[ZOOKEEPER-4030] Optionally canonicalize host names in quorum SASL authentication

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.7.0
• Fix Version/s: 3.7.0
• Component/s: kerberos, quorum, server
• Labels: pull-request-available
• Assignee: Damien Diederen
• Reporter: Damien Diederen
• Created: 17/Dec/20 18:13
• Updated: 28/Mar/21 08:54
• Resolved: 05/Jan/21 13:22

Description

ZOOKEEPER-3156 introduced an option for canonicalizing the host name used by the Java client before starting SASL authentication, allowing Kerberos-authenticating servers to be referenced by CNAME.

The example given in that ticket's description explains how without that option, the client would compose a non-functional principal akin to zookeeper/zk1.mycluster.mycompany.com@... instead of the required zookeeper/real-node.mycompany.com@....

This is about introducing a similar option for server-to-server connections. It would allow enabling quorum SASL authentication for ensembles defined using {{CNAME}}s.

(Self-assigning as I have been working on this.)

Issue Links

• links to: GitHub Pull Request #1564