[HBASE-4791] Allow Secure Zookeeper JAAS configuration to be programmatically set (rather than only by reading JAAS configuration file)

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.94.4, 0.95.0
• Component/s: security, Zookeeper
• Labels: security zookeeper
• Hadoop Flags: Reviewed
• Assignee: Matteo Bertozzi
• Reporter: Eugene Joseph Koontz
• Created: 15/Nov/11 20:49
• Updated: 02/May/13 02:29
• Resolved: 18/Dec/12 00:55

Description

In the currently proposed fix for HBASE-2418, there must be a JAAS file specified in System.setProperty("java.security.auth.login.config").

However, it might be preferable to construct a JAAS configuration programmatically, as is done with secure Hadoop (see https://github.com/apache/hadoop-common/blob/a48eceb62c9b5c1a5d71ee2945d9eea2ed62527b/src/java/org/apache/hadoop/security/UserGroupInformation.java#L175).

This would have the benefit of avoiding a usage of a system property setting, and allow instead an HBase-local configuration setting.

Issue Links

• depends upon: HBASE-2418 add support for ZooKeeper authentication
• is part of: HBASE-6099 Secure ZooKeeper integration changes
• is part of: HBASE-6096 AccessController v2
• is related to: HBASE-7829 zookeeper kerberos conf keytab and principal parameters interchanged
• is related to: ZOOKEEPER-1422 Support _HOST substitution in JAAS configuration
• relates to: ZOOKEEPER-1373 Hardcoded SASL login context name clashes with Hadoop security configuration override
• relates to: ZOOKEEPER-1467 Make server principal configurable at client side.