forked from docs/doc-exports
Yang, Tong
6182f91ba8
Reviewed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com> Co-authored-by: Yang, Tong <yangtong2@huawei.com> Co-committed-by: Yang, Tong <yangtong2@huawei.com>
143 lines
22 KiB
HTML
143 lines
22 KiB
HTML
<a name="mrs_01_2097"></a><a name="mrs_01_2097"></a>
|
|
|
|
<h1 class="topictitle1">Configuring the ZooKeeper Permissions</h1>
|
|
<div id="body1595905684810"><div class="section" id="mrs_01_2097__sdd3bbba2e7014a76be11f3489948471d"><h4 class="sectiontitle">Scenario</h4><p id="mrs_01_2097__ad19531742682452eb1efb5aea1d3bdce">Configure znode permission of ZooKeeper.</p>
|
|
<p id="mrs_01_2097__af1f6363a4dca41c591ff7917084056a5">ZooKeeper uses an access control list (ACL) to implement znode access control. The ZooKeeper client specifies a znode ACL, and the ZooKeeper server determines whether a client that requests for a znode has related operation permission according to the ACL. ACL configuration involves the following four operations:</p>
|
|
<ul id="mrs_01_2097__u4b9155ed7a0f4a3d9aaa8f9457105d14"><li id="mrs_01_2097__l20dd1c4f986e4b4fa0dc273a03838c26">Check znode ACLs in ZooKeeper.</li><li id="mrs_01_2097__l2d5211b99a684a5394d9e5e8ae91a5ba">Add znode ACLs to ZooKeeper.</li><li id="mrs_01_2097__l40ee1b613ef8456089dd1ec54344050f">Modify znode ACLs in ZooKeeper.</li><li id="mrs_01_2097__lf32e676906a847099dd082a3d6344a04">Delete znode ACLs from ZooKeeper.<p id="mrs_01_2097__ac1425bb190da4eb0ac7828cb3b27679b"><a name="mrs_01_2097__lf32e676906a847099dd082a3d6344a04"></a><a name="lf32e676906a847099dd082a3d6344a04"></a>The ZooKeeper ACL permission is described as follows:</p>
|
|
<p id="mrs_01_2097__ade8e64556896466a84140449ea7c3f5a">ZooKeeper supports five types of permission, create, delete, read, write, and admin. ZooKeeper permission control is of a znode level. That is, the permission configuration for a parent znode is not inherited by its child znodes. The ZooKeeper znode default permission is <strong id="mrs_01_2097__a5c91df9d9e9f4e9a842e3afb40a80883">world:anyone: cdrwa</strong>. That is, any user has all permissions.</p>
|
|
</li></ul>
|
|
<div class="note" id="mrs_01_2097__n1163ada79ace48728f6694a3652a989e"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p class="tableheading" id="mrs_01_2097__ab4c4044bf12a44939b47a633a8402100">ACL has three parts:</p>
|
|
<p class="tableheading" id="mrs_01_2097__ae3e86116aec4498e837dceb5d70ea0c6">The first part is the authentication type. For example, <strong id="mrs_01_2097__b99609942592652">world</strong> indicates all authentication types and <strong id="mrs_01_2097__b51827643092652">sasl</strong> indicates the kerberos authentication type.</p>
|
|
<p class="tableheading" id="mrs_01_2097__a7d168be464e541f880d7388fd2e1800e">The second part is the account. For example, anyone indicates any user.</p>
|
|
<p class="tableheading" id="mrs_01_2097__aa7b4e88f413a44439b3c9823aceca83c">The third part is permission. For example, <strong id="mrs_01_2097__b153326189992652">cdrwa</strong> indicates all permissions.</p>
|
|
