[DISCUSS] CEP-50: Authentication Negotiation

[Joel Shepherd]

Hello - We would like to propose CEP-50: Authentication Negotiation for 
adoption by the community: <link> .

This CEP proposes minor changes to the initial handshake protocol 
(OPTIONS, SUPPORTED and STARTUP messages) to enable a client to inform 
the node of the authenticators supported by the client, and changes in 
the node's authentication-related areas to enable it to pick its 
preferred authenticator for each client client connection. The CEP 
explains why this approach is proposed, instead of implementing a 
"negotiating authenticator".

Authentication negotiation will make it easier and safer for 
administrators to migrate clusters to stronger authentication mechanisms 
(including switching on authentication for a cluster that has been using 
"allow-all" authentication) without downtime, and to support 
environments where different clients prefer different authentication 
mechanisms (e.g., username and password for ad-hoc cqlsh access, mutual 
TLS for programmatic access, etc.), without having to pick a single 
"lowest common denominator" authenticator for all. Additionally, the 
proposed changes are intended to be backwards compatible for both 
clients and nodes.

Thanks in advance for your time and feedback. Please keep the discussion 
on this mailing list thread.

Thanks! -- Joel.