YSQL and YCQL: Enforcing Uniform Credential Expiration Across API Boundaries

Enforcing Uniform Credential Expiration Across YSQL and YCQL

The goal is to implement a consistent least‑privilege policy that revokes user access automatically after a specified time, regardless of whether the client connects via YSQL (PostgreSQL‑compatible) or YCQL (Cassandra‑compatible). In YSQL, roles can be created with a VALID UNTIL timestamp, and authentication fails once that time is reached. YCQL, however, lacks a documented equivalent, so an external mechanism would be needed to enforce expiration on its keyspace and table permissions.

Key constraints include the need to maintain the same expiration semantics for both APIs, avoid lock‑out scenarios during cluster upgrades, and support SCRAM‑SHA‑256 password encryption for secure authentication. The uncertainty centers on how best to propagate or synchronize the expiration information between YSQL and YCQL, and whether YugabyteDB provides a unified approach or requires third‑party tooling.

Specific questions:

• Does YugabyteDB offer a built‑in mechanism to set expiration on YCQL roles or permissions, analogous to YSQL’s VALID UNTIL?
• Can a shared metadata table or external scheduler be used to enforce expiration across both APIs, and what are the recommended best practices?
• What impact does enabling authentication on only one API have on credential expiration handling, and how can cross‑API consistency be verified?