Add support for AstraAuthenticator

[absurdfarce]

AstraAuthenticator appears to be used in AD4D (DSE feature support on Astra). To confirm that that following test sequence was performed:

1. cql-proxy (built from main) against a stock Astra serverless instance:

$ ./cql-proxy --astra-bundle 'astra-scb.zip' --username 'token' --password 'myastratoken'
{"level":"info","ts":1705706131.924702,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"f7db89d0-f403-4f89-b763-3f0f5679d0f1-us-east-1.db.astra-dev.datastax.com:30047:26fe35c3-ff99-4181-8957-24b32bad1f93"}
...

cqlsh> select * from system.local;

 key   | rpc_address | data_center | rack  | tokens                   | release_version | partitioner                                 | cluster_name | cql_version | schema_version                       | native_protocol_version | host_id
-------+-------------+-------------+-------+--------------------------+-----------------+---------------------------------------------+--------------+-------------+--------------------------------------+-------------------------+--------------------------------------
 local |   127.0.0.1 |   us-east-2 | rack1 | {'-9223372036854775808'} |      4.0.0.6816 | org.apache.cassandra.dht.Murmur3Partitioner |    cql-proxy |       3.4.5 | 4f2b29e6-59b5-4e2d-8fd6-01e32e67f0d7 |   ProtocolVersion OSS 4 | f528764d-624d-3129-b32c-21fbca0cb8d6

(1 rows)

2. Same cql-proxy instance (again, built from main) against AD4D instance:

$ ./cql-proxy --astra-bundle 'ad4d-scb.zip' --username 'token' --password 'myastratoken'
cql-proxy: error: unable to connect to cluster unknown authenticator: org.apache.cassandra.auth.AstraAuthenticator

3. Switch to feature branch, rebuild and test against same AD4D instance:

$ go clean
$ go build
$ ./cql-proxy --astra-bundle 'ad4d-scb.zip' --username 'token' --password 'myastratoken'
{"level":"info","ts":1705706131.924702,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"f7db89d0-f403-4f89-b763-3f0f5679d0f1-us-east-1.db.astra-dev.datastax.com:30047:26fe35c3-ff99-4181-8957-24b32bad1f93"}
...

cqlsh> select * from system.local;

 key   | rpc_address | data_center | dse_version | rack  | tokens                   | release_version | partitioner                                 | cluster_name | cql_version | schema_version                       | native_protocol_version | host_id
-------+-------------+-------------+-------------+-------+--------------------------+-----------------+---------------------------------------------+--------------+-------------+--------------------------------------+-------------------------+--------------------------------------
 local |   127.0.0.1 |        dc-1 |   6.8.33.47 | rack1 | {'-9223372036854775808'} |      4.0.0.6833 | org.apache.cassandra.dht.Murmur3Partitioner |    cql-proxy |       3.4.5 | 4f2b29e6-59b5-4e2d-8fd6-01e32e67f0d7 |   ProtocolVersion OSS 4 | f528764d-624d-3129-b32c-21fbca0cb8d6

(1 rows)

[absurdfarce]

cql-proxy creates mock rows for system.local so the rows shown in my test above didn't come directly from the underlying cluster. But some of the data displayed there is derived from the node cql-proxy is connected to. The key point is that we were able to connect to the cluster at all and get past the auth sequence, something these results seem to demonstrate.

[joao-r-reis]

I would make the "passwordAuthenticator" the default case so we don't run into these issues again in the future (see datastax/zdm-proxy#101 )

[absurdfarce]

I'm okay with returning a SASL auth process in the default case but I'd also argue for adding a log message which can record the authenticator if it isn't something we already know about (i.e. some known good SASL authenticator class). My rationale is that if we just return SASL and (for whatever reason) the authenticator in use isn't based on SASL we'll have other weird failures elsewhere which will make it harder to track back to the fact that we were using the wrong authenticator. A simple log message here saying "unexpected authenticator [blah], using SASL auth" if it's something else will help track down what's going on in those cases.

[absurdfarce]

Updated. With the most recent commit I now see the following (if I artificially make PasswordAuthenticator an "unsupported" authenticator):

$ ./cql-proxy --astra-bundle '/path/to/myscb.zip' --username 'token' --password 'myastratoken'
{"level":"info","ts":1705955428.8055565,"caller":"proxycore/auth.go:48","msg":"Observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}                  
{"level":"info","ts":1705955429.0558403,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:06642708-043d-4e23-
a1a8-6a13a07b84d4"}                                                                                                                                                                                                  
{"level":"info","ts":1705955429.055905,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:6b2830d7-0f45-4eaf-9
2b9-d402dc658605"}                                                                                        
{"level":"info","ts":1705955429.0559106,"caller":"proxycore/cluster.go:263","msg":"adding host to the cluster","host":"8c86116c-e592-4e28-886f-e22cb44935d3-us-east-2.db.astra.datastax.com:29042:fe706378-1299-4015-
9fca-d613a4cf8a07"}                                                                                       
{"level":"info","ts":1705955429.056024,"caller":"proxy/proxy.go:376","msg":"no local DC configured using DC from the first successful contact point","dc":"us-east-2"}
{"level":"info","ts":1705955429.2330513,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.2406676,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.300766,"caller":"proxycore/auth.go:48","msg":"observed unknown authenticator, treating as SASL","authenticator":"org.apache.cassandra.auth.PasswordAuthenticator"}
{"level":"info","ts":1705955429.363725,"caller":"proxy/run.go:286","msg":"proxy is listening","address":"[::]:9042"}

[joao-r-reis]

Nice 👍

[joao-r-reis]