<p id="mrs_01_2097__a55050b655ac44d048408f8bf606d588a">In particular, because starting the client in common mode does not need authentication, ACL with <strong id="mrs_01_2097__b35288817392652">sasl</strong> authentication type cannot be used in common mode. Authentications of <strong id="mrs_01_2097__b11498001192652">sasl</strong> scheme in this document are performed in clusters that have the security mode enabled.</p>
|
|
</div></div>
|
|
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="mrs_01_2097__t6d89b1a1e28743f7bde7429428a4aa1d" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Five types of ZooKeeper ACLs</caption><thead align="left"><tr id="mrs_01_2097__r1cb39115bbd845ccb03e44aa45b2cf5a"><th align="left" class="cellrowborder" valign="top" width="18.67%" id="mcps1.3.1.6.2.4.1.1"><p id="mrs_01_2097__a859570298da64055ab6e4d9fb75d7f27">Permission Description</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="19.61%" id="mcps1.3.1.6.2.4.1.2"><p id="mrs_01_2097__a96eff3e8709c4d2b89e6760caf0020b2">Permission Name</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="61.72%" id="mcps1.3.1.6.2.4.1.3"><p id="mrs_01_2097__a53d4a57783154c1683a58302cb7854c3">Permission Details</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="mrs_01_2097__r9afbb22dcd5a4873a2c9f5ae077b6c7a"><td class="cellrowborder" valign="top" width="18.67%" headers="mcps1.3.1.6.2.4.1.1 "><p id="mrs_01_2097__afecb993dd39d4b669cef2df30e57f26f">Create permission</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="19.61%" headers="mcps1.3.1.6.2.4.1.2 "><p id="mrs_01_2097__a9d28deb994d44c2689571d5c34e486f9">create(c)</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.72%" headers="mcps1.3.1.6.2.4.1.3 "><p id="mrs_01_2097__a9cea3168790c40d5bd5ccd42204a7dc9">Users with this permission can create child znodes in the current znode.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="mrs_01_2097__r4d521f5cc10145728e7386a368a77d02"><td class="cellrowborder" valign="top" width="18.67%" headers="mcps1.3.1.6.2.4.1.1 "><p id="mrs_01_2097__a5ceabb4a97af45c0abf3b013468d4645">Delete permission</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="19.61%" headers="mcps1.3.1.6.2.4.1.2 "><p id="mrs_01_2097__a97845a62d0af4405a87bec34334dba1d">delete(d)</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.72%" headers="mcps1.3.1.6.2.4.1.3 "><p id="mrs_01_2097__a3338bf77a2624ff0945993d4c288e2a4">Users with this permission can delete the current znode.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="mrs_01_2097__rc26257e36414450cbffad42f930cc117"><td class="cellrowborder" valign="top" width="18.67%" headers="mcps1.3.1.6.2.4.1.1 "><p id="mrs_01_2097__a526bf217d7c94bc684fbf50763d5f520">Read permission</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="19.61%" headers="mcps1.3.1.6.2.4.1.2 "><p id="mrs_01_2097__a9a48829431df40c0af0d0c96eb786275">read(r)</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.72%" headers="mcps1.3.1.6.2.4.1.3 "><p id="mrs_01_2097__af7a1a75b649b469991d6942bb150b490">Users with this permission can obtain data of the current znode and list all the child znodes of the current znode.