Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
Received-SPF: pass (nike.apache.org: domain of rakeshr@huawei.com designates
 119.145.14.65 as permitted sender)
From: Rakesh R <rakeshr@huawei.com>
To: "sharma.sucheta@gmail.com" <sharma.sucheta@gmail.com>,
        "user@zookeeper.apache.org" <user@zookeeper.apache.org>,
        "zookeeper-user@hadoop.apache.org" <zookeeper-user@hadoop.apache.org>
Subject: RE: authorize and authenticate zookeeper nodes
Thread-Topic: authorize and authenticate zookeeper nodes
Thread-Index: AQHP0u3HGwTb7zWohUCvFoscHBMqR5wGTrmQgAGP+nA=
Date: Fri, 19 Sep 2014 05:27:41 +0000
Message-ID: 
 <C2496325850AA74C92AAF83AA9662D26458D64C2@szxeml561-mbx.china.huawei.com>
References: <1411009659613-7580303.post@n2.nabble.com> 
Accept-Language: en-US, zh-CN
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Hi Sucheta,

Yes its possible to do by setting the ACLs and the authentication schemes(I=
P, Digest, Sasl schemes) available in ZK.=20

>>>>1) Zookeeper znode should be accessed by selected ip addresses only.
>>>>2) Zookeeper znode should be accessed by selected users only.

Let me try to brief the ACLs through the examples.

IP Example:
		    ArrayList<ACL> testACL =3D new ArrayList<ACL>();
                testACL.add(new ACL(Perms.ADMIN, new Id("ip", "127.0.0.1"))=
);
                zk.create("/acltest", new byte[0], testACL, CreateMode.PERS=
ISTENT);
                zk.getACL("/acltest", new Stat());

User Example:
          =20
		zk1 =3D // create zk client
            zk1.addAuthInfo("digest", "ben:passwd".getBytes());
            zk1.create("/acltest", new byte[0], Ids.CREATOR_ALL_ACL, Create=
Mode.PERSISTENT);
           =20
            zk2 =3D // create another client
            zk2.addAuthInfo("digest", "ben:passwd2".getBytes());=20
		zk2.getData("/acltest", false, new Stat()); // Accessing this will throw =
Auth exceptions.

Sasl Example: Refer org.apache.zookeeper.test.SaslAuthTest.java

Also, please see my below mail thread about the Wiki pages (replied on yest=
erday).

-Rakesh
-----Original Message-----
From: Rakesh R=20
Sent: 18 September 2014 10:29
To: 'user@zookeeper.apache.org'; zookeeper-user@hadoop.apache.org
Subject: RE: authorize and authenticate zookeeper nodes


Yes, there are different authentication schemes available in ZooKeeper and =
is pluggable. Based on the usecase one can choose it.

Please see the wiki page to get more details:
https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zookeeper+and+SASL

-Rakesh

-----Original Message-----
From: Sucheta [mailto:sharma.sucheta@gmail.com]=20
Sent: 18 September 2014 08:38
To: zookeeper-user@hadoop.apache.org
Subject: authorize and authenticate zookeeper nodes

Hi,

I want to authorize and authenticate zookeeper nodes so that:-

1) Zookeeper znode should be accessed by selected ip addresses only.
2) Zookeeper znode should be accessed by selected users only.

Please let me know how to do this. Can we use openAM for this?


--
View this message in context: http://zookeeper-user.578899.n2.nabble.com/au=
thorize-and-authenticate-zookeeper-nodes-tp7580303.html
Sent from the zookeeper-user mailing list archive at Nabble.com.