Mailing-List: contact dev-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@zookeeper.apache.org
Date: Fri, 1 Jul 2016 14:52:10 +0000 (UTC)
From: "Botond Hejj (JIRA)" <jira@apache.org>
To: dev@zookeeper.apache.org
Message-ID: <JIRA.12986209.1467384601000.5345.1467384730957@Atlassian.JIRA>
In-Reply-To: <JIRA.12986209.1467384601000@Atlassian.JIRA>
References: <JIRA.12986209.1467384601000@Atlassian.JIRA> <JIRA.12986209.1467384601653@arcas>
Subject: [jira] [Updated] (ZOOKEEPER-2462) force
 authentication/authorization
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 01 Jul 2016 14:52:12 -0000


     [ https://issues.apache.org/jira/browse/ZOOKEEPER-2462?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Botond Hejj updated ZOOKEEPER-2462:
-----------------------------------
    Attachment: ZOOKEEPER-2462.patch

> force authentication/authorization
> ----------------------------------
>
>                 Key: ZOOKEEPER-2462
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2462
>             Project: ZooKeeper
>          Issue Type: New Feature
>          Components: server
>            Reporter: Botond Hejj
>            Priority: Minor
>         Attachments: ZOOKEEPER-2462.patch
>
>
> This change introduces two new config options to force authorization and authentication:
> 1. disableWorldACL
> The purpose of this option is disable the builtin mechanism which authorizes everyone.
> If it is turned on than the world/anyone usage is ignored. ZooKeeper will not check operations based on world/anyone.
> This option is useful to force some kind of authorization mechanism. This restriction is useful in a strictly audited environment.
> 2. forceAuthentication
> If this option is turned on than ZooKeeper won't authorize any operation if the user has not authenticated either with SASL or with addAuth.
> There is way to enforce SASL authentication but currently there is no way to enforce authentication using the plugin mechanism. Enforcing authentication for that is more tricky since authentication can come any time later. This option doesn't drop the connection if there was no authentication. It is only throwing NoAuth for any operation until the Auth packet arrives.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)