Package org.apache.hadoop.security.authentication.util

Class ZookeeperClient

java.lang.Object
org.apache.hadoop.security.authentication.util.ZookeeperClient
public class ZookeeperClient extends Object
Utility class to create a CuratorFramework object that can be used to connect to Zookeeper based on configuration values that can be supplied from different configuration properties. It is used from ZKDelegationTokenSecretManager in hadoop-common, and from ZKSignerSecretProvider. The class implements a fluid API to set up all the different properties. A very basic setup would seem like: 
   ZookeeperClient.configure()
     .withConnectionString(<connectionString>)
     .create();
Mandatory parameters to be set:
  • connectionString: A Zookeeper connection string.
  • if authentication type is set to 'sasl':
    • keytab: the location of the keytab to be used for Kerberos authentication
    • principal: the Kerberos principal to be used from the supplied Kerberos keytab file.
    • jaasLoginEntryName: the login entry name in the JAAS configuration that is created for the KerberosLoginModule to be used by the Zookeeper client code.
  • if SSL is enabled:
    • the location of the Truststore file to be used
    • the location of the Keystore file to be used
    • if the Truststore is protected by a password, then the password of the Truststore
    • if the Keystore is protected by a password, then the password if the Keystore
When using 'sasl' authentication type, the JAAS configuration to be used by the Zookeeper client withing CuratorFramework is set to use the supplied keytab and principal for Kerberos login, moreover an ACL provider is set to provide a default ACL that requires SASL auth and the same principal to have access to the used paths. When using SSL/TLS, the Zookeeper client will set to use the secure channel towards Zookeeper, with the specified Keystore and Truststore. Default values:
  • authentication type: 'none'
  • sessionTimeout: either the system property curator-default-session-timeout, or 60 seconds
  • connectionTimeout: either the system property curator-default-connection-timeout, or 15 seconds
  • retryPolicy: an ExponentialBackoffRetry, with a starting interval of 1 seconds and 3 retries
  • zkFactory: a ConfigurableZookeeperFactory instance, to allow SSL setup via ZKClientConfig
See Also: