You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@zookeeper.apache.org by "Robert Joseph Evans (JIRA)" <ji...@apache.org> on 2013/10/04 20:24:46 UTC

[jira] [Created] (ZOOKEEPER-1782) zookeeper.superUser is not as super as superDigest

Robert Joseph Evans created ZOOKEEPER-1782:
----------------------------------------------

             Summary: zookeeper.superUser is not as super as superDigest
                 Key: ZOOKEEPER-1782
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1782
             Project: ZooKeeper
          Issue Type: Bug
    Affects Versions: 3.4.5
            Reporter: Robert Joseph Evans


The zookeeper.superUser system property does not fully grant super user privileges, like zookeeper.DigestAuthenticationProvider.superDigest does.

zookeeper.superUser only has as many privileges as the sasl ACLs on the znode being accessed.  This means that if a znode only has digest ACLs zookeeper.superUser is ignored.  Or if a znode has a single sasl ACL that only has read privileges zookeeper.superUser only has read privileges.

The reason for this is that SASLAuthenticationProvider implements the superUser check in the matches method, instead of having the super user include a new Id("super","") as Digest does.



--
This message was sent by Atlassian JIRA
(v6.1#6144)