{"id":21377,"date":"2018-07-29T04:00:16","date_gmt":"2018-07-29T04:00:16","guid":{"rendered":"https:\/\/data-flair.training\/blogs\/?p=21377"},"modified":"2021-05-19T18:23:58","modified_gmt":"2021-05-19T12:53:58","slug":"zookeeper-acl","status":"publish","type":"post","link":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/","title":{"rendered":"ZooKeeper ACL – Access Control in Zookeeper Using ACLs"},"content":{"rendered":"

In our last Zookeeper tutorial<\/strong>, we discussed ZooKeeper Sessions<\/strong>. Today, we will see ZooKeeper ACL. Though, there is much more to learn about ACL in ZooKeeper. So, in this Zookeeper article, we will discuss the concept of ZooKeeper access control using ACLs. <\/span><\/p>\n

Also, we will see Built-in ACL Schemes along with a sample code to understand well.\u00a0Basically, to control access to its ZNodes<\/strong>, ZooKeeper uses ACLs. Along with this, we will also see ZooKeeper Authentication.<\/span><\/p>\n

So, let’s start ZooKeeper ACL.<\/p>\n

What is Zookeeper ACL?<\/span><\/h2>\n

In order to control access to its ZNodes, ZooKeeper uses ACLs. However, the ZooKeeper ACL implementation\u00a0is very much same as UNIX file access permissions. So, to allow\/disallow various operations against a node and the scope to which the bits apply, that employs permission bits.\u00a0<\/span><\/p>\n

Moreover, ZooKeeper\u00a0offers pluggable authentication schemes. And, by using the form scheme:id, all Ids are specified, especially where the scheme is a ZooKeeper authentication scheme that the id corresponds to.<\/span><\/p>\n

In addition, ZooKeeper associates all the ids that correspond to a client with the client’s connection, while a client connects to ZooKeeper and authenticates itself. Further, when a ZooKeeper client tries to access a node, these ids are checked against the ACLs of ZNodes. <\/span><\/p>\n

However, ZooKeeper ACL are made up of pairs (scheme: expression, perms). Make sure that the format of the expression is specific to the scheme.\u00a0<\/span><\/p>\n

a. ACL Permissions<\/span><\/h3>\n

There are various ZooKeeper ACL Permissions:<\/span><\/p>\n

    \n
  • CREATE:<\/strong>\u00a0It helps to create a child node.<\/span><\/li>\n
  • READ:\u00a0<\/strong>This helps to get data from a node and also list its children.<\/span><\/li>\n
  • WRITE:<\/strong>\u00a0By using it we can set data for a node.<\/span><\/li>\n
  • DELETE:<\/strong>\u00a0It can delete a child node.<\/span><\/li>\n
  • ADMIN:\u00a0<\/strong>This can set permissions.<\/span><\/li>\n<\/ul>\n

    b. Built-in ACL Schemes<\/span><\/h3>\n

    There are\u00a0various built-in schemes in Zookeeper:<\/span><\/p>\n

      \n
    • Basically, the world has a single id, anyone, which represents anyone.<\/span><\/li>\n
    • Moreover, auth doesn’t use any id. So, represents any authenticated user.<\/span><\/li>\n
    • Also, digest uses a username. Moreover, by sending the username: password in clear text, ZooKeeper authentication occurs. And, the expression\u00a0for it will be the username:base64 encoded SHA1 password digest, while used in the ACL.<\/span><\/li>\n
    • As a ZooKeeper ACL ID identity, IP uses the client host IP.<\/span><\/li>\n<\/ul>\n

      c. ZooKeeper C client API<\/span><\/h3>\n

      ZooKeeper C library offers below constants:<\/span><\/p>\n

        \n
      • const int ZOO_PERM_READ; \/\/can read node\u2019s value and list its children<\/span><\/li>\n
      • const int ZOO_PERM_WRITE;\/\/ can set the node\u2019s value<\/span><\/li>\n
      • const int ZOO_PERM_CREATE; \/\/can create children<\/span><\/li>\n
      • const int ZOO_PERM_DELETE;\/\/ can delete children<\/span><\/li>\n
      • const int ZOO_PERM_ADMIN; \/\/can execute set_acl()<\/span><\/li>\n
      • const int ZOO_PERM_ALL;\/\/ all of the above flags OR\u2019d together<\/span><\/li>\n<\/ul>\n

