Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
MIME-Version: 1.0
From: Irfan Hamid <ihamid@salesforce.com>
Date: Fri, 29 Jan 2016 14:51:01 -0800
Message-ID: 
 <CANP1xSKk2R2EBW5gsFq59t6-fsi9bjB_LQjPCQ57RydMZW94nQ@mail.gmail.com>
Subject: Kerberos authentication setup question
To: user@zookeeper.apache.org
Content-Type: multipart/alternative; boundary=001a11c3db70bc1208052a80dfd7

--001a11c3db70bc1208052a80dfd7
Content-Type: text/plain; charset=UTF-8

Hi,

We're trying to set up ZooKeeper with Kerberos authentication in our setup.
The documentation about setting this up is a bit complicated. The steps for
the ZooKeeper quorum servers are quite clear:

*ZooKeeper quorum servers*
1. Create zookeeper service principals as described here
<http://www.cloudera.com/documentation/archive/cdh/4-x/4-2-0/CDH4-Security-Guide/cdh4sg_topic_11_1.html>.
I am creating them as zookeeper/fqdn.of.my.zk.quorum.server@MYREAL.COM
2. Copy the keytab files created in (1) to the respective ZooKeeper quorum
servers and place it in the ZooKeeper conf directory
3. Add the configs indicated to the zoo.cfg file
4. Add a jaas.conf file (and point to it as part of the jvm params) as
indicated

*ZooKeeper client side*
This part is throwing me for a loop. We are using the basic ZooKeeper API
(not Curator) in our client side code and creating connections using the
vanilla new ZooKeeper(cxnString, ...) constructor. The only documentation
on how to set this up I could find is here
<http://www.cloudera.com/documentation/archive/cdh/4-x/4-3-0/CDH4-Security-Guide/cdh4sg_topic_11_2.html>.
I was wondering if the linked steps would work for my use-case or if these
are for a specific Cloudera ZooKeeper client tool?

1. Create zookeeper client principals using zkcli@MYREAL.COM (the client's
FQDN isn't needed here?)
2. Copy the keytab file to the machine running our client app
3. Make the necessary modifications to jaas.conf
4. Run our client app with the JVM param pointing to the jaas.conf file
from (2)

Is my understanding correct or are these steps only for the Cloudera client
shell?

Regards,
Irfan.

--001a11c3db70bc1208052a80dfd7--