Scylla supports user authentication via an LDAP server by leveraging the SaslauthdAuthenticator. By configuring saslauthd correctly against your LDAP server, you enable Scylla to check the user’s credentials through it.
LDAP is scheduled for an upcoming release of Scylla Enterprise. To see which release, read the Release Notes.
Scylla can outsource authentication to a third-party utility named saslauthd, which, in turn,supports many different authentication mechanisms. Scylla accomplishes this by providing a custom authenticator named SaslauthdAuthenticator. This procedure explains how to install and configure it. Once configured, any login to Scylla is authenticated with the SaslauthdAuthenticator.
Install saslauthd. The easiest way is via a Linux package, if your package manager supports it. Choose a package according to your distro.
Enable the saslauthd service. Run:
systemctl enable saslauthd.service
Configure saslauthd: choose the authentication mechanism (e.g., LDAP or PAM) and set the appropriate mechanism-specific parameters by following the saslauthd documentation.
After every configuration change, restart the saslauthd service.
systemctl restart saslauthd.service
Test your configuration using the testsaslauthd command. Verify you see a success message. If not, verify that the user name and password are correct and then look at the saslauthd logs ( run
dmesg -H, and look for
LOG_AUTH) to diagnose problems.
Find the mux file (saslauthd’s Unix domain socket) and note its full path.
Once saslauthd is correctly configured and running, you modify the scylla.yaml configuration file, so communication can begin. Modify the following entries:
Restart the Scylla server. From now on, Scylla will authenticate all login attempts via saslauthd.