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="mrs_01_2097__rebda0d73cb0e4919bb5787c84f1cf40d"><td class="cellrowborder" valign="top" width="18.67%" headers="mcps1.3.1.6.2.4.1.1 "><p id="mrs_01_2097__a28caef2eaee34e59b9f3cf00890f2bbb">Write permission</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="19.61%" headers="mcps1.3.1.6.2.4.1.2 "><p id="mrs_01_2097__ad47c4f9beb324e1a9fccfbae4a34da55">write(w)</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.72%" headers="mcps1.3.1.6.2.4.1.3 "><p id="mrs_01_2097__a396f34644b104d30b42ee1ade08d6564">Users with this permission can write data to the current znode and its child znodes.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="mrs_01_2097__r13d677ec7e3f43e2a6eecbf92def2e0f"><td class="cellrowborder" valign="top" width="18.67%" headers="mcps1.3.1.6.2.4.1.1 "><p id="mrs_01_2097__a851231b5d4dd4ecfa831c94496c3578d">Administration permission</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="19.61%" headers="mcps1.3.1.6.2.4.1.2 "><p id="mrs_01_2097__a9b0c742f8b4d46bf93c7f789ece842fb">admin(a)</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.72%" headers="mcps1.3.1.6.2.4.1.3 "><p id="mrs_01_2097__a0010000891124e8f906e90bbb6c90060">Users with this permission can set permission for the current znode.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="mrs_01_2097__s5ff6e85538f244e99c6367edcad1bd8a"><h4 class="sectiontitle">Impact on the System</h4><div class="notice" id="mrs_01_2097__nd3f1d63b467e4e44ab2ac516d1334f18"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><p class="litext" id="mrs_01_2097__aeb2f319c7c854692affbdc569d6635e4">Modifying ZooKeeper ACLs is a critical operation. If znode permission is modified in ZooKeeper, other users may have no permission to access the znode and some system functions are abnormal. In 3.5.6 and later versions, users must have the read permission for the <strong id="mrs_01_2097__b6200697529">getAcl </strong>operation.</p>
|
|
</div></div>
|
|
</div>
|
|
<div class="section" id="mrs_01_2097__sd18e34d132994c119b3cf5fa2b02dd18"><h4 class="sectiontitle">Prerequisites</h4><ul id="mrs_01_2097__u77813f5fddfe4794b1ccc6e4f86f8e71"><li id="mrs_01_2097__l19ae427b896c4781b9cfab1e0093183c">The ZooKeeper client has been installed. For example, the installation directory is <strong id="mrs_01_2097__b152501518432">/opt/client</strong>.</li><li id="mrs_01_2097__l18a53d60d8a54ce382ca24482928a705">You have obtained the password of the system administrator account.</li></ul>
|
|
</div>
|
|
<div class="section" id="mrs_01_2097__s89f283723ee34c6baabe713d333b3e0a"><h4 class="sectiontitle">Procedure</h4><p class="tableheading" id="mrs_01_2097__afe93204f3ecb4567893285a1ab7358b0"><strong id="mrs_01_2097__a66118a5ab0344ba7bcade40dda9497bf">Start the ZooKeeper client.</strong></p>
|
|
<ol id="mrs_01_2097__oc6c9bde5ecc6476ca93c3227f9ce0807"><li id="mrs_01_2097__li533915434199"><span>Log in to the server where the ZooKeeper client is installed as user <strong id="mrs_01_2097__b91911335525">root</strong>.</span></li><li id="mrs_01_2097__li1389464814199"><span>Run the following command to go to the client installation directory:</span><p><p id="mrs_01_2097__p9880175718191"><strong id="mrs_01_2097__a5dc5c2779c71418abdee1fc239cee148">cd /opt/client</strong></p>
|
|
</p></li><li id="mrs_01_2097__l5e7507ff356f445a8e1b37a50f4224ab"><span>Run the following command to configure environment variables:</span><p><p class="litext" id="mrs_01_2097__a71301cd1e248452583d7f5ad1acf7d24"><strong id="mrs_01_2097__a8209b9ce86084438a9d7ad8659aa0ebe">source bigdata_env</strong></p>
