[ZOOKEEPER-1373] Hardcoded SASL login context name clashes with Hadoop security configuration override

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.2
• Fix Version/s: 3.4.3, 3.5.0
• Component/s: java client
• Assignee: Eugene Joseph Koontz
• Reporter: Thomas Weise
• Created: 24/Jan/12 03:40
• Updated: 02/May/13 02:29
• Resolved: 06/Feb/12 08:37

Description

I'm trying to configure a process with Hadoop security (Hive metastore server) to talk to ZooKeeper 3.4.2 with Kerberos authentication. In this scenario Hadoop controls the SASL configuration (org.apache.hadoop.security.UserGroupInformation.HadoopConfiguration), instead of setting up the ZooKeeper "Client" loginContext via jaas.conf and system property

-Djava.security.auth.login.config

Using the Hadoop configuration would work, except that ZooKeeper client code expects the loginContextName to be "Client" while Hadoop security will use "hadoop-keytab-kerberos". I verified that by changing the name in the debugger the SASL authentication succeeds while otherwise the login configuration cannot be resolved and the connection to ZooKeeper is unauthenticated.

To integrate with Hadoop, the following in ZooKeeperSaslClient would need to change to make the name configurable:

login = new Login("Client",new ClientCallbackHandler(null));

Issue Links

• depends upon: ZOOKEEPER-938 Support Kerberos authentication of clients.
• is depended upon by: HIVE-2712 Make ZooKeeper token store ACL configurable
• is related to: HADOOP-7853 multiple javax security configurations cause conflicts
• is related to: ZOOKEEPER-1497 Allow server-side SASL login with JAAS configuration to be programmatically set (rather than only by reading JAAS configuration file)
• is related to: HBASE-4791 Allow Secure Zookeeper JAAS configuration to be programmatically set (rather than only by reading JAAS configuration file)
• is related to: ZOOKEEPER-1467 Make server principal configurable at client side.
• relates to: HADOOP-7853 multiple javax security configurations cause conflicts