京公网安备11010502063487号ZooKeeper 的 SASL 认证有两种常用机制:DIGEST-MD5 和 Kerberos。这篇都真的跑一遍:先用不需要 KDC 的 DIGEST-MD5,再用 brew 的 krb5 在本机搭一个 KDC,用 keytab 做 Kerberos 登录,最后验证 sasl ACL。
不带 JAAS 的客户端 whoami → Auth scheme: User | ip: 127.0.0.1 JAAS 里是 bob 的客户端 whoami → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Auth scheme: User | sasl: bob | ip: 127.0.0.1 口令错误的客户端 whoami → WatchedEvent state:AuthFailed type:None path:null zxid: -1 | Auth scheme: User | SASL authentication failed using login context 'Client'.
DIGEST-MD5 的用户名口令写在服务端 JAAS 文件里(user_bob="bobsecret"),这只适合实验。
bob 创建 /bobs → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Created /bobs bob 读 → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | data alice 读 → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Insufficient permission : /bobs | Exiting JVM with code 1 匿名读 → Insufficient permission : /bobs | Exiting JVM with code 1
匿名 ls / → KeeperErrorCode = Session closed because client failed to authenticate for / | Exiting JVM with code 1 bob ls / → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | [zookeeper]
zkclient(Kerberos 登录)whoami → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Auth scheme: User | ip: 127.0.0.1 | sasl: zkclient@ZK.TEST zkclient 创建 /krbnode(ACL = sasl:zkclient@ZK.TEST)→ WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Created /krbnode otheruser(也是合法的 Kerberos 用户)读 → WatchedEvent state:SaslAuthenticated type:None path:null zxid: -1 | Insufficient permission : /krbnode | Exiting JVM with code 1 没有凭据的客户端读 → Insufficient permission : /krbnode | Exiting JVM with code 1
KDC 只绑定本机端口 7650,realm 与密钥都是临时生成的;客户端登录用 keytab(useTicketCache=false),所以不会读写你系统的 Kerberos 票据缓存。