|
|
</p></li><li id="mrs_01_2097__l75319ed990064d22b677f0192aa422a7"><span>If the cluster has the security mode enabled, run the following command for user authentication and enter the username and password (Any authorized user. <strong id="mrs_01_2097__b7228818531">admin</strong> is used as an example.):</span><p><p class="litext" id="mrs_01_2097__a5cc1b3fbad0742f0855ce259aa0feba8"><strong id="mrs_01_2097__ac6ff97d9f9af46209b5809744921463c">kinit admin</strong></p>
|
|
</p></li><li id="mrs_01_2097__l1601ec49720043b0b338461c450fc743"><span>On the ZooKeeper client, run the following command to go to the ZooKeeper command-line interface (CLI):</span><p><p class="litext" id="mrs_01_2097__a3c2a0e1b9ded4fd38e8772c264cfbb8f"><strong id="mrs_01_2097__aa85aa6bcdadd4112bc1d9136954a8acc">sh zkCli.sh -server </strong><em id="mrs_01_2097__a94739a67f76d4aa08132c9dde71f9b2b">ZooKeeper</em><em id="mrs_01_2097__a26e0b1eb78654705bee21c2f3cd22699"> plane IP address of any instance</em>:<em id="mrs_01_2097__i121731740132119">clientPort</em></p>
|
|
<p id="mrs_01_2097__a465a1aa043c9424f9c97aa0b03ba5a15">The default <span class="parmname" id="mrs_01_2097__pdff4a2d7eeae458a9ebc3850288cc4e5"><b>clientPort</b></span> is <strong id="mrs_01_2097__b994965565318">2181</strong>.</p>
|
|
<p class="litext" id="mrs_01_2097__a75efc26cbabc458d8ceaea59061e2c1e">Example: <strong id="mrs_01_2097__a1a050b48786b414dae215ca56ce8b4b0">sh zkCli.sh -server 192.168.0.151:</strong><strong id="mrs_01_2097__b154131916203417">2181</strong></p>
|
|
</p></li><li id="mrs_01_2097__l886e3782ec914e1386fdee550384f296"><span>Run the <strong id="mrs_01_2097__acb54514a0fe042d48c281c588d2ce32b">ls</strong> command to view the znode list in ZooKeeper. For example, you can view the list of znodes in the root directory.</span><p><p id="mrs_01_2097__a58a2b40566e54fd4b0e3c3d7ecb094c3"><strong id="mrs_01_2097__ae1e26d4eeef04307b13082e754a675a0">ls /</strong></p>
|
|
<pre class="screen" id="mrs_01_2097__s47e57488019f45ddba9c5149e3746654">[zk: 192.168.0.151:2181(CONNECTED) 1] ls /
|
|
[hadoop-flag, hadoop-ha, test, test2, test3, test4, test5, test6, zookeeper]</pre>
|
|
</p></li></ol>
|
|
<p class="tableheading" id="mrs_01_2097__a0760fe6fc0a44cbbaf7bf98105f43d03"><strong id="mrs_01_2097__ab1e0b11564bf44f7bfa6e91d92071f58">View the ZooKeeper znode ACL.</strong></p>
|
|
<ol start="7" id="mrs_01_2097__obb15adf1a97e448f9ac701b9b4315655"><li id="mrs_01_2097__la295bb75a2084fc2a5900fe95832ce6b"><span>Start the ZooKeeper client.</span></li><li id="mrs_01_2097__lf1d78362c13e4437b660112113304aaa"><span>Run the <strong id="mrs_01_2097__ad63ab8516eff487e878c923804767a30">getAcl</strong> command to view znodes. The following command can be used to view the created znode ACL named <strong id="mrs_01_2097__b171809106545">test</strong>:</span><p><p class="litext" id="mrs_01_2097__adeea73513f514d7d86626c9a4cfec279"><strong id="mrs_01_2097__aecde238e6ccc43e2a124d86fc06b8d9d">getAcl</strong> /<em id="mrs_01_2097__a36247cbf16624650b5d78b312256532a">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__s851f9895bf13444c911c26ebdcc5a52f">[zk: 192.168.0.151:2181(CONNECTED) 2] getAcl /test
