xandra icon indicating copy to clipboard operation
xandra copied to clipboard

Full support of custom auth methods

Open nikita-v opened this issue 4 months ago • 2 comments

Hi there!

It seems that Xandra does not fully support custom authentication mechanisms.
Specifically, it is not possible to connect to AWS Keyspaces when using temporary credentials (documentation).

The expected authentication flow in Keyspaces is:

  1. After receiving AUTHENTICATE, the client replies with an AUTH_RESPONSE containing the string "SigV4\00\00", indicating that temporary credentials will be used.
  2. Keyspaces responds with an AUTH_CHALLENGE carrying a random nonce.
  3. The client signs this nonce cryptographically and sends the result in a second AUTH_RESPONSE.
  4. Keyspaces validates the signature and replies with either AUTH_SUCCESS or ERROR.

Currently, Xandra does not appear to implement any handling of AUTH_CHALLENGE messages, which makes this authentication flow unsupported.

nikita-v avatar Sep 04 '25 15:09 nikita-v

A possible solution is to change the Authenticator behavior like this:

defmodule Xandra.Authenticator do
  @doc """
  Returns an iodata that's used as the response body to Cassandra's AUTHENTICATE message.
  """
  @callback initial_response_body(options :: keyword) :: iodata

  @doc """
  Returns an iodata that's used as the response body to Cassandra's auth challenge.
  """
  @callback challenge_response_body(challenge :: iodata, options :: keyword) :: iodata
end

Change the message processing logic so that:

  • In response to an AUTHENTICATE message, the reply is generated using the result of the initial_response_body function.

  • In response to an AUTH_CHALLENGE message, the reply is generated using the result of the challenge_response_body function.

nikita-v avatar Sep 05 '25 13:09 nikita-v

I think we should add challenge_response_body and not change the existing callback, so that we can make the behavior backwards compatible. We can make the new callback optional, and if it's there, call it when receiving the challenge. Thoughts? Want to send a PR?

whatyouhide avatar Sep 12 '25 11:09 whatyouhide