Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
From: Jordan Zimmerman <jordan@jordanzimmerman.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_49B54455-2AED-4125-9027-F1E810EB3612"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Subject: Re: Setting acls in Zookeeper
Date: Wed, 8 Feb 2017 15:03:07 -0500
References: <CAMRGZUaZTHwmf+-UsHSMbMHgFQ+k=tWsf8b=rOVke_Lzj7=VFg@mail.gmail.com>
 <737C3389-AFEE-451E-BA20-5E363C4978B3@jordanzimmerman.com>
 <CAMRGZUaT_9w__=oSafhDkWPY-NBz3SikNmNNxcSSnYM9-e8_0Q@mail.gmail.com>
To: user@zookeeper.apache.org
In-Reply-To: <CAMRGZUaT_9w__=oSafhDkWPY-NBz3SikNmNNxcSSnYM9-e8_0Q@mail.gmail.com>
Message-Id: <0F37F0F7-B4DA-4A8B-93F4-32F139C7DFB5@jordanzimmerman.com>
archived-at: Wed, 08 Feb 2017 20:03:15 -0000

--Apple-Mail=_49B54455-2AED-4125-9027-F1E810EB3612
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

AddAuth sets the authorization value for the current connection. It's =
the client-side portion of the ACL spec. What you want is "setAcl".

	setAcl [-s] [-v version] path acl

-Jordan

> On Feb 8, 2017, at 1:52 PM, Megha Sharma =
<megha.hitesh.kapil@gmail.com> wrote:
>=20
> Thanks Jordan
> That was my understanding as well, wanted to make sure that setting =
acls
> doesn't need zkServer restart. The way I am setting the acls could be
> faulty then, I am trying to set the acl ZOO_AUTH_IDS and
> ZOO_READ_ACL_UNSAFE using zkCli. According to zookeeper doc, =
ZOO_AUTH_IDS
> translates to (=E2=80=98auth=E2=80=99,=E2=80=99=E2=80=99) and empty =
identity string should be interpreted
> as =E2=80=9Cthe identity of the creator=E2=80=9D. I have tried both =
empty identity string
> (2) and with credentials (1) with zkCli and I am not sure which is the
> correct way of achieving ZOO_AUTH_IDS.
>=20
>=20
> 1) addauth digest user:pwd
>    setAcl /mesos world:anyone:r,auth::crdwa
>=20
> 2) addauth digest user:pwd
>    setAcl /mesos world:anyone:r,auth:user:pwd:cdrwa
>=20
> Thanks
> Megha
>=20
>=20
> On Wed, Feb 8, 2017 at 7:27 AM, Jordan Zimmerman =
<jordan@jordanzimmerman.com
>> wrote:
>=20
>>> I have been trying to set acls with zkCli and it seems like the acls
>> don=E2=80=99t
>>> take effect until all the zkServers are restarted. Do the acls need
>>> zkServer restart?
>>=20
>> No. ACL changes take effect immediately. It's a ZNode modification =
like
>> any other. Do you have an example of the problem?
>>=20
>> -Jordan


--Apple-Mail=_49B54455-2AED-4125-9027-F1E810EB3612--