From 043bc829ba2b282f92161f676aa87dd6a6be33de Mon Sep 17 00:00:00 2001
From: Eric Evans <eevans@apache.org>
Date: Wed, 6 Oct 2010 15:19:28 +0000
Subject: [PATCH] document authorization changes

Patch by eevans for CASSANDRA-1554

git-svn-id: https://svn.apache.org/repos/asf/cassandra/trunk@1005083 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES.txt            |  1 +
 NEWS.txt               |  8 ++++++++
 conf/access.properties | 17 ++++++++++++-----
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 0713e1f436..bffdf556ec 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -11,6 +11,7 @@ dev
  * fix moving nodes with no keyspaces defined (CASSANDRA-1574)
  * fix unbootstrap when no data is present in a transfer range (CASSANDRA-1573)
  * take advantage of AVRO-495 to simplify our avro IDL (CASSANDRA-1436)
+ * extend authorization hierarchy to column family (CASSANDRA-1554)
 
 
 0.7-beta2
diff --git a/NEWS.txt b/NEWS.txt
index 7922a25e04..7f1f3b2f38 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -26,6 +26,8 @@ Features
     - Dynamic endpoint snitch mitigates the impact of impaired nodes
     - New `IntegerType`, faster than LongType and allows integers of 
       both less and more bits than Long's 64
+    - A revamped authentication system that decouples authorization and 
+      allows finer-grained control of resources.
 
 Upgrading
 ---------
@@ -87,6 +89,12 @@ Configuraton
     - Keyspace and column family definitions will need to be loaded via
       "bin/schematool <host> <jmxport> import".  _You only need to do this to
       one node_.
+    - In addition to an authenticator, an authority must be configured as
+      well. Users of SimpleAuthenticator should use SimpleAuthority for this
+      value (the default is AllowAllAuthority, which corresponds with 
+      AllowAllAuthenticator).
+    - The format of access.properties has changed, see the sample configuration
+      conf/access.properties for documentation on the new format.
 
 
 JMX
diff --git a/conf/access.properties b/conf/access.properties
index 9a017aacba..9cce0dc6b5 100644
--- a/conf/access.properties
+++ b/conf/access.properties
@@ -14,12 +14,19 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# This is a sample access file for SimpleAuthority. The format of
-# this file is keyspace=users, where users is a comma delimited list of 
-# authenticatable users from passwd.properties. This file contains 
-# potentially sensitive information, keep this in mind when setting its
-# mode and ownership.
+# This is a sample access file for SimpleAuthority. The format of this file
+# is KEYSPACE[.COLUMNFAMILY].PERMISSION=USERS, where:
 #
+# * KEYSPACE is the keyspace name.
+# * COLUMNFAMILY is the column family name.
+# * PERMISSION is one of <ro> or <rw> for read-only or read-write respectively.
+# * USERS is a comma delimited list of users from passwd.properties.
+# 
+# See below for example entries.
+
+# NOTE: This file contains potentially sensitive information, please keep
+# this in mind when setting its mode and ownership.
+
 # The magical '<modify-keyspaces>' property lists users who can modify the
 # list of keyspaces: all users will be able to view the list of keyspaces.
 <modify-keyspaces>=jsmith