Return-Path: <dev-return-50465-archive-asf-public=cust-asf.ponee.io@zookeeper.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id 2E31F200B80
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Wed, 14 Sep 2016 15:39:27 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id 2CCF9160ABA; Wed, 14 Sep 2016 13:39:27 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 7577B160AB4
	for <archive-asf-public@cust-asf.ponee.io>; Wed, 14 Sep 2016 15:39:26 +0200 (CEST)
Received: (qmail 22378 invoked by uid 500); 14 Sep 2016 13:39:20 -0000
Mailing-List: contact dev-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@zookeeper.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@zookeeper.apache.org>
List-Post: <mailto:dev@zookeeper.apache.org>
List-Id: <dev.zookeeper.apache.org>
Reply-To: dev@zookeeper.apache.org
Delivered-To: mailing list dev@zookeeper.apache.org
Received: (qmail 22351 invoked by uid 99); 14 Sep 2016 13:39:20 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 14 Sep 2016 13:39:20 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id 7714F2C0D56
	for <dev@zookeeper.apache.org>; Wed, 14 Sep 2016 13:39:20 +0000 (UTC)
Date: Wed, 14 Sep 2016 13:39:20 +0000 (UTC)
From: "Rakesh Kumar Singh (JIRA)" <jira@apache.org>
To: dev@zookeeper.apache.org
Message-ID: <JIRA.13004890.1473860338000.571230.1473860360484@Atlassian.JIRA>
In-Reply-To: <JIRA.13004890.1473860338000@Atlassian.JIRA>
References: <JIRA.13004890.1473860338000@Atlassian.JIRA> <JIRA.13004890.1473860338472@arcas>
Subject: [jira] [Created] (ZOOKEEPER-2582) When addauth twice for same user
 but different password, it is adding 2 digest corresponding to both
 username, password and so we can able to access znode with user and any of
 these password which does not seem to be correct
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
archived-at: Wed, 14 Sep 2016 13:39:27 -0000

Rakesh Kumar Singh created ZOOKEEPER-2582:
---------------------------------------------

             Summary: When addauth twice for same user but different password, it is adding 2 digest corresponding to both username, password and so we can able to access znode with user and any of these password which does not seem to be correct
                 Key: ZOOKEEPER-2582
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2582
             Project: ZooKeeper
          Issue Type: Bug
          Components: server
    Affects Versions: 3.5.1
            Reporter: Rakesh Kumar Singh


When addauth twice for same user but different password, it is adding 2 digest corresponding to both username, password and so we can able to access znode with user and any of these password which does not seem to be correct

Steps:-
[zk: localhost:2181(CONNECTED) 0] addauth digest user1:pass1
[zk: localhost:2181(CONNECTED) 1] addauth digest user1:pass

[zk: localhost:2181(CONNECTED) 9] create /user_test5 hello
Created /user_test5
[zk: localhost:2181(CONNECTED) 10] setAcl /user_test5 auth:user1:pass1:crdwa
[zk: localhost:2181(CONNECTED) 11] getAcl /user_test5
'digest,'user1:+7K83PhyQ3ijGj0ADmljf0quVwQ=
: cdrwa
'digest,'user1:UZIsvOKp29j8vAahJzjgpA1VTOk=
: cdrwa


Here we can see 2 entries for same user (user1) with different password

Now disconnect the client and connect again using zkCli.sh
addauth digest user1:<any of 2 password>, we can able to access the znode.

[zk: localhost:2181(CONNECTED) 0] get /user_test5
Authentication is not valid : /user_test5
[zk: localhost:2181(CONNECTED) 1] addauth digest user1:pass
[zk: localhost:2181(CONNECTED) 2] get /user_test5
hello

Same way, it will allow n number of entry if we addauth for same user with n number of password




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)