[
https://issues.apache.org/jira/browse/ZOOKEEPER-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15480110#comment-15480110
]
Alexander Shraer commented on ZOOKEEPER-1045:
---------------------------------------------
We discussed this with Rakesh offline, and here's a summary of what I propose.
Any comments appreciated!
1. Make auth checks on both sides of a connection - both receiving and
connecting, for both FLE connections as well as connections to leader.
2. in 3.4, create a separate file for the auth list, and link it from zoo.cfg,
similarly to the way I link the dynamic config file from zoo.cfg.
This will make updating the file easier in 3.5 (see below).
3. In 3.5 support dynamic addition/removal of permissions (this may be very
similar to dynamic reconfig): store the auth list in a znode,
create a new command for addition/removal/query from the auth list. Whenever
the auth list is updated, also update the on-disk auth file.
3.1. before a server can be added to the cluster using dynamic reconfig, it
needs to be added using dynamic auth list command
3.2 when a server is removed from the cluster using dynamic reconfig, the auth
list isn't changed. It may continue to include the server,
and you may add it back to the cluster in the future. (membership info is
separate from auth info - for example the auth list can have 10 servers
that you intend to add to the cluster some time in the future).
3.3. when a server is removed from the auth list, all existing connections to
that server from other servers can be dropped upon commit
of the auth change command.
> Support Quorum Peer mutual authentication via SASL
> --------------------------------------------------
>
> Key: ZOOKEEPER-1045
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1045
> Project: ZooKeeper
> Issue Type: New Feature
> Components: server
> Reporter: Eugene Koontz
> Assignee: Rakesh R
> Priority: Critical
> Fix For: 3.4.10, 3.5.3
>
> Attachments: 0001-ZOOKEEPER-1045-br-3-4.patch,
> 1045_failing_phunt.tar.gz, HOST_RESOLVER-ZK-1045.patch,
> TEST-org.apache.zookeeper.server.quorum.auth.QuorumAuthUpgradeTest.txt,
> ZK-1045-test-case-failure-logs.zip, ZOOKEEPER-1045-00.patch,
> ZOOKEEPER-1045-Rolling Upgrade Design Proposal.pdf,
> ZOOKEEPER-1045-br-3-4.patch, ZOOKEEPER-1045-br-3-4.patch,
> ZOOKEEPER-1045-br-3-4.patch, ZOOKEEPER-1045-br-3-4.patch,
> ZOOKEEPER-1045-br-3-4.patch, ZOOKEEPER-1045-br-3-4.patch,
> ZOOKEEPER-1045TestValidationDesign.pdf
>
>
> ZOOKEEPER-938 addresses mutual authentication between clients and servers.
> This bug, on the other hand, is for authentication among quorum peers.
> Hopefully much of the work done on SASL integration with Zookeeper for
> ZOOKEEPER-938 can be used as a foundation for this enhancement.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
