Zookeeper對(duì)權(quán)限的控制是節(jié)點(diǎn)級(jí)別的艇搀，而且不繼承腋颠，即對(duì)父節(jié)點(diǎn)設(shè)置權(quán)限袋狞，其子節(jié)點(diǎn)不繼承父節(jié)點(diǎn)的權(quán)限婚苹。
Zookeeper提供了幾種認(rèn)證方式
- world：有個(gè)單一的ID岸更，anyone，表示任何人膊升。
- auth：不使用任何ID怎炊，表示任何通過驗(yàn)證的用戶（是通過ZK驗(yàn)證的用戶？連接到此ZK服務(wù)器的用戶？）评肆。
- digest：使用 用戶名：密碼 字符串生成MD5哈希值作為ACL標(biāo)識(shí)符ID债查。權(quán)限的驗(yàn)證通過直接發(fā)送用戶名密碼字符串的方式完成，
- ip：使用客戶端主機(jī)ip地址作為一個(gè)ACL標(biāo)識(shí)符瓜挽，ACL表達(dá)式是以 addr/bits 這種格式表示的盹廷。ZK服務(wù)器會(huì)將addr的前bits位與客戶端地址的前bits位來進(jìn)行匹配驗(yàn)證權(quán)限。
下面以Digest為例久橙，測(cè)試一下結(jié)果：
public class ZookeeperAuth implements Watcher {
/** 連接地址 */
final static String CONNECT_ADDR = "s100:2181,s101:2181,s102:2181";
/** 測(cè)試路徑 */
final static String PATH = "/testAuth";
final static String PATH_DEL = "/testAuth/delNode";
/** 認(rèn)證類型 */
final static String authentication_type = "digest";
/** 認(rèn)證正確方法 */
final static String correctAuthentication = "123456";
/** 認(rèn)證錯(cuò)誤方法 */
final static String badAuthentication = "654321";
static ZooKeeper zk = null;
/** 計(jì)時(shí)器 */
AtomicInteger seq = new AtomicInteger();
/** 標(biāo)識(shí) */
private static final String LOG_PREFIX_OF_MAIN = "【Main】";
private CountDownLatch connectedSemaphore = new CountDownLatch(1);
@Override
public void process(WatchedEvent event) {
try {
Thread.sleep(200);
} catch (InterruptedException e) {
e.printStackTrace();
}
if (event==null) {
return;
}
// 連接狀態(tài)
KeeperState keeperState = event.getState();
// 事件類型
EventType eventType = event.getType();
// 受影響的path
String path = event.getPath();
String logPrefix = "【W(wǎng)atcher-" + this.seq.incrementAndGet() + "】";
System.out.println(logPrefix + "收到Watcher通知");
System.out.println(logPrefix + "連接狀態(tài):\t" + keeperState.toString());
System.out.println(logPrefix + "事件類型:\t" + eventType.toString());
if (KeeperState.SyncConnected == keeperState) {
// 成功連接上ZK服務(wù)器
if (EventType.None == eventType) {
System.out.println(logPrefix + "成功連接上ZK服務(wù)器");
connectedSemaphore.countDown();
}
} else if (KeeperState.Disconnected == keeperState) {
System.out.println(logPrefix + "與ZK服務(wù)器斷開連接");
} else if (KeeperState.AuthFailed == keeperState) {
System.out.println(logPrefix + "權(quán)限檢查失敗");
} else if (KeeperState.Expired == keeperState) {
System.out.println(logPrefix + "會(huì)話失效");
}
System.out.println("--------------------------------------------");
}
/**
* 創(chuàng)建ZK連接
*
* @param connectString
* ZK服務(wù)器地址列表
* @param sessionTimeout
* Session超時(shí)時(shí)間
*/
public void createConnection(String connectString, int sessionTimeout) {
this.releaseConnection();
try {
zk = new ZooKeeper(connectString, sessionTimeout, this);
//添加節(jié)點(diǎn)授權(quán)
zk.addAuthInfo(authentication_type,correctAuthentication.getBytes());
System.out.println(LOG_PREFIX_OF_MAIN + "開始連接ZK服務(wù)器");
//倒數(shù)等待
connectedSemaphore.await();
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* 關(guān)閉ZK連接
*/
public void releaseConnection() {
if (this.zk!=null) {
try {
this.zk.close();
} catch (InterruptedException e) {
}
}
}
/**
*
* <B>方法名稱：</B>測(cè)試函數(shù)<BR>
* <B>概要說明：</B>測(cè)試認(rèn)證<BR>
* @param args
* @throws Exception
*/
public static void main(String[] args) throws Exception {
ZookeeperAuth testAuth = new ZookeeperAuth();
testAuth.createConnection(CONNECT_ADDR,2000);
List<ACL> acls = new ArrayList<ACL>(1);
for (ACL ids_acl : Ids.CREATOR_ALL_ACL) {
acls.add(ids_acl);
}
try {
zk.create(PATH, "init content".getBytes(), acls, CreateMode.PERSISTENT);//創(chuàng)建一個(gè)永久的節(jié)點(diǎn)俄占，并賦初值
System.out.println("使用授權(quán)key：" + correctAuthentication + "創(chuàng)建節(jié)點(diǎn)："+ PATH + ", 初始內(nèi)容是: init content");
} catch (Exception e) {
e.printStackTrace();
}
try {
zk.create(PATH_DEL, "will be deleted! ".getBytes(), acls, CreateMode.PERSISTENT);
System.out.println("使用授權(quán)key：" + correctAuthentication + "創(chuàng)建節(jié)點(diǎn)："+ PATH_DEL + ", 初始內(nèi)容是: init content");
} catch (Exception e) {
e.printStackTrace();
}
// 獲取數(shù)據(jù)
getDataByNoAuthentication();
getDataByBadAuthentication();
getDataByCorrectAuthentication();
// 更新數(shù)據(jù)
updateDataByNoAuthentication();
updateDataByBadAuthentication();
updateDataByCorrectAuthentication();
// 刪除數(shù)據(jù)
deleteNodeByBadAuthentication();
deleteNodeByNoAuthentication();
deleteNodeByCorrectAuthentication();
//
Thread.sleep(1000);
deleteParent();
//釋放連接
testAuth.releaseConnection();
}
/** 獲取數(shù)據(jù)：采用錯(cuò)誤的密碼 */
static void getDataByBadAuthentication() {
String prefix = "[使用錯(cuò)誤的授權(quán)信息]";
try {
ZooKeeper badzk = new ZooKeeper(CONNECT_ADDR, 2000, null);
//授權(quán)
badzk.addAuthInfo(authentication_type,badAuthentication.getBytes());
Thread.sleep(2000);
System.out.println(prefix + "獲取數(shù)據(jù)：" + PATH);
System.out.println(prefix + "成功獲取數(shù)據(jù)：" + badzk.getData(PATH, false, null));
} catch (Exception e) {
System.err.println(prefix + "獲取數(shù)據(jù)失敗，原因：" + e.getMessage());
}
}
/** 獲取數(shù)據(jù)：不采用密碼 */
static void getDataByNoAuthentication() {
String prefix = "[不使用任何授權(quán)信息]";
try {
System.out.println(prefix + "獲取數(shù)據(jù)：" + PATH);
ZooKeeper nozk = new ZooKeeper(CONNECT_ADDR, 2000, null);
Thread.sleep(2000);
System.out.println(prefix + "成功獲取數(shù)據(jù)：" + nozk.getData(PATH, false, null));
} catch (Exception e) {
System.err.println(prefix + "獲取數(shù)據(jù)失敗淆衷，原因：" + e.getMessage());
}
}
/** 采用正確的密碼 */
static void getDataByCorrectAuthentication() {
String prefix = "[使用正確的授權(quán)信息]";
try {
System.out.println(prefix + "獲取數(shù)據(jù)：" + PATH);
System.out.println(prefix + "成功獲取數(shù)據(jù)：" + zk.getData(PATH, false, null));
} catch (Exception e) {
System.out.println(prefix + "獲取數(shù)據(jù)失敗缸榄，原因：" + e.getMessage());
}
}
/**
* 更新數(shù)據(jù)：不采用密碼
*/
static void updateDataByNoAuthentication() {
String prefix = "[不使用任何授權(quán)信息]";
System.out.println(prefix + "更新數(shù)據(jù)： " + PATH);
try {
ZooKeeper nozk = new ZooKeeper(CONNECT_ADDR, 2000, null);
Thread.sleep(2000);
Stat stat = nozk.exists(PATH, false);
if (stat!=null) {
nozk.setData(PATH, prefix.getBytes(), -1);
System.out.println(prefix + "更新成功");
}
} catch (Exception e) {
System.err.println(prefix + "更新失敗，原因是：" + e.getMessage());
}
}
/**
* 更新數(shù)據(jù)：采用錯(cuò)誤的密碼
*/
static void updateDataByBadAuthentication() {
String prefix = "[使用錯(cuò)誤的授權(quán)信息]";
System.out.println(prefix + "更新數(shù)據(jù)：" + PATH);
try {
ZooKeeper badzk = new ZooKeeper(CONNECT_ADDR, 2000, null);
//授權(quán)
badzk.addAuthInfo(authentication_type,badAuthentication.getBytes());
Thread.sleep(2000);
Stat stat = badzk.exists(PATH, false);
if (stat!=null) {
badzk.setData(PATH, prefix.getBytes(), -1);
System.out.println(prefix + "更新成功");
}
} catch (Exception e) {
System.err.println(prefix + "更新失敗祝拯，原因是：" + e.getMessage());
}
}
/**
* 更新數(shù)據(jù)：采用正確的密碼
*/
static void updateDataByCorrectAuthentication() {
String prefix = "[使用正確的授權(quán)信息]";
System.out.println(prefix + "更新數(shù)據(jù)：" + PATH);
try {
Stat stat = zk.exists(PATH, false);
if (stat!=null) {
zk.setData(PATH, prefix.getBytes(), -1);
System.out.println(prefix + "更新成功");
}
} catch (Exception e) {
System.err.println(prefix + "更新失敗甚带，原因是：" + e.getMessage());
}
}
/**
* 不使用密碼 刪除節(jié)點(diǎn)
*/
static void deleteNodeByNoAuthentication() throws Exception {
String prefix = "[不使用任何授權(quán)信息]";
try {
System.out.println(prefix + "刪除節(jié)點(diǎn)：" + PATH_DEL);
ZooKeeper nozk = new ZooKeeper(CONNECT_ADDR, 2000, null);
Thread.sleep(2000);
Stat stat = nozk.exists(PATH_DEL, false);
if (stat!=null) {
nozk.delete(PATH_DEL,-1);
System.out.println(prefix + "刪除成功");
}
} catch (Exception e) {
System.err.println(prefix + "刪除失敗，原因是：" + e.getMessage());
}
}
/**
* 采用錯(cuò)誤的密碼刪除節(jié)點(diǎn)
*/
static void deleteNodeByBadAuthentication() throws Exception {
String prefix = "[使用錯(cuò)誤的授權(quán)信息]";
try {
System.out.println(prefix + "刪除節(jié)點(diǎn)：" + PATH_DEL);
ZooKeeper badzk = new ZooKeeper(CONNECT_ADDR, 2000, null);
//授權(quán)
badzk.addAuthInfo(authentication_type,badAuthentication.getBytes());
Thread.sleep(2000);
Stat stat = badzk.exists(PATH_DEL, false);
if (stat!=null) {
badzk.delete(PATH_DEL, -1);
System.out.println(prefix + "刪除成功");
}
} catch (Exception e) {
System.err.println(prefix + "刪除失敗佳头，原因是：" + e.getMessage());
}
}
/**
* 使用正確的密碼刪除節(jié)點(diǎn)
*/
static void deleteNodeByCorrectAuthentication() throws Exception {
String prefix = "[使用正確的授權(quán)信息]";
try {
System.out.println(prefix + "刪除節(jié)點(diǎn)：" + PATH_DEL);
Stat stat = zk.exists(PATH_DEL, false);
if (stat!=null) {
zk.delete(PATH_DEL, -1);
System.out.println(prefix + "刪除成功");
}
} catch (Exception e) {
System.out.println(prefix + "刪除失敗鹰贵，原因是：" + e.getMessage());
}
}
/**
* 使用正確的密碼刪除節(jié)點(diǎn)
*/
static void deleteParent() throws Exception {
try {
Stat stat = zk.exists(PATH_DEL, false);
if (stat == null) {
zk.delete(PATH, -1);
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
當(dāng)使用錯(cuò)誤的key去訪問節(jié)點(diǎn)時(shí)，拋異常 ：KeeperErrorCode: NoAuth for /testAuth
