[HBASE-14775] Replication can't authenticate with peer Zookeeper with different server principal

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Replication, security
• Assignee: Unassigned
• Reporter: Gary Helmling
• Created: 06/Nov/15 00:02
• Updated: 03/Feb/24 07:49

Description

When replication is setup with security, where the local ZK cluster and peer ZK cluster use different server principals, the source HBase cluster is unable to authenticate with the peer ZK cluster.

When ZK is configured for SASL authentication and a server principal other than the default ("zookeeper") is used, the correct server principal must be specified on the client as a system property – the confusingly named zookeeper.sasl.client.username. However, since this is given as a system property, authentication with the peer cluster breaks when it uses a different ZK server principal than the local cluster.

We need a way of tying this setting to the replication peer config and then setting the property when the peer's ZooKeeperWatcher is created.

Issue Links

• relates to: ZOOKEEPER-2139 Support multiple ZooKeeper client, with different configurations, in a single JVM