[ https://issues.apache.org/jira/browse/ZOOKEEPER-1634?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Patrick Hunt updated ZOOKEEPER-1634: ------------------------------------ Issue Type: New Feature (was: Improvement) > A new feature proposal to ZooKeeper: authentication enforcement > --------------------------------------------------------------- > > Key: ZOOKEEPER-1634 > URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1634 > Project: ZooKeeper > Issue Type: New Feature > Components: server > Affects Versions: 3.4.5 > Reporter: Jaewoong Choi > Fix For: 3.5.2, 3.6.0 > > Attachments: > zookeeper_3.4.5_patch_for_authentication_enforcement.patch > > Original Estimate: 72h > Remaining Estimate: 72h > > Up to the version of 3.4.5, ZooKeeperServer doesn't force the authentication > if the client doesn't give any auth-info through ZooKeeper#addAuthInfo method > invocation. Hence, every znode should have at least one ACL assigned > otherwise any unauthenticated client can do anything on it. > The current authentication/authorization mechanism of ZooKeeper described > above has several points at issue: > 1. At security standpoint, a maleficent client can access a znode which > doesn't have any proper authorization access control set. > 2. At runtime performance standpoint, authorization for every znode to every > operation is unnecessarily but always evaluated against the client who > bypassed the authentication phase. > In other words, the current mechanism doesn't address a certain requirement > at below: > "We want to protect a ZK server by enforcing a simple authentication to every > client no matter which znode it is trying to access. Every connection (or > operation) from the client won't be established but rejected if it doesn't > come with a valid authentication information. As we don't have any other > distinction between znodes in term of authorization, we don't want any ACLs > on any znode." > To address the issues mentioned above, we propose a feature called > "authentication enforcement" to the ZK source. The idea is roughly but > clearly described in a form of patch in the attached file > (zookeeper_3.4.5_patch_for_authentication_enforcement.patch): which makes > ZooKeeperServer enforce the authentication with the given 2 configurations: > authenticationEnforced (boolean) and enforcedAuthenticationScheme (string) > against every operation coming through ZooKeeperServer#processPacket method > except for OpCode.auth operation. The repository base of the patch is > "http://svn.apache.org/repos/asf/zookeeper/tags/release-3.4.5/" -- This message was sent by Atlassian JIRA (v6.3.4#6332)