[ZOOKEEPER-3482] SASL (Kerberos) Authentication with SSL for clients and Quorum

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.5
• Fix Version/s: 3.6.0, 3.7.0, 3.5.7
• Component/s: server
• Labels: pull-request-available
• Assignee: Mate Szalay-Beko
• Reporter: Jörn Franke
• Created: 01/Aug/19 18:30
• Updated: 14/Feb/20 15:23
• Resolved: 22/Jan/20 10:10

Description

It seems that Kerberos authentication does not work for encrypted connections of clients and quorum. It seems that only X509 Authentication works.

What I would have expected:

ClientSecurePort is defined

A keystore and truststore are deployed on the ZooKeeper servers

Only a truststore is deployed with the client (to validate the CA of the server certificate)

Client can authenticate with SASL (Kerberos)

Similarly, it should work for the Quorum SSL connection.

Is there a way to configure this in ZooKeeper?

 

Note: Kerberos Authentication for SSL encrypted connection should be used instead of X509 authentication for this case and not in addition. However, if it only works in 3.5.5 in addition then I would be interested and willing to test it.

Issue Links

• relates to: SOLR-7893 Document ZooKeeper SSL support
• links to: GitHub Pull Request #1204
• links to: GitHub Pull Request #1205