PYTHON-940 Log warning when driver configures an authenticator, but server does not request authentication

beltran · beltran · commit 4ff50f63c579 · 2018-03-28T08:39:34.000+02:00
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -11,6 +11,7 @@ Other
 * Reevaluate MONKEY_PATCH_LOOP in test codebase (PYTHON-903)
 * Remove CASS_SERVER_VERSION and replace it for CASSANDRA_VERSION in tests (PYTHON-910)
 * Refactor CASSANDRA_VERSION to a some kind of version object (PYTHON-915)
+* Log warning when driver configures an authenticator, but server does not request authentication (PYTHON-940)
 
 
 3.13.0
diff --git a/cassandra/connection.py b/cassandra/connection.py
@@ -724,6 +724,12 @@ def _handle_startup_response(self, startup_response, did_authenticate=False):
         if self.is_defunct:
             return
         if isinstance(startup_response, ReadyMessage):
+            if self.authenticator:
+                log.warning("An authentication challenge was not sent, "
+                            "this is suspicious because the driver expects "
+                            "authentication (configured authenticator = %s)",
+                            self.authenticator.__class__.__name__)
+
             log.debug("Got ReadyMessage on new connection (%s) from %s", id(self), self.host)
             if self._compressor:
                 self.compressor = self._compressor
diff --git a/tests/integration/__init__.py b/tests/integration/__init__.py
@@ -619,6 +619,22 @@ def get_message_count(self, level, sub_string):
                 count+=1
         return count
 
+    def set_module_name(self, module_name):
+        """
+        This is intended to be used doing:
+        with MockLoggingHandler().set_module_name(connection.__name__) as mock_handler:
+        """
+        self.module_name = module_name
+        return self
+
+    def __enter__(self):
+        self.logger = logging.getLogger(self.module_name)
+        self.logger.addHandler(self)
+        return self
+
+    def __exit__(self, *args):
+        pass
+
 
 class BasicExistingKeyspaceUnitTestCase(BasicKeyspaceUnitTestCase):
     """
diff --git a/tests/integration/standard/test_cluster.py b/tests/integration/standard/test_cluster.py
@@ -36,6 +36,8 @@
 
 from cassandra.pool import Host
 from cassandra.query import SimpleStatement, TraceUnavailable, tuple_factory
+from cassandra.auth import PlainTextAuthProvider, SaslAuthProvider
+from cassandra import connection
 
 from tests import notwindows
 from tests.integration import use_singledc, PROTOCOL_VERSION, get_server_versions, CASSANDRA_VERSION, \
@@ -672,6 +674,57 @@ def test_string_coverage(self):
         self.assertIn('result', str(future))
         cluster.shutdown()
 
+    def test_can_connect_with_plainauth(self):
+        """
+        Verify that we can connect setting PlainTextAuthProvider against a
+        C* server without authentication set. We also verify a warning is
+        issued per connection. This test is here instead of in test_authentication.py
+        because the C* server running in that module has auth set.
+
+        @since 3.14
+        @jira_ticket PYTHON-940
+        @expected_result we can connect, query C* and warning are issued
+
+        @test_category auth
+        """
+        auth_provider = PlainTextAuthProvider(
+            username="made_up_username",
+            password="made_up_password"
+        )
+        self._warning_are_issued_when_auth(auth_provider)
+
+    def test_can_connect_with_sslauth(self):
+        """
+        Verify that we can connect setting SaslAuthProvider against a
+        C* server without authentication set. We also verify a warning is
+        issued per connection. This test is here instead of in test_authentication.py
+        because the C* server running in that module has auth set.
+
+        @since 3.14
+        @jira_ticket PYTHON-940
+        @expected_result we can connect, query C* and warning are issued
+
+        @test_category auth
+        """
+        sasl_kwargs = {'service': 'cassandra',
+                       'mechanism': 'PLAIN',
+                       'qops': ['auth'],
+                       'username': "made_up_username",
+                       'password': "made_up_password"}
+
+        auth_provider = SaslAuthProvider(**sasl_kwargs)
+        self._warning_are_issued_when_auth(auth_provider)
+
+    def _warning_are_issued_when_auth(self, auth_provider):
+        with MockLoggingHandler().set_module_name(connection.__name__) as mock_handler:
+            with Cluster(auth_provider=auth_provider) as cluster:
+                session = cluster.connect()
+                self.assertIsNotNone(session.execute("SELECT * from system.local"))
+
+            # Three conenctions to nodes plus the control connection
+            self.assertEqual(4, mock_handler.get_message_count('warning',
+                                                               "An authentication challenge was not sent"))
+
     def test_idle_heartbeat(self):
         interval = 2
         cluster = Cluster(protocol_version=PROTOCOL_VERSION, idle_heartbeat_interval=interval)
