Mailing-List: contact dev-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@zookeeper.apache.org
Date: Fri, 4 Nov 2016 05:04:58 +0000 (UTC)
From: "Benjamin Reed (JIRA)" <jira@apache.org>
To: dev@zookeeper.apache.org
Message-ID: <JIRA.12735645.1408589857000.184642.1478235898407@Atlassian.JIRA>
In-Reply-To: <JIRA.12735645.1408589857000@Atlassian.JIRA>
References: <JIRA.12735645.1408589857000@Atlassian.JIRA> <JIRA.12735645.1408589857785@arcas>
Subject: [jira] [Commented] (ZOOKEEPER-2014) Only admin should be allowed to
 reconfig a cluster
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 04 Nov 2016 05:05:00 -0000


    [ https://issues.apache.org/jira/browse/ZOOKEEPER-2014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15635265#comment-15635265 ] 

Benjamin Reed commented on ZOOKEEPER-2014:
------------------------------------------

ah that makes sense. i didn't dig deep enough :) it is sad that an exception "that should never happen" has such a big impact on the code. shouldn't we have thrown a runtime exception? i think it would have eliminated a lot of this patch...

this is just an observation not a vote :)

> Only admin should be allowed to reconfig a cluster
> --------------------------------------------------
>
>                 Key: ZOOKEEPER-2014
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2014
>             Project: ZooKeeper
>          Issue Type: Bug
>          Components: server
>    Affects Versions: 3.5.0
>            Reporter: Raul Gutierrez Segales
>            Assignee: Michael Han
>            Priority: Blocker
>             Fix For: 3.5.3
>
>         Attachments: ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch
>
>
> ZOOKEEPER-107 introduces reconfiguration support via the reconfig() call. We should, at the very least, ensure that only the Admin can reconfigure a cluster. Perhaps restricting access to /zookeeper/config as well, though this is debatable. Surely one could ensure Admin only access via an ACL, but that would leave everyone who doesn't use ACLs unprotected. We could also force a default ACL to make it a bit more consistent (maybe).
> Finally, making reconfig() only available to Admins means they have to run with zookeeper.DigestAuthenticationProvider.superDigest (which I am not sure if everyone does, or how would it work with other authentication providers). 
> Review board https://reviews.apache.org/r/51546/


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)