Java Tech Tips & Tutorials

If you have one or more Zookeeper "multi-tenant" clusters you may want to protect znodes against unwanted modifications. Here is a very simple and short introduction to the ACL and custom authentication features. This post is not intended to give you best practices about security and Zookeeper, the only goal is to give you a complete example of a custom authentication handler. Complete source code with JUnit test is available here : https://github.com/barkbay/zookeeper-acl-sample/ Use case Let say that your Zookeeper cluster is used by several users. In order to restrict user actions you have decided that each user must prefix all paths with the first letter of his name. User foo is only allowed to create, read, delete and update znodes under the /f znode. User bar is only allowed to create, read, delete and update znodes under the /b znode. Get client authentication data on the server side Zookeeper client authentication can be easily customized , a...

Here is a summary of what events are expected if you set ChildrenWatcher , DataWatcher or ExistsWatcher on a znode : WARNING : none means that no event is triggered, do no confuse with EventType.None Do not forget this basic rule : Watches are one time trigger, once a watch has been triggered you must register it once again if you want to be notified. Moreover due to network latency you can miss one or several changes that happen just before the watch is re-registered. An expired zookeeper session also means that all your watches are gone, you have to create them once again. More informations here. Hope it helps...