hadoop-zookeeper-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Eugene Koontz (JIRA)" <j...@apache.org>
Subject [jira] Created: (ZOOKEEPER-938) support Kerberos Authentication
Date Tue, 23 Nov 2010 17:26:15 GMT
support Kerberos Authentication

                 Key: ZOOKEEPER-938
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-938
             Project: Zookeeper
          Issue Type: New Feature
          Components: server
            Reporter: Eugene Koontz

Support Keberos authentication of clients. 

The following usage would let an admin use Kerberos authentication to assign ACLs to authenticated

1. Admin logs into zookeeper (not necessarily through Kerberos however). 

2. Admin decides that a new node called '/mynode' should be owned by the user 'zkclient' and
have full permissions on this.

3. Admin does: zk> create /mynode content kerb:zkclient@FOOFERS.ORG:x:cdrwa

(note: for now, the dummy ':x' is a placeholder for the password, and is required by the zk
command parser. The user's actual password is not stored within Zookeeper; simply put 'x'

4. User 'zkclient' logins to kerberos using the command line utility 'kinit'.

5. User connects to zookeeper server using a Kerberos-enabled version of zkClient (ZookeeperMain).

6. Behind the scenes, the client and server exchange authentication information. User is now
authenticated as 'zkclient'.

7. User accesses /mynode with permissions 'cdrwa'.

This message is automatically generated by JIRA.
You can reply to this email to add a comment to the issue online.

View raw message