[ZOOKEEPER-938] Support Kerberos authentication of clients.

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.4.0
• Component/s: java client, server
• Hadoop Flags: Reviewed
• Release Note: ZOOKEEPER-938 : support Kerberos authentication via SASL.
• Assignee: Eugene Joseph Koontz
• Reporter: Eugene Joseph Koontz
• Created: 23/Nov/10 17:25
• Updated: 28/Apr/14 04:03
• Resolved: 18/Aug/11 22:05

Description

Support Kerberos authentication of clients.

The following usage would let an admin use Kerberos authentication to assign ACLs to authenticated clients.

1. Admin logs into zookeeper (not necessarily through Kerberos however).

2. Admin decides that a new node called '/mynode' should be owned by the user 'zkclient' and have full permissions on this.

3. Admin does: zk> create /mynode content sasl:[e-mail]:cdrwa

4. User 'zkclient' logins to kerberos using the command line utility 'kinit'.

5. User connects to zookeeper server using a Kerberos-enabled version of zkClient (ZookeeperMain).

6. Behind the scenes, the client and server exchange authentication information. User is now authenticated as 'zkclient'.

7. User accesses /mynode with permissions 'cdrwa'.

Issue Links

• blocks: ZOOKEEPER-1045 Support Quorum Peer mutual authentication via SASL
• blocks: ZOOKEEPER-1112 Add support for C client for SASL authentication
• is depended upon by: HBASE-3025 Coprocessor based simple access control
• is depended upon by: ZOOKEEPER-1373 Hardcoded SASL login context name clashes with Hadoop security configuration override
• is depended upon by: ZOOKEEPER-1181 Fix problems with Kerberos TGT renewal
• is depended upon by: ZOOKEEPER-1185 Send AuthFailed event to client if SASL authentication fails
• is depended upon by: ZOOKEEPER-1195 SASL authorizedID being incorrectly set: should use getHostName() rather than getServiceName()
• is depended upon by: GIRAPH-265 Enable Zookeeper security support within Giraph
• is depended upon by: ZOOKEEPER-1469 Adding Cross-Realm support for secure Zookeeper client authentication
• is related to: ZOOKEEPER-1920 Login thread is not shutdown when close the ClientCnxn
• is related to: ZOOKEEPER-1236 Security uses proprietary Sun APIs
• is related to: HADOOP-4487 Security features for Hadoop
• is related to: ZOOKEEPER-1422 Support _HOST substitution in JAAS configuration
• is related to: HBASE-2418 add support for ZooKeeper authentication
• relates to: ZOOKEEPER-1437 Client uses session before SASL authentication complete
• relates to: ZOOKEEPER-1420 Kerberos principal to user mapping / authorization
• relates to: HIVE-2467 HA Support for Metastore Server
• relates to: ZOOKEEPER-896 Improve client to support dynamic authentication schemes
• requires: ZOOKEEPER-329 document how to integrate 3rd party authentication into ZK server ACLs