|
|
'world,'anyone
|
|
: cdrwa</pre>
|
|
</p></li></ol>
|
|
<p id="mrs_01_2097__a84604736f9b84566838b7775ca810919">Add a ZooKeeper znode ACL.</p>
|
|
<ol start="9" id="mrs_01_2097__o44b957b7e7ee447b95d6ba13af5e3e4a"><li id="mrs_01_2097__l86284037cbc044eda1ba639b4abfddbe"><span>Start the ZooKeeper client.</span></li><li id="mrs_01_2097__lb31d34cf49d1498597b0583dbed15cfa"><span>View the old ACL information to check whether the current account has the permission to modify the znode ACL information (a permission). If no, use kinit to switch to a user that has the permission and restart the ZooKeeper client.</span><p><div class="p" id="mrs_01_2097__a06ed0e5589734ed7b6c8ea25f3221b9b"><strong id="mrs_01_2097__abe7fac9265494727a8e0c6041a4eae67">getAcl</strong> /<em id="mrs_01_2097__a9518ef73a37046c1bac58833f988c416">znode name</em><pre class="screen" id="mrs_01_2097__s0a4c87d850e545a8a43044b7e02b845b"> [zk: 192.168.0.151:2181(CONNECTED) 3] getAcl /test
|
|
'world,'anyone
|
|
: cdrwa</pre>
|
|
</div>
|
|
</p></li><li id="mrs_01_2097__lebe133589ad74faf98dd9bc2ded66095"><span>Run the <strong id="mrs_01_2097__a05b3ff8aceb540c4ab4c9964ec75df86">setAcl</strong> command to add an ACL. The command for adding an ACL is as follows:</span><p><p class="litext" id="mrs_01_2097__a922b1788b4b541b9b865aa6ba1f6fb2e"><strong id="mrs_01_2097__b83052251492652">setAcl /test world:anyone:cdrwa,sasl:</strong> <em id="mrs_01_2097__i176790335092652">username</em>@: <em id="mrs_01_2097__i191749611492652"><system domain name></em>:<em id="mrs_01_2097__i163171520692652">ACL value</em></p>
|
|
<p class="litext" id="mrs_01_2097__a0a90410dc6be431baae9ef50c1910828">For example, to add the ACL of the <strong id="mrs_01_2097__b107502198292652">admin</strong> user to the test znode, run the following command:</p>
|
|
<p class="litext" id="mrs_01_2097__a2e712a7554db4a39b649e3bae6afad6f"><strong id="mrs_01_2097__ae2145635fbdd442080fabc5028d17eb5">setAcl /test world:anyone:cdrwa,sasl:admin@HADOOP.COM:cdrwa</strong></p>
|
|
<div class="note" id="mrs_01_2097__n45e1af2fcad84cf58ce8b9d49cb9febf"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p class="litext" id="mrs_01_2097__a3ea21646da4246b7959bc3d2acd5a4f0">When adding a new ACL, reserve the existing ones. The new and old ACLs are separated by a comma. The newly added ACL has three parts:</p>
|
|
<p class="tableheading" id="mrs_01_2097__acd725d810b1a49a4a8360cb6036d674b">The first part is the authentication type. For example, <strong id="mrs_01_2097__b182506408692652">sasl</strong> indicates the kerberos authentication type.</p>
|
|
<p class="tableheading" id="mrs_01_2097__ae4ca668fab324cffa4d100a47b2bd74f">The second part is the account. For example, <strong id="mrs_01_2097__b170349803792652">admin@HADOOP.COM</strong> indicates user <strong id="mrs_01_2097__b176622857592652">admin</strong>.</p>
|
|
<p class="tableheading" id="mrs_01_2097__a9191c3f3dc4d4578bf94454214582193">The third part is permission. For example, <strong id="mrs_01_2097__b59401031192652">cdrwa</strong> indicates all permissions.</p>
|
|
</div></div>
|
|
