[ZOOKEEPER-1467] Make server principal configurable at client side.

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.3, 3.4.4, 3.5.0
• Fix Version/s: 3.6.0, 3.5.7
• Component/s: java client
• Labels: Security client kerberos pull-request-available sasl
• Release Note: Allow system property "zookeeper.clusterName", if defined, to be used as the instance portion of zookeeper server's Kerberos principal name. Otherwise, server's hostname will be used.
• Assignee: Sujith Simon
• Reporter: Laxman
• Created: 16/May/12 11:57
• Updated: 14/Feb/20 15:23
• Resolved: 01/Oct/19 07:37

Description

Server principal on client side is derived using hostname.

org.apache.zookeeper.ClientCnxn.SendThread.startConnect()

           try {
                zooKeeperSaslClient = new ZooKeeperSaslClient("zookeeper/"+addr.getHostName());
            }

This may have problems when admin wanted some customized principals like zookeeper/[e-mail] where clusterid is the cluster identifier but not the host name.

IMO, server principal also should be configurable as hadoop is doing.

Issue Links

• blocks: HBASE-1697 Discretionary access control
• is related to: ZOOKEEPER-2139 Support multiple ZooKeeper client, with different configurations, in a single JVM
• is related to: HBASE-4791 Allow Secure Zookeeper JAAS configuration to be programmatically set (rather than only by reading JAAS configuration file)
• is related to: ZOOKEEPER-2433 ZooKeeperSaslServer: allow user principals in subject
• relates to: ZOOKEEPER-1373 Hardcoded SASL login context name clashes with Hadoop security configuration override
• relates to: ZOOKEEPER-1420 Kerberos principal to user mapping / authorization
• requires: ZOOKEEPER-2257 Make zookeeper server principal configurable at zookeeper client side
• links to: GitHub Pull Request #1099
• links to: GitHub Pull Request #1104