[ https://issues.apache.org/jira/browse/ZOOKEEPER-1373?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13196756#comment-13196756 ]
Mahadev konar commented on ZOOKEEPER-1373: ------------------------------------------ Took a look at the patch. It looks good overall, like the new test cases. Some minor nits, I think the ClientCnxn code needs to move out a little (ClientCnxn is getting too huge). Can we do a helper class for Security? Something like ZooKeeperSecureUtil where all this code can reside (creating a zk sasl client?). Also its a little painful to see all the config property names spread around. This is probably another jira where we move all the properties in a single place so that we dont have to go hunting arnd for our config properties. > Hardcoded SASL login context name clashes with Hadoop security configuration > override > ------------------------------------------------------------------------------------- > > Key: ZOOKEEPER-1373 > URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1373 > Project: ZooKeeper > Issue Type: Bug > Components: java client > Affects Versions: 3.4.2 > Reporter: Thomas Weise > Assignee: Eugene Koontz > Fix For: 3.4.3, 3.5.0 > > Attachments: ZOOKEEPER-1373-TW_3_4.patch, ZOOKEEPER-1373.patch, > ZOOKEEPER-1373.patch, ZOOKEEPER-1373.patch, ZOOKEEPER-1373.patch > > > I'm trying to configure a process with Hadoop security (Hive metastore > server) to talk to ZooKeeper 3.4.2 with Kerberos authentication. In this > scenario Hadoop controls the SASL configuration > (org.apache.hadoop.security.UserGroupInformation.HadoopConfiguration), > instead of setting up the ZooKeeper "Client" loginContext via jaas.conf and > system property > {{-Djava.security.auth.login.config}} > Using the Hadoop configuration would work, except that ZooKeeper client code > expects the loginContextName to be "Client" while Hadoop security will use > "hadoop-keytab-kerberos". I verified that by changing the name in the > debugger the SASL authentication succeeds while otherwise the login > configuration cannot be resolved and the connection to ZooKeeper is > unauthenticated. > To integrate with Hadoop, the following in ZooKeeperSaslClient would need to > change to make the name configurable: > {{login = new Login("Client",new ClientCallbackHandler(null));}} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira