Project: talendesb
Issue TESB-6923: Authentication / Authorization for Service Locator
Currently access to the Service Locator server (aka ZooKeeper) is not not restricted at all. As an administrator I want to be able to restrict access to the content of the SL so that malicious modifications from unknown parties are prevented. ZooKeeper allows to restrict acces to node and content by setting ACL's for each node. ZooKeeper provides different authentication schemes , e.g. IP address or Digest. Digest is basically user name password authentication where password is digested. Drawback of the digest authentication scheme is the lack of a backend which really checks user logins. Currently every login is accepted. Fortunately ZooKeeper provides a way to implement and register own AuthenticationProviders. This feature is about a custom authentication scheme "sl" which is backed by a custom AuthenticationProvider based on JAAS login module. See http://zookeeper.apache.org/doc/r3.3.6/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication for more information about the AuthenticationProvider interface. The handleAuthentication is the method to validate authentication information by forwarding the id and credentials to the login module. To make the handling more flexible permissions ACL's attached to the nodes in ZooKeeper will not include users as identity, but roles. The matches method should be used to ensure whether the authenticated user has the role which is specified in the ACL. Therefore we need to provide roles in the JAAS backends for the users and evaluate whether the user has the required role. The following roles will be available - SL_READ - SL_MAINTAIN - SL_ALL The authentication feature is only relevant for ZooKeeper running within OSGi, not for the stand-alone version. A fragment bundle should be used to add the AuthenticationProvider to ZooKeeper. Whether authentication is enforced by the Service Locator server should be configurable. If authentication is not enabled 5.1 clients must run successfully against the 5.2 server. How to add user and roles for the Service locator and the additional parameters should be documented.
Story points: 5