Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
Received-SPF: pass (nike.apache.org: domain of matt@nextdoor.com designates
 209.85.220.51 as permitted sender)
From: Matt Wise <matt@nextdoor.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_EB74A58F-901D-4E43-A3BC-93A43AE03D5F"
Subject: ACLs Ephemeral Nodes?
Message-Id: <ECF1361E-E9B0-4C3C-B520-432FE543289E@nextdoor.com>
Date: Thu, 27 Dec 2012 08:30:48 -0800
To: "user@zookeeper.apache.org" <user@zookeeper.apache.org>
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))

--Apple-Mail=_EB74A58F-901D-4E43-A3BC-93A43AE03D5F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Is there a way to set an ACL for an ephemeral node so that it cannot be =
deleted/modified by anybody other than the unique session ID that =
created it? It seems like if I have the following path layout and I set =
/servers so that its 'read only' to everyone, and a special digest auth =
has access to create/delete/modify it, that auth also has access to =
delete the nodes from it.=20

> /servers/server1:22
> /servers/server2:22
> /servers/server3:22

Ideally, I'd like to say that a client needs special credentials to =
create a node in there (say: 'foo:bar').. but once that node is created, =
no other session ID can delete or change that node. However, it seems =
like the ability to delete a child node rests in the permissions of the =
parent directory, rather  than on that child node itself. Correct?

--Matt


--Apple-Mail=_EB74A58F-901D-4E43-A3BC-93A43AE03D5F--