How to work with authentication in Zookeeper?

-
In this article, I tried to collect all my experience and add links which I used to set up authentication in Zookeeper.

First of all, you need to run Zookeeper (ZK) with the password for "super" user. We need to use DigestAuthenticationProvider for this.
Need to generate digest of a given password and after that, you can run Zookeeper with option -DSERVER_JVMFLAGS=-Dzookeeper.DigestAuthenticationProvider.superDigest=super:<password digest>

How to generate digest of a given password.
For generating  digest you need to do next:
/bin/java -cp "/opt/zookeeper-3.4.9.jar /opt/lib/slf4j-api-1.6.1.jar" org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:pass
(by link, you can find a slightly different way).

The output will be:
super:CiymZRNkXx0HJFQhdpGmqJqKuHM=

Please note: this is example and digest may not match the password.

After that, you need to set SERVER_JVMFLAGS and restart Zookeeper:
export SERVER_JVMFLAGS="-Dzookeeper.DigestAuthenticationProvider.superDigest=super:
CiymZRNkXx0HJFQhdpGmqJqKuHM="

But after Zookeeper restart ACL's will be the same (we will use zkCli.sh for connecting to ZK):
[zk: zookeeper(CONNECTED) 2] getAcl /
'world,'anyone
: cdrwa

Let’s go ahead and setup ACL's. For this need to connect to the ZK via zkCli, authorize as super user, after that authorize as another user which can access to the ZK (let's call it "other"):


More info about ZK ACL's you can find by this link.

As you can see getAcl / show us two records - for super and for other users, and these ACL's is identical. This means you can't set different ACL's for one node in ZK.

How can we disable Authentication in Zookeeper?
The simplest way as I found - to run  Zookeeper with the blank password for super user, and with  "skipACL" option. Why do we need to set up the blank password for super user? Because when we will disable Authentication, ACL's still persisted and we need to know a old super password for unsetting it.

Lets set up SERVER_JVMFLAGS and run Zookeeper:
export SERVER_JVMFLAGS="-Dzookeeper.DigestAuthenticationProvider.superDigest=super: -Dzookeeper.skipACL=yes"

For unsetting old ACL's need to connect to the ZK, authorize as super user and set default ACL's:



Ok, what will happen when we enable authentication in Zookeeper, do something, disable it do something new and enable authentication again?

Yes, we will have inconsistent state of ZK ACL's. Some more explanation you can find in this answer in the StackOverflow.

Let's try to demonstrate this:

 

What do we see in this example?
In the first output of getAcl command, we see ACL's setting with new passwords (yes, we run ZK with the different password from the first time).

In second output we see the k node which was created after we completely disable authentication.
And in third output, we can see ddd node which was created when we run ZK first time with enabled authentication and different passwords.

This is links which were used for preparing for this article:
[ Tutorial ] Apache ZooKeeper – Setting ACL in ZooKeeper Client
How to remove ACL protected ZK Node
Zookeeper - Super User Authentication and Authorization
stackoverflow: How to access a Zookeeper ensemble as a 'super' user via Zookeeper shell?
ZooKeeper -> Command Line Utilities (zkCli)
ZooKeeper Dynamic Reconfiguration
ZooKeeper access control using ACLs
ZooKeeper Authentication & Authorization Options




Комментарии

Отправить комментарий

Популярные сообщения из этого блога

How-to use cUrl for work with ZKUI.

-
Изображение
ZKUI is an open source (under Apache 2.0 license ) a UI dashboard that allows CRUD operations on Zookeeper. But sometimes you can want to upload something to the Zookeeper via ZKUI automatically. And as far as I could understand ZKUI don't have API for this purpose, but you can always use cUrl . First of all, you need to authenticate in the ZKUI using LDAP login/password: curl -c COOKIE --data "username=USERNAME&password=PASSWORD&action= 'Sign In' " https: //ZKUI_ADDRESS/login After that, you can use the COOKIE file to communicate with ZKUI. Use the next commands: To export all data to a file: curl -c COOKIE -b COOKIE -s -S "https: //ZKUI_ADDRESS/export?zkPath=/" > FILE To import data from a file: curl -c COOKIE -b COOKIE -s -S --form scmFile=@FILE --form Import=submit https: //ZKUI_ADDRESS/ import Please note: you can set "--form scmOverwrite=true" if you want to overwrite existing properties. ...
Далее...

Consul-template: how to run exec command, if file changed? Create a "watcher" via consul-template.

-
You can create a "watcher" via consul-template using file function.   But for this function we need to create source and destination files. If you want to simply monitor one file and destination file is unwanted, you can do simple trick using optional command in consul-template, something like this: template {     contents = "{{ file \"$WATCHING_FILE\" }}"     destination = "$DEV_NULL_FILE"     command = "/bin/sh -c 'rm -f $DEV_NULL_FILE'" } In this template we monitor $WATCHING_FILE. If it changed, consul-template creates new $DEV_NULL_FILE  and triggers command  "/bin/sh -c 'rm -f $DEV_NULL_FILE'" which delete this file. So finally we can have exec block, which is triggered after this template.  
Далее...