[
https://issues.apache.org/jira/browse/ZOOKEEPER-2014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15561850#comment-15561850
]
Flavio Junqueira commented on ZOOKEEPER-2014:
---------------------------------------------
[~hanm] I'm probably missing something obvious, but when I try to reconfigure,
I get an auth failure, but I think I'm setting up everything right. This is the
output of ZooKeeperMain plus my commands:
{noformat}
Connecting to localhost:2181
log4j:WARN No appenders could be found for logger
(org.apache.zookeeper.ZooKeeper).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more
info.
Welcome to ZooKeeper!
JLine support is disabled
WATCHER::
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
WatchedEvent state:SyncConnected type:None path:null
addauth digest super:test
getAcl /zookeeper/config
'digest,'super:D/InIHSb7yEEbrWz8b9l71RjZJU=
: a
reconfig -add server.5=127.0.0.1:1234:1235;1236
Authentication is not valid :
{noformat}
I have {{reconfigEnabled=true}} in the configuration of the servers.
> Only admin should be allowed to reconfig a cluster
> --------------------------------------------------
>
> Key: ZOOKEEPER-2014
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2014
> Project: ZooKeeper
> Issue Type: Bug
> Components: server
> Affects Versions: 3.5.0
> Reporter: Raul Gutierrez Segales
> Assignee: Michael Han
> Priority: Blocker
> Fix For: 3.5.3
>
> Attachments: ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch,
> ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch,
> ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch, ZOOKEEPER-2014.patch
>
>
> ZOOKEEPER-107 introduces reconfiguration support via the reconfig() call. We
> should, at the very least, ensure that only the Admin can reconfigure a
> cluster. Perhaps restricting access to /zookeeper/config as well, though this
> is debatable. Surely one could ensure Admin only access via an ACL, but that
> would leave everyone who doesn't use ACLs unprotected. We could also force a
> default ACL to make it a bit more consistent (maybe).
> Finally, making reconfig() only available to Admins means they have to run
> with zookeeper.DigestAuthenticationProvider.superDigest (which I am not sure
> if everyone does, or how would it work with other authentication providers).
> Review board https://reviews.apache.org/r/51546/
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