</p></li><li id="mrs_01_2097__la1ef23a105a24072952f6c202d1ce506"><span>After adding the ACL, run the <strong id="mrs_01_2097__ac1604a2db244478ab5d8782674a46f3a">getAcl</strong> command to check whether the permission is added successfully:</span><p><p id="mrs_01_2097__a20337e0d4ca3402a86454ce705d559c0"><strong id="mrs_01_2097__ade7b114f6ea147649ba35aa5e9fd60c3">getAcl</strong> /<em id="mrs_01_2097__ac436ab05355d4538932d16e071309768">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__s62831d896f92457da8c06d42c6039e4a">[zk: 192.168.0.151:2181(CONNECTED) 4] getAcl /test
|
|
'world,'anyone
|
|
: cdrwa
|
|
'sasl,'admin@<em id="mrs_01_2097__i7573153972515"><system domain name></em>
|
|
: cdrwa</pre>
|
|
</p></li></ol>
|
|
<p class="tableheading" id="mrs_01_2097__ad7137080309e40d298ddb44b70f2eccb"><strong id="mrs_01_2097__a8ba932bbfd6e4ad98e25143543c38b66">Modify the ZooKeeper znode ACL.</strong></p>
|
|
<ol start="13" id="mrs_01_2097__o611795b595de4bbeb2a3e409ca8d32af"><li id="mrs_01_2097__lf44004b8026841adadf185c4d784344c"><span>Start the ZooKeeper client.</span></li><li id="mrs_01_2097__lbf3e8bedf8da4b58b15c9cd9d6f6f5bd"><span>View the old ACL information to check whether the current account has the permission to modify the znode ACL information (a permission). If no, use kinit to switch to a user that has the permission and restart the ZooKeeper client.</span><p><p class="litext" id="mrs_01_2097__a1d99b450ff5d46d196f28c95f6fb576f"><strong id="mrs_01_2097__a5c712b44f35a4d6395de74888b92972e">getAcl</strong> /<em id="mrs_01_2097__aa85904860e504a779e0d9a46e02bd9e1">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__sc34f67359f3440e2899c70d990242266">[zk: 192.168.0.151:2181(CONNECTED) 5] getAcl /test
|
|
'world,'anyone
|
|
: cdrwa
|
|
'sasl,'admin@<em id="mrs_01_2097__i16880647227"><system domain name></em>
|
|
: cdrwa</pre>
|
|
</p></li><li id="mrs_01_2097__l6f56967de1034c7b9eeee8d1d8e27703"><span>Run the <strong id="mrs_01_2097__aea98583473124be7b36cc740fb9fb8da">setAcl</strong> command to modify an ACL. The command for adding an ACL is as follows:</span><p><p id="mrs_01_2097__a6e3ba6e50332476d8a4d56b11d1a26ae">s<strong id="mrs_01_2097__a79a70ce84d4641d0b3567b90bb5d6ea5">etAcl /test sasl:</strong><em id="mrs_01_2097__a57b9177cbf084a3d9366997df5bed79f">Username</em><em id="mrs_01_2097__abb88bd26cce74011a16badc76f59928a">@</em><em id="mrs_01_2097__i119919105226"><System domain name></em>:<em id="mrs_01_2097__a06b598446f6847c08a218150840b3383">ACL value</em></p>
|
|
<p id="mrs_01_2097__a1d88c75ce4634567a0fb856ee44750bb">For example, to reserve only <strong id="mrs_01_2097__b39880094592652">admin</strong> user permission and delete <strong id="mrs_01_2097__b149003454292652">anyone</strong> rw permission, run the following command:</p>
|
|
<p id="mrs_01_2097__aad74ecb46ce74f2ebdd9c27c6780583f"><strong id="mrs_01_2097__a89c4e1bd767d4b658e0916dced6fa128">setAcl /test sasl:admin@HADOOP.COM:cdrwa</strong></p>
|
|
</p></li><li id="mrs_01_2097__l6d14f7e05a1e47fbb10b4e44bf35b5d0"><span>After modifying the ACL, run the <strong id="mrs_01_2097__aa8a27e1dfbbd42a697c257c38071e8de">getAcl</strong> command to check whether the permission is modified successfully:</span><p><p id="mrs_01_2097__a6b59d2d48f0c400e99a8eb1b28422598"><strong id="mrs_01_2097__a584c4a4eae7c4157a31b18b835f8b088">getAcl</strong> /<em id="mrs_01_2097__a245a4d28c99c43288c279a166212eeea">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__s7a5f1035caf84ebf970de724b65557d5">[zk: 192.168.0.151:2181(CONNECTED) 6] getAcl /test
