[
https://issues.apache.org/jira/browse/DRILL-5671?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16087820#comment-16087820
]
ASF GitHub Bot commented on DRILL-5671:
---------------------------------------
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/875#discussion_r127524590
--- Diff:
exec/java-exec/src/main/java/org/apache/drill/exec/ExecConstants.java ---
@@ -39,6 +39,7 @@
String ZK_TIMEOUT = "drill.exec.zk.timeout";
String ZK_ROOT = "drill.exec.zk.root";
String ZK_REFRESH = "drill.exec.zk.refresh";
+ String ZK_SECURE_ACL = "drill.exec.zk.use.secure_acl";
--- End diff --
`use.secure_acl` --> `secure_acl` as `use` is not a group. This provides:
```
zk: {
connect: "localhost:2181",
root: "drill",
secure_acl: true,
```
Are we using ACL's for security? Then, we are really "applying" ACLs, so
maybe `apply_acl` (apply an access control list...)
> Set secure ACLs (Access Control List) for Drill ZK nodes in a secure cluster
> ----------------------------------------------------------------------------
>
> Key: DRILL-5671
> URL: https://issues.apache.org/jira/browse/DRILL-5671
> Project: Apache Drill
> Issue Type: New Feature
> Components: Server
> Reporter: Karthikeyan Manivannan
> Assignee: Karthikeyan Manivannan
>
> All Drill ZK nodes, currently, are assigned a default [world:all] ACL i.e.
> anyone gets to do CDRWA(create, delete, read, write, admin access). This
> means that even on a secure cluster anyone can perform all CRDWA actions on
> the znodes.
> This should be changed such that:
> - In a non-secure cluster, Drill will continue using the current default
> [world:all] ACL
> - In a secure cluster, all nodes should have an [authid: all] ACL i.e. the
> authenticated user that created the znode gets full access. The discovery
> znodes i.e. the znodes with the list of Drillbits will have an additional
> [world:read] ACL, i.e. the list of Drillbits will be readable by anyone.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
