Skip to content
Navigation Menu
{{ message }}
forked from apache/cassandra-python-driver
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsecurity.html
More file actions
213 lines (179 loc) · 14.5 KB
/
Copy pathsecurity.html
File metadata and controls
213 lines (179 loc) · 14.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="refresh" content="0; URL=https://docs.datastax.com/en/developer/python-driver/latest/security/">
<link rel="canonical" href="https://docs.datastax.com/en/developer/python-driver/latest/security/">
<title>Security — Cassandra Driver 3.13.0 documentation</title>
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: './',
VERSION: '3.13.0',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true,
SOURCELINK_SUFFIX: '.txt'
};
</script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="User Defined Types" href="user_defined_types.html" />
<link rel="prev" title="Lightweight Transactions (Compare-and-set)" href="lwt.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
<meta name="viewport" content="width=device-width, initial-scale=0.9, maximum-scale=0.9" />
</head>
<body>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="section" id="security">
<span id="id1"></span><h1>Security<a class="headerlink" href="#security" title="Permalink to this headline">¶</a></h1>
<p>The two main security components you will use with the
Python driver are Authentication and SSL.</p>
<div class="section" id="authentication">
<h2>Authentication<a class="headerlink" href="#authentication" title="Permalink to this headline">¶</a></h2>
<p>Versions 2.0 and higher of the driver support a SASL-based
authentication mechanism when <a class="reference internal" href="api/cassandra/cluster.html#cassandra.cluster.Cluster.protocol_version" title="cassandra.cluster.Cluster.protocol_version"><code class="xref py py-attr docutils literal"><span class="pre">protocol_version</span></code></a>
is set to 2 or higher. To use this authentication, set
<a class="reference internal" href="api/cassandra/cluster.html#cassandra.cluster.Cluster.auth_provider" title="cassandra.cluster.Cluster.auth_provider"><code class="xref py py-attr docutils literal"><span class="pre">auth_provider</span></code></a> to an instance of a subclass
of <a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.AuthProvider" title="cassandra.auth.AuthProvider"><code class="xref py py-class docutils literal"><span class="pre">AuthProvider</span></code></a>. When working
with Cassandra’s <code class="docutils literal"><span class="pre">PasswordAuthenticator</span></code>, you can use
the <a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.PlainTextAuthProvider" title="cassandra.auth.PlainTextAuthProvider"><code class="xref py py-class docutils literal"><span class="pre">PlainTextAuthProvider</span></code></a> class.</p>
<p>For example, suppose Cassandra is setup with its default
‘cassandra’ user with a password of ‘cassandra’:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">cassandra.cluster</span> <span class="kn">import</span> <span class="n">Cluster</span>
<span class="kn">from</span> <span class="nn">cassandra.auth</span> <span class="kn">import</span> <span class="n">PlainTextAuthProvider</span>
<span class="n">auth_provider</span> <span class="o">=</span> <span class="n">PlainTextAuthProvider</span><span class="p">(</span><span class="n">username</span><span class="o">=</span><span class="s1">'cassandra'</span><span class="p">,</span> <span class="n">password</span><span class="o">=</span><span class="s1">'cassandra'</span><span class="p">)</span>
<span class="n">cluster</span> <span class="o">=</span> <span class="n">Cluster</span><span class="p">(</span><span class="n">auth_provider</span><span class="o">=</span><span class="n">auth_provider</span><span class="p">,</span> <span class="n">protocol_version</span><span class="o">=</span><span class="mi">2</span><span class="p">)</span>
</pre></div>
</div>
<p>When working with version 2 or higher of the driver, the protocol
version is set to 2 by default, but we’ve included it in the example
to be explicit.</p>
<div class="section" id="custom-authenticators">
<h3>Custom Authenticators<a class="headerlink" href="#custom-authenticators" title="Permalink to this headline">¶</a></h3>
<p>If you’re using something other than Cassandra’s <code class="docutils literal"><span class="pre">PasswordAuthenticator</span></code>,
<a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.SaslAuthProvider" title="cassandra.auth.SaslAuthProvider"><code class="xref py py-class docutils literal"><span class="pre">SaslAuthProvider</span></code></a> is provided for generic SASL authentication mechanisms,
utilizing the <code class="docutils literal"><span class="pre">pure-sasl</span></code> package.
