[
https://issues.apache.org/jira/browse/ZOOKEEPER-2793?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16208133#comment-16208133
]
Rakesh R commented on ZOOKEEPER-2793:
-------------------------------------
Also, thanks a lot [~shralex] for the #reconfig discussions during ZK-1045
implementation in {{branch-3.4}}. I'm thinking to programatically build the
{{/zookeeper/authorized_hosts}} while upgrading from 3.4 to 3.5 from
{{zoo.cfg}} file. Later on, before #reconfig user has to call the #setData or
cli commands to update the hosts.
> [QP MutualAuth]: Implement a mechanism to build "authzHosts" for dynamic
> reconfig servers
> -----------------------------------------------------------------------------------------
>
> Key: ZOOKEEPER-2793
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2793
> Project: ZooKeeper
> Issue Type: Sub-task
> Components: quorum, security
> Reporter: Rakesh R
> Assignee: Rakesh R
> Fix For: 3.5.4, 3.6.0
>
>
> {{QuorumServer}} will do the authorization checks against configured
> authorized hosts. During LE, QuorumLearner will send an authentication packet
> to QuorumServer. Now, QuorumServer will check that the connecting
> QuorumLearner’s hostname exists in the authorized hosts. If not exists then
> connecting peer is not authorized to join this ensemble and the request will
> be rejected immediately.
> In {{branch-3.4}} building {{authzHosts}} list is pretty straight forward,
> can use the ensemble server details in zoo.cfg file. But with dynamic
> reconfig, it has to consider the dynamic add/remove/update servers and need
> to discuss the ways to handle dynamic cases.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