|
|
'sasl,'admin@<em id="mrs_01_2097__i18534034112218"><system domain name></em>
|
|
: cdrwa</pre>
|
|
</p></li></ol>
|
|
<p class="tableheading" id="mrs_01_2097__a2fe99b1c96b64e0994dd2e03fef8640d"><strong id="mrs_01_2097__a5db2d3b35c774f7689281236c395395e">Delete the ZooKeeper znode ACL.</strong></p>
|
|
<ol start="17" id="mrs_01_2097__o22341e0177cf406c933577c81af2343b"><li id="mrs_01_2097__l5d4ffe17b5f849ae800819f7af11a509"><span>Start the ZooKeeper client.</span></li><li id="mrs_01_2097__l6f475800055944b4b7c47b2e99e546d5"><span>View the old ACL information to check whether the current account has the permission to modify the znode ACL information (a permission). If no, use kinit to switch to a user that has the permission and restart the ZooKeeper client.</span><p><p id="mrs_01_2097__ac9933862c21e4c55b091efc5a4d31ec9"><strong id="mrs_01_2097__a784fc2b7eaa94edd887c827ddc42971b">getAcl</strong> /<em id="mrs_01_2097__aa7bd86a7687e4bd49054e26adb07409d">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__s5f8753ebf40847038a4b74208ba86b0d">[zk: 192.168.0.151:2181(CONNECTED) 5] getAcl /test
|
|
'world,'anyone
|
|
: rw
|
|
'sasl,'admin@<em id="mrs_01_2097__i431416369227"><system domain name></em>
|
|
: cdrwa</pre>
|
|
</p></li><li id="mrs_01_2097__l162f7b12bcf34605a33cce6df5e5187a"><span>Run the <strong id="mrs_01_2097__a6e7156f17b524a1b81e65cda42f6ca75">setAcl</strong> command to add an ACL. The command for adding an ACL is as follows:</span><p><p id="mrs_01_2097__aaa9f02920267472c8e2e411839e7984f">s<strong id="mrs_01_2097__b593193885520">etAcl /test sasl:</strong><em id="mrs_01_2097__i1293338165520">Username</em><em id="mrs_01_2097__i193738195518">@</em><em id="mrs_01_2097__i1893738185511"><System domain name></em>:<em id="mrs_01_2097__i393113810557">ACL value</em></p>
|
|
<p id="mrs_01_2097__ab52f64f21ce24bd382eded85161f1eb4">For example, to reserve only <strong id="mrs_01_2097__b207862927192652">admin</strong> user permission and delete <strong id="mrs_01_2097__b162639980792652">anyone</strong> rw permission, run the following command:</p>
|
|
<p id="mrs_01_2097__a415d00f1909b4b149cbbc5cfca0841fe"><strong id="mrs_01_2097__af2c94fc9965b49d5a1ab4c6b7dad59eb">setAcl /test sasl:admin@HADOOP.COM:cdrwa</strong></p>
|
|
</p></li><li id="mrs_01_2097__lf335b54863f04c8ca9191ad3051b26c4"><span>After modifying the ACL, run the <strong id="mrs_01_2097__a26f02be0d0ed4ee8a60f48e07173136f">getAcl</strong> command to check whether the permission is modified successfully: </span><p><p id="mrs_01_2097__a8bfb0aaaef624f0da9e54a7943469db4"><strong id="mrs_01_2097__b83184859992652">getAcl</strong> /<em id="mrs_01_2097__i148300756792652">znode name</em></p>
|
|
<pre class="screen" id="mrs_01_2097__s624b5c34770e4b8491847c044aab54a3">[zk: 192.168.0.151:2181(CONNECTED) 6] getAcl /test
|
|
'sasl,'admin@<em id="mrs_01_2097__i19806142022318"><system domain name></em>
|
|
: cdrwa</pre>
|
|
</p></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="mrs_01_2092.html">Using ZooKeeper</a></div>
|
|
</div>
|
|
</div>
|
|
|