        Here are some standard ACL IDs:<\/span><\/p>\n

          \n
        • struct Id ZOO_ANYONE_ID_UNSAFE; \/\/(\u2018world\u2019,\u2019anyone\u2019)<\/span><\/li>\n
        • struct Id ZOO_AUTH_IDS;\/\/ (\u2018auth\u2019,\u2019\u2019)<\/span><\/li>\n<\/ul>\n

          ZOO_AUTH_IDS empty identity string must be\u00a0considered as \u201cthe identity of the creator\u201d.<\/span>
          \nMoreover, with three standard ACL in ZooKeeper,\u00a0ZooKeeper client comes:<\/span><\/p>\n

            \n
          • struct ACL_vector ZOO_OPEN_ACL_UNSAFE; <\/span><\/li>\n<\/ul>\n

            \/\/(ZOO_PERM_ALL,ZOO_ANYONE_ID_UNSAFE)<\/span><\/p>\n

              \n
            • struct ACL_vector ZOO_READ_ACL_UNSAFE;\/\/ (ZOO_PERM_READ, ZOO_ANYONE_ID_UNSAFE)<\/span><\/li>\n
            • struct ACL_vector ZOO_CREATOR_ALL_ACL; \/\/(ZOO_PERM_ALL,ZOO_AUTH_IDS)<\/span><\/li>\n<\/ul>\n

              In addition,\u00a0 for all ACL ZOO_OPEN_ACL_UNSAFE is completely open free. That means any application can easily execute any operation on the node. Also, can create, list as well as delete its children. Though, for any application, the ZOO_READ_ACL_UNSAFE is read-only access. <\/span><\/p>\n

              And, CREATE_ALL_ACL\u00a0give all allowances to the node’s creator. Ensure that before creator can create nodes with this ACL, the creator must have been authenticated by the server.<\/span><\/p>\n

              Here are various ZooKeeper operations which deal with ACLs:<\/p>\n

                \n
              • int zoo_add_auth (zhandle_t *zh,const char* scheme,const char* cert, int certLen, void_completion_t completion, const void *data);<\/li>\n<\/ul>\n

                Basically, to authenticate itself to the server, the application uses the zoo_add_auth function. However, we can call this function many times if the application asks to authenticate by using different schemes and\/or identities.<\/p>\n

                  \n
                • int zoo_create (zhandle_t *zh, const char *path, const char *value,int valuelen, const struct ACL_vector *acl, int flags,char *realpath, int max_realpath_len);<\/li>\n<\/ul>\n

                  Well, zoo_create(…) operation,\u00a0creates a new node. The acl parameter is a list of ACLs associated with the node. Also, make sure if the parent node must have the CREATE permission bit set or not.<\/p>\n

                    \n
                  • int zoo_get_acl (zhandle_t *zh, const char *path,struct ACL_vector *acl, struct Stat *stat);<\/li>\n<\/ul>\n

                    It gets ACL info of node.<\/p>\n

                    d. Sample code<\/h3>\n

                    Now\u00a0below you can see a sample code\u00a0with \u201cfoo\u201d scheme\u00a0which also creates an ephemeral node \u201c\/xyz\u201d with create-only permissions, to make use of the above APIs in order to authenticate itself.<\/span><\/p>\n

                    However, it is very important to note that it is a simple example which specifically shows to interact with ZooKeeper ACLs.<\/span><\/p>\n

