Zookeeper ACL

Zookeeper ACL

7.1 Shell 操作

zookeeper本身提供了ACL机制，表示为scheme: id:permissions，第一个字段表示采用哪一种机制，第二个id表示用户，permissions表示相关权限（如只读，读写，管理等）。

7.1 .1 scheme ：id 介绍

• world: 它下面只有一个id, 叫anyone, world:anyone代表任何人，zookeeper中对所有人有权限的结点就是属于world:anyone的
• auth: 它不需要id, 只要是通过authentication的user都有权限（zookeeper支持通过kerberos来进行authencation, 也支持username/password形式的authentication)，使用auth来设置权限的时候，需要在zk里注册一个用户才可以
• digest: 它对应的id为username:BASE64(SHA1(password))，它需要先通过username:password形式的authentication
• ip: 它对应的id为客户机的IP地址，设置的时候可以设置一个ip段，比如ip:192.168.1.0/16, 表示匹配前16个bit的IP段
• super: 在这种scheme情况下，对应的id拥有超级权限，可以做任何事情(cdrwa）

7.1 .2 permissions

权限	ACL简写	描述
CREATE	c	可以创建子节点
DELETE	d	可以删除子节点（仅下一级节点）
READ	r	可以读取节点数据及显示子节点列表
WRITE	w	可以设置节点数据
ADMIN	a	可以设置节点访问控制列表权限

7.1.3 ACL Shell 命令

命令	使用方式	描述
getAcl	getAcl	读取ACL权限
setAcl	setAcl	设置ACL权限
addauth	addauth	添加认证用户

7.1.4 操作

World scheme

其实默认就是Word Scheme

语法

setAcl <path> world:anyone:<acl>

#随便创建一个节点
[zk: localhost:2181(CONNECTED) 61] create /ba 1
Created /baizhiedu
[zk: localhost:2181(CONNECTED) 62] getAcl /ba
'world,'anyone
: cdrwa

#在创建完成后相关节点，还可以通过setAcl的方式设置相关权限
[zk: localhost:2181(CONNECTED) 64] setAcl的方式设置相关权限 /ba world:anyone:cdrw
cZxid = 0x1c631
ctime = Tue Jul 09 08:37:06 CST 2019
mZxid = 0x1c631
mtime = Tue Jul 09 08:37:06 CST 2019
pZxid = 0x1c631
cversion = 0
dataVersion = 0
aclVersion = 1
ephemeralOwner = 0x0
dataLength = 1
numChildren = 0
[zk: localhost:2181(CONNECTED) 67] getAcl /ba
'world,'anyone
: cdrw

IP scheme

对于特定IP适用，其他没有设置过的IP没有相关权限

语法

setAcl <path> ip:<ip>:<acl>

[zk: localhost:2181(CONNECTED) 73] setAcl /ba ip:192.168.123.111:cdrwa
cZxid = 0x1c635
ctime = Tue Jul 09 08:44:14 CST 2019
mZxid = 0x1c635
mtime = Tue Jul 09 08:44:14 CST 2019
pZxid = 0x1c635
cversion = 0
dataVersion = 0
aclVersion = 1
ephemeralOwner = 0x0
dataLength = 1
numChildren = 0


[zk: localhost:2181(CONNECTED) 78] getAcl /ba
'ip,'192.168.123.111
: cdrwa

[zk: localhost:2181(CONNECTED) 79] get /ba
Authentication is not valid : /ba

Auth scheme

语法

addauth digest <user>:<password> #添加认证用户
setAcl <path> auth:<user>:<acl>

[zk: localhost:2181(CONNECTED) 81] addauth digest gjf:root
[zk: localhost:2181(CONNECTED) 82] setAcl /baizhi03  auth:gjf:root
cZxid = 0x1c637
ctime = Tue Jul 09 08:47:00 CST 2019
mZxid = 0x1c637
mtime = Tue Jul 09 08:47:00 CST 2019
pZxid = 0x1c637
cversion = 0
dataVersion = 0
aclVersion = 1
ephemeralOwner = 0x0
dataLength = 1
numChildren = 0

[zk: localhost:2181(CONNECTED) 95] getAcl /ba03
'digest,'gjf:bbYGkKPfBgiZDzcwrmVylqDlXnI=
: cdrwa

Digest scheme

语法

setAcl <path> digest:<user>:<password>:<acl>

计算密文

echo -n <user>:<password> | openssl dgst -binary -sha1 | openssl base64

[root@GuoJiafeng01 ~]# echo -n gjf:root | openssl dgst -binary -sha1 | openssl base64
bbYGkKPfBgiZDzcwrmVylqDlXnI=

[zk: localhost:2181(CONNECTED) 98] create /ba04 1
Created /ba04
[zk: localhost:2181(CONNECTED) 99] setAcl /ba04 digest:gjf:bbYGkKPfBgiZDzcwrmVylqDlXnI=:a
cZxid = 0x1c641
ctime = Tue Jul 09 08:59:18 CST 2019
mZxid = 0x1c641
mtime = Tue Jul 09 08:59:18 CST 2019
pZxid = 0x1c641
cversion = 0
dataVersion = 0
aclVersion = 1
ephemeralOwner = 0x0
dataLength = 1
numChildren = 0
[zk: localhost:2181(CONNECTED) 100] getAcl /ba04
'digest,'gjf:bbYGkKPfBgiZDzcwrmVylqDlXnI=
: a

# 当前是没有权限的
[zk: localhost:2181(CONNECTED) 101] get /ba04
Authentication is not valid : /ba04

# 在当前session中添加认证用户
[zk: localhost:2181(CONNECTED) 102] addauth digest gjf:root
#就能获取到相关的权限了
[zk: localhost:2181(CONNECTED) 107] get /ba04
1
cZxid = 0x1c641
ctime = Tue Jul 09 08:59:18 CST 2019
mZxid = 0x1c641
mtime = Tue Jul 09 08:59:18 CST 2019
pZxid = 0x1c641
cversion = 0
dataVersion = 0
aclVersion = 2
ephemeralOwner = 0x0
dataLength = 1
numChildren = 0

7.2 Java API

 @Before
    public void getClient() {

        /*
         * 重连策略 四种实现
         *  ExponentialBackoffRetry、RetryNTimes、RetryOneTimes、RetryUntilElapsed
         * */

        ACLProvider aclProvider = new ACLProvider() {
            private List<ACL> acl ;
            @Override
            public List<ACL> getDefaultAcl() {
                if(acl ==null){
                    ArrayList<ACL> acl = ZooDefs.Ids.CREATOR_ALL_ACL;
                    acl.clear();
                    acl.add(new ACL(ZooDefs.Perms.ALL, new Id("digest", "admin:123") ));
                    this.acl = acl;
                }
                return acl;
            }

            @Override
            public List<ACL> getAclForPath(String path) {
                return null;
            }
        };

        ExponentialBackoffRetry backoffRetry = new ExponentialBackoffRetry(1000, 1000);

        //curatorFramework = CuratorFrameworkFactory.builder().aclProvider(aclProvider).authorization("digest", "admin:123".getBytes()).connectString("192.168.134.99:2181").retryPolicy(backoffRetry).build();
         curatorFramework = CuratorFrameworkFactory.newClient("192.168.134.99:2181", backoffRetry);

        this.curatorFramework.start();


    }