If these do not suit your needs, you may need to create your own subclasses of
<a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.AuthProvider" title="cassandra.auth.AuthProvider"><code class="xref py py-class docutils literal"><span class="pre">AuthProvider</span></code></a> and <a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.Authenticator" title="cassandra.auth.Authenticator"><code class="xref py py-class docutils literal"><span class="pre">Authenticator</span></code></a>. You can use the Sasl classes
as example implementations.</p>
</div>
<div class="section" id="protocol-v1-authentication">
<h3>Protocol v1 Authentication<a class="headerlink" href="#protocol-v1-authentication" title="Permalink to this headline">¶</a></h3>
<p>When working with Cassandra 1.2 (or a higher version with
<a class="reference internal" href="api/cassandra/cluster.html#cassandra.cluster.Cluster.protocol_version" title="cassandra.cluster.Cluster.protocol_version"><code class="xref py py-attr docutils literal"><span class="pre">protocol_version</span></code></a> set to <code class="docutils literal"><span class="pre">1</span></code>), you will not pass in
an <a class="reference internal" href="api/cassandra/auth.html#cassandra.auth.AuthProvider" title="cassandra.auth.AuthProvider"><code class="xref py py-class docutils literal"><span class="pre">AuthProvider</span></code></a> instance. Instead, you should pass in a
function that takes one argument, the IP address of a host, and returns
a dict of credentials with a <code class="docutils literal"><span class="pre">username</span></code> and <code class="docutils literal"><span class="pre">password</span></code> key:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">cassandra.cluster</span> <span class="kn">import</span> <span class="n">Cluster</span>
<span class="k">def</span> <span class="nf">get_credentials</span><span class="p">(</span><span class="n">host_address</span><span class="p">):</span>
<span class="k">return</span> <span class="p">{</span><span class="s1">'username'</span><span class="p">:</span> <span class="s1">'joe'</span><span class="p">,</span> <span class="s1">'password'</span><span class="p">:</span> <span class="s1">'1234'</span><span class="p">}</span>
<span class="n">cluster</span> <span class="o">=</span> <span class="n">Cluster</span><span class="p">(</span><span class="n">auth_provider</span><span class="o">=</span><span class="n">get_credentials</span><span class="p">,</span> <span class="n">protocol_version</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span>
</pre></div>
</div>
</div>
</div>
<div class="section" id="ssl">
<h2>SSL<a class="headerlink" href="#ssl" title="Permalink to this headline">¶</a></h2>
<p>To enable SSL you will need to set <a class="reference internal" href="api/cassandra/cluster.html#cassandra.cluster.Cluster.ssl_options" title="cassandra.cluster.Cluster.ssl_options"><code class="xref py py-attr docutils literal"><span class="pre">Cluster.ssl_options</span></code></a> to a
dict of options. These will be passed as kwargs to <code class="docutils literal"><span class="pre">ssl.wrap_socket()</span></code>
when new sockets are created. This should be used when client encryption
is enabled in Cassandra.</p>
<p>By default, a <code class="docutils literal"><span class="pre">ca_certs</span></code> value should be supplied (the value should be
a string pointing to the location of the CA certs file), and you probably
want to specify <code class="docutils literal"><span class="pre">ssl_version</span></code> as <code class="docutils literal"><span class="pre">ssl.PROTOCOL_TLSv1</span></code> to match
Cassandra’s default protocol.</p>
<p>For example:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">cassandra.cluster</span> <span class="kn">import</span> <span class="n">Cluster</span>
<span class="kn">from</span> <span class="nn">ssl</span> <span class="kn">import</span> <span class="n">PROTOCOL_TLSv1</span><span class="p">,</span> <span class="n">CERT_REQUIRED</span>
<span class="n">ssl_opts</span> <span class="o">=</span> <span class="p">{</span>