                    #include <string.h>\r\n#include <errno.h>\r\n#include \"zookeeper.h\"\r\nstatic zhandle_t *zh;\r\n\/**\r\n* In this example this method gets the cert for your\r\n*   environment -- you must provide\r\n*\/\r\nchar *foo_get_cert_once(char* id) { return 0; }\r\n\/** Watcher function -- empty for this example, not something you should\r\n* do in real code *\/\r\nvoid watcher(zhandle_t *zzh, int type, int state, const char *path,\r\n            void *watcherCtx) {}\r\nint main(int argc, char argv) {\r\n char buffer[512];\r\n char p[2048];\r\n char *cert=0;\r\n char appId[64];\r\n strcpy(appId, \"example.foo_test\");\r\n cert = foo_get_cert_once(appId);\r\n if(cert!=0) {\r\n   fprintf(stderr,\r\n           \"Certificate for appid [%s] is [%s]\\n\",appId,cert);\r\n   strncpy(p,cert, sizeof(p)-1);\r\n   free(cert);\r\n } else {\r\n   fprintf(stderr, \"Certificate for appid [%s] not found\\n\",appId);\r\n   strcpy(p, \"dummy\");\r\n }\r\n zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);\r\n zh = zookeeper_init(\"localhost:3181\", watcher, 10000, 0, 0, 0);\r\n if (!zh) {\r\n   return errno;\r\n }\r\n if(zoo_add_auth(zh,\"foo\",p,strlen(p),0,0)!=ZOK)\r\n   return 2;\r\n struct ACL CREATE_ONLY_ACL[] = {{ZOO_PERM_CREATE, ZOO_AUTH_IDS}};\r\n struct ACL_vector CREATE_ONLY = {1, CREATE_ONLY_ACL};\r\n int rc = zoo_create(zh,\"\/xyz\",\"value\", 5, &CREATE_ONLY, ZOO_EPHEMERAL,\r\n                     buffer, sizeof(buffer)-1);\r\n \/** this operation will fail with a ZNOAUTH error *\/\r\n int buflen= sizeof(buffer);\r\n struct Stat stat;\r\n rc = zoo_get(zh, \"\/xyz\", 0, buffer, &buflen, &stat);\r\n if (rc) {\r\n   fprintf(stderr, \"Error %d for %s\\n\", rc, __LINE__);\r\n }\r\n zookeeper_close(zh);\r\n return 0;<\/pre>\n
                    So, this was all in ZooKeeper ACL. Hope you like our explanation of ZooKeeper Access Control using ACL’s.<\/p>\n
                    Conclusion: ZooKeeper Access Control<\/span><\/h2>\n
                    Hence, in this ZooKeeper ACL tutorial, we have seen the whole concept of\u00a0ZooKeeper access control using ACLs. Moreover, we discussed Built-in ACL SChemes along with a sample code.<\/p>\n
                    Also, we saw permissions in ZooKeeper ACL. At last, we learned about ZooKeeper authentication. Still, if any doubt regarding Access Control in ZooKeeper ask in the comment tab.<\/p>\n","protected":false},"excerpt":{"rendered":"
                    In our last Zookeeper tutorial, we discussed ZooKeeper Sessions. Today, we will see ZooKeeper ACL. Though, there is much more to learn about ACL in ZooKeeper. So, in this Zookeeper article, we will discuss...<\/p>\n","protected":false},"author":7,"featured_media":21592,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[77],"tags":[212,213,230,231,12633,16358,16359,16363,16368,16369,16375],"class_list":["post-21377","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zookeeper","tag-access-control","tag-access-control-limit","tag-acl","tag-acl-in-zookeeper","tag-schemes-in-zookeeper","tag-zookeeper-access-control","tag-zookeeper-access-control-limit","tag-zookeeper-acl-example","tag-zookeeper-auth","tag-zookeeper-authentication","tag-zookeeper-c-library"],"yoast_head":"\nZooKeeper ACL - Access Control in Zookeeper Using ACLs - DataFlair<\/title>\n<meta name=\"description\" content=\"ZooKeeper ACL, ZooKeeper access control using ACL, ZooKeeper Authentication, ZooKeeper ACL example, access control limit in ZooKeeper,ZooKeeper auth\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ZooKeeper ACL - Access Control in Zookeeper Using ACLs - DataFlair\" \/>\n<meta property=\"og:description\" content=\"ZooKeeper ACL, ZooKeeper access control using ACL, ZooKeeper Authentication, ZooKeeper ACL example, access control limit in ZooKeeper,ZooKeeper auth\" \/>\n<meta property=\"og:url\" content=\"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/\" \/>\n<meta property=\"og:site_name\" content=\"DataFlair\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DataFlairWS\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-07-29T04:00:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-05-19T12:53:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"DataFlair Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DataFlairWS\" \/>\n<meta name=\"twitter:site\" content=\"@DataFlairWS\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"DataFlair Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ZooKeeper ACL - Access Control in Zookeeper Using ACLs - DataFlair","description":"ZooKeeper ACL, ZooKeeper access control using ACL, ZooKeeper Authentication, ZooKeeper ACL example, access control limit in ZooKeeper,ZooKeeper auth","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/","og_locale":"en_US","og_type":"article","og_title":"ZooKeeper ACL - Access Control in Zookeeper Using ACLs - DataFlair","og_description":"ZooKeeper ACL, ZooKeeper access control using ACL, ZooKeeper Authentication, ZooKeeper ACL example, access control limit in ZooKeeper,ZooKeeper auth","og_url":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/","og_site_name":"DataFlair","article_publisher":"https:\/\/www.facebook.com\/DataFlairWS\/","article_published_time":"2018-07-29T04:00:16+00:00","article_modified_time":"2021-05-19T12:53:58+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg","type":"image\/jpeg"}],"author":"DataFlair