10.0 Zookeeper Access Control ACL
Category Zookeeper Tutorial
Zookeeper's ACL (Access Control List) permissions are particularly important in a production environment, so this section is dedicated to explaining them.
ACL permissions can be set for nodes to control read, write, and other permissions, ensuring data security.
Permissions can specify different scopes and roles.
ACL Command Line
-getAcl command: Retrieves the acl permissions of a node.
-setAcl command: Sets the acl permissions of a node.
-addauth command: Inputs authentication authorization information, registers with a plaintext password, and saves in encrypted form.
ACL Composition
Zookeeper's acl is composed of [scheme:id:permissions] to form a list of permissions.
1、scheme: Represents a certain permission mechanism, including world, auth, digest, ip, super, etc.
2、id: Represents the user allowed to access.
3、permissions: A combination of permission strings, composed of cdrwa, where each letter represents a different permission, create permission (c), delete permission (d), read permission (r), write permission (w), admin permission (a).
World Example
View the default node permissions, then update the node permissions part to crwa, resulting in a failed node deletion. Here, world represents open permissions.
$ getAcl /tutorialpro/child
$ setAcl /tutorialpro/child world:anyone:crwa
$ delete /tutorialpro/child
Auth Example
Auth is used to grant permissions, note that a user needs to be created first.
$ setAcl /tutorialpro/child auth:user1:123456:cdrwa
$ addauth digest user1:123456
$ setAcl /tutorialpro/child auth:user1:123456:cdrwa
$ getAcl /tutorialpro/child
Digest Example
Exit the current user, reconnect the terminal, digest can be used for account password login and verification.
$ ls /tutorialpro
$ create /tutorialpro/child01 tutorialpro
$ getAcl /tutorialpro/child01
$ setAcl /tutorialpro/child01 digest:user1:HYGa7IZRm2PUBFiFFu8xY2pPP/s=:cdra
$ getAcl /tutorialpro/child01
$ addauth digest user1:123456
$ getAcl /tutorialpro/child01
Tip: The encrypted password is created in the previous step.
IP Example
Restrict access permissions by IP address, after setting the permissions for the IP address 192.168.3.7, the IP address 192.168.3.38 no longer has access permissions.
$ create /tutorialpro/ip 0
$ getAcl /tutorialpro/ip
$ setAcl /tutorialpro/ip ip:192.168.3.7:cdrwa
$ get /tutorialpro/ip
-2.0 Zookeeper Installation and Configuration
-3.0 Zookeeper Linux Server Cluster Setup Steps
-4.0 Zookeeper Java Client Setup
-5.0 ZooKeeper Data Model znode Structure Detailed
-6.0 Zookeeper Session Basic Principles
-7.0 Zookeeper Basic Client Commands Usage
-8.0 Zookeeper Four-Letter Commands
- 10.0 Zookeeper Access Control ACL
-11.0 Zookeeper Watcher Event Mechanism Analysis
-12.0 Zookeeper Data Synchronization Process
-13.0 Zookeeper Leader Election Principles
-14.0 Zookeeper Distributed Lock Implementation Principles
WeChat Subscription
English: