[ZOOKEEPER-4753] Explicit handling of DIGEST-MD5 vs GSSAPI in quorum auth

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.9.0
• Fix Version/s: 3.7.2, 3.8.3, 3.9.1
• Component/s: server
• Labels: pull-request-available
• Flags: Patch
• Assignee: Damien Diederen
• Reporter: Damien Diederen
• Created: 03/Oct/23 12:51
• Updated: 26/Aug/24 05:49
• Resolved: 04/Oct/23 09:16

Description

The SASL-based quorum authorizer does not explicitly distinguish between the DIGEST-MD5 and GSSAPI mechanisms: it is simply relying on NameCallback and PasswordCallback for authentication with the former and examining Kerberos principals in AuthorizeCallback for the latter.

It turns out that some SASL/DIGEST-MD5 configurations cause authentication and authorization IDs not to match the expected format, and the DIGEST-MD5-based portions of the quorum test suite to fail with obscure errors. (They can be traced to failures to join the quorum, but only by looking into detailed logs.)

We can use the login module name to determine whether DIGEST-MD5 or GSSAPI is used, and relax the authentication ID check for the former. As a cleanup, we can keep the password-based credential map empty when Kerberos principals are expected. Finally, we can adapt tests to ensure "weirdly-shaped" credentials only cause authentication failures in the GSSAPI case.

Issue Links

• links to: GitHub Pull Request #2089
• links to: GitHub Pull Request #2090