Team","twitter_card":"summary_large_image","twitter_creator":"@DataFlairWS","twitter_site":"@DataFlairWS","twitter_misc":{"Written by":"DataFlair Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#article","isPartOf":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/"},"author":{"name":"DataFlair Team","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/person\/beb0cab24b7aa54423a3b50e669a9dcd"},"headline":"ZooKeeper ACL – Access Control in Zookeeper Using ACLs","datePublished":"2018-07-29T04:00:16+00:00","dateModified":"2021-05-19T12:53:58+00:00","mainEntityOfPage":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/"},"wordCount":905,"commentCount":4,"publisher":{"@id":"https:\/\/data-flair.training\/blogs\/#organization"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#primaryimage"},"thumbnailUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg","keywords":["Access Control","Access Control limit","ACL","ACL in ZooKeeper","schemes in Zookeeper","ZooKeeper Access Control","ZooKeeper Access control limit","ZooKeeper ACL Example","ZooKeeper Auth","zookeeper authentication","ZooKeeper C library"],"articleSection":["Zookeeper Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/","url":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/","name":"ZooKeeper ACL - Access Control in Zookeeper Using ACLs - DataFlair","isPartOf":{"@id":"https:\/\/data-flair.training\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#primaryimage"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#primaryimage"},"thumbnailUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg","datePublished":"2018-07-29T04:00:16+00:00","dateModified":"2021-05-19T12:53:58+00:00","description":"ZooKeeper ACL, ZooKeeper access control using ACL, ZooKeeper Authentication, ZooKeeper ACL example, access control limit in ZooKeeper,ZooKeeper auth","breadcrumb":{"@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/data-flair.training\/blogs\/zookeeper-acl\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#primaryimage","url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg","contentUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2018\/07\/ZooKeeper-ACL-01.jpg","width":1200,"height":628,"caption":"ZooKeeper ACL - Access Control in Zookeeper Using ACLs"},{"@type":"BreadcrumbList","@id":"https:\/\/data-flair.training\/blogs\/zookeeper-acl\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog Home","item":"https:\/\/data-flair.training\/blogs\/"},{"@type":"ListItem","position":2,"name":"Zookeeper Tutorials","item":"https:\/\/data-flair.training\/blogs\/category\/zookeeper\/"},{"@type":"ListItem","position":3,"name":"ZooKeeper ACL – Access Control in Zookeeper Using ACLs"}]},{"@type":"WebSite","@id":"https:\/\/data-flair.training\/blogs\/#website","url":"https:\/\/data-flair.training\/blogs\/","name":"DataFlair","description":"Learn Today. Lead Tomorrow.","publisher":{"@id":"https:\/\/data-flair.training\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/data-flair.training\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/data-flair.training\/blogs\/#organization","name":"DataFlair","url":"https:\/\/data-flair.training\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2016\/07\/Data-Flair.png","contentUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2016\/07\/Data-Flair.png","width":106,"height":48,"caption":"DataFlair"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DataFlairWS\/","https:\/\/x.com\/DataFlairWS","https:\/\/www.linkedin.com\/company\/dataflair-web-services-pvt-ltd\/","https:\/\/www.youtube.com\/user\/DataFlairWS"]},{"@type":"Person","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/person\/beb0cab24b7aa54423a3b50e669a9dcd","name":"DataFlair Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c322416204232f4dd97ef3901b0a499a5d34d7ba7fe333f4bfe53a907873d293?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c322416204232f4dd97ef3901b0a499a5d34d7ba7fe333f4bfe53a907873d293?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c322416204232f4dd97ef3901b0a499a5d34d7ba7fe333f4bfe53a907873d293?s=96&d=mm&r=g","caption":"DataFlair Team"},"description":"DataFlair Team specializes in creating clear, actionable content on programming, Java, Python, C++, DSA, AI, ML, data Science, Android, Flutter, MERN, Web Development, and technology. Backed by industry expertise, we make learning easy and career-oriented for beginners and pros alike.","url":"https:\/\/data-flair.training\/blogs\/author\/dfteam3\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/21377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/comments?post=21377"}],"version-history":[{"count":6,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/21377\/revisions"}],"predecessor-version":[{"id":94153,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/21377\/revisions\/94153"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/media\/21592"}],"wp:attachment":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/media?parent=21377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/categories?post=21377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/tags?post=21377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}