[
https://issues.apache.org/jira/browse/NIFI-6463?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16891024#comment-16891024
]
Bryan Bende commented on NIFI-6463:
-----------------------------------
Just enabling SASL on ZooKeeper side will not create proper ACLs on its own.
There is configuration on NiFi side that has to be setup in nifi.properties:
{code:java}
# Zookeeper properties for the authentication scheme used when creating acls on
znodes used for cluster management
# Values supported for nifi.zookeeper.auth.type are "default", which will apply
world/anyone rights on znodes
# and "sasl" which will give rights to the sasl/kerberos identity used to
authenticate the nifi node
# The identity is determined using the value in nifi.kerberos.service.principal
and the removeHostFromPrincipal
# and removeRealmFromPrincipal values (which should align with the
kerberos.removeHostFromPrincipal and kerberos.removeRealmFromPrincipal
# values configured on the zookeeper server).
nifi.zookeeper.auth.type=
nifi.zookeeper.kerberos.removeHostFromPrincipal=
nifi.zookeeper.kerberos.removeRealmFromPrincipal={code}
> Nifi Zookeeper allows anyone to modify data
> -------------------------------------------
>
> Key: NIFI-6463
> URL: https://issues.apache.org/jira/browse/NIFI-6463
> Project: Apache NiFi
> Issue Type: Improvement
> Reporter: Jerome Xue
> Priority: Major
>
> Our zookeeper cluster has SASL enabled.
> But when I check ACL rules on zookeeper, it's 'world,' anyone cdrwa.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
