[ZOOKEEPER-1497] Allow server-side SASL login with JAAS configuration to be programmatically set (rather than only by reading JAAS configuration file)

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.3, 3.5.0
• Fix Version/s: 3.4.4, 3.5.0
• Component/s: server
• Labels: security
• Hadoop Flags: Reviewed
• Assignee: Matteo Bertozzi
• Reporter: Matteo Bertozzi
• Created: 03/Jul/12 21:08
• Updated: 26/Sep/12 18:17
• Resolved: 30/Aug/12 18:30

Description

Currently the CnxnFactory checks for "java.security.auth.login.config" to decide whether or not enable SASL.

• zookeeper/server/NIOServerCnxnFactory.java
• zookeeper/server/NettyServerCnxnFactory.java
  • configure() checks for "java.security.auth.login.config"
    • If present start the new Login("Server", SaslServerCallbackHandler(conf))

But since the SaslServerCallbackHandler does the right thing just checking if getAppConfigurationEntry() is empty, we can allow SASL with JAAS configuration to be programmatically just checking weather or not a configuration entry is present instead of "java.security.auth.login.config".
(Something quite similar was done for the SaslClient in ZOOKEEPER-1373)

Issue Links

• is related to: ZOOKEEPER-1455 there is no way to determine if a session is sasl authenticated or not
• relates to: ZOOKEEPER-1373 Hardcoded SASL login context name clashes with Hadoop security configuration override
• relates to: ZOOKEEPER-1503 remove redundant JAAS configuration code in SaslAuthTest and SaslAuthFailTest