1. Install saslauthd. The easiest way is via a Linux package, if your package manager supports it. Choose a package according to your distro.

   rpm-based distrosdeb-based distros

   Use the cyrus-sasl package

2. Enable the saslauthd service. Run:

   systemctl enable saslauthd.service
   

3. Configure saslauthd: choose the authentication mechanism (e.g., LDAP or PAM) and set the appropriate mechanism-specific parameters by following the saslauthd documentation.

4. After every configuration change, restart the saslauthd service.

   systemctl restart saslauthd.service
   

5. Test your configuration using the testsaslauthd command. Verify you see a success message. If not, verify that the user name and password are correct and then look at the saslauthd logs ( run dmesg -H, and look for LOG_AUTH) to diagnose problems.

6. Find the mux file (saslauthd’s Unix domain socket) and note its full path.

   rpm-based distrosdeb-based distros

   Usually, it is /run/saslauthd/mux

7. Once saslauthd is correctly configured and running, you modify the scylla.yaml configuration file, so communication can begin. Modify the following entries:

   • authenticator: com.scylladb.auth.SaslauthdAuthenticator

   • saslauthd_socket_path: /path/to/the/mux

8. Restart the ScyllaDB server. From now on, ScyllaDB will authenticate all login attempts via saslauthd.

   Supported OSDocker

   sudo systemctl restart scylla-server
   

9. Create ScyllaDB roles which match the same roles in the LDAP server. To create a role, refer to the CQL Reference and the RBAC example.