<span class="s1">'ca_certs'</span><span class="p">:</span> <span class="s1">'/path/to/my/ca.certs'</span><span class="p">,</span>
<span class="s1">'ssl_version'</span><span class="p">:</span> <span class="n">PROTOCOL_TLSv1</span><span class="p">,</span>
<span class="s1">'cert_reqs'</span><span class="p">:</span> <span class="n">CERT_REQUIRED</span> <span class="c1"># Certificates are required and validated</span>
<span class="p">}</span>
<span class="n">cluster</span> <span class="o">=</span> <span class="n">Cluster</span><span class="p">(</span><span class="n">ssl_options</span><span class="o">=</span><span class="n">ssl_opts</span><span class="p">)</span>
</pre></div>
</div>
<p>This is only an example to show how to pass the ssl parameters. Consider reading
the <a class="reference external" href="https://docs.python.org/2/library/ssl.html#ssl.wrap_socket">python ssl documentation</a> for
your configuration. For further reading, Andrew Mussey has published a thorough guide on
<a class="reference external" href="http://blog.amussey.com/post/64036730812/cassandra-2-0-client-server-ssl-with-datastax-python">Using SSL with the DataStax Python driver</a>.</p>
</div>
</div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<h1 class="logo"><a href="index.html">Cassandra Driver</a></h1>
<p class="blurb">Python driver for Cassandra</p>
<p>
<iframe src="https://ghbtns.com/github-btn.html?user=datastax&repo=python-driver&type=star&count=true&size=large&v=2"
allowtransparency="true" frameborder="0" scrolling="0" width="200px" height="35px"></iframe>
</p>
<h3>Navigation</h3>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="api/index.html">API Documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="installation.html">Installation</a></li>
<li class="toctree-l1"><a class="reference internal" href="getting_started.html">Getting Started</a></li>
<li class="toctree-l1"><a class="reference internal" href="upgrading.html">Upgrading</a></li>
<li class="toctree-l1"><a class="reference internal" href="execution_profiles.html">Execution Profiles</a></li>
<li class="toctree-l1"><a class="reference internal" href="performance.html">Performance Notes</a></li>
<li class="toctree-l1"><a class="reference internal" href="query_paging.html">Paging Large Queries</a></li>
<li class="toctree-l1"><a class="reference internal" href="lwt.html">Lightweight Transactions (Compare-and-set)</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Security</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#authentication">Authentication</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#custom-authenticators">Custom Authenticators</a></li>
<li class="toctree-l3"><a class="reference internal" href="#protocol-v1-authentication">Protocol v1 Authentication</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="#ssl">SSL</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="user_defined_types.html">User Defined Types</a></li>
<li class="toctree-l1"><a class="reference internal" href="object_mapper.html">Object Mapper</a></li>
<li class="toctree-l1"><a class="reference internal" href="dates_and_times.html">Working with Dates and Times</a></li>
<li class="toctree-l1"><a class="reference internal" href="faq.html">Frequently Asked Questions</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="lwt.html" title="previous chapter">Lightweight Transactions (Compare-and-set)</a></li>
<li>Next: <a href="user_defined_types.html" title="next chapter">User Defined Types</a></li>
</ul></li>
</ul>
</div>
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<form class="search" action="search.html" method="get">
<div><input type="text" name="q" /></div>
<div><input type="submit" value="Go" /></div>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©2013-2017 DataStax.
|
Powered by <a href="http://sphinx-doc.org/">Sphinx 1.6.6</a>
& <a href="https://github.com/bitprophet/alabaster">Alabaster 0.7.10</a>
|
<a href="_sources/security.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>
You can’t perform that action at this time.