zookeeper addauth
下载最新的稳定版zookeeperhttp://www.apache.org/dyn/closer.cgi/zookeeper/
进入zookeeper/conf将zoo_sample.cfg重命令为zoo.cfg
修改 dataDir=/tmp/zookeeper到自定义位置
zookeeper/bin/zkServer.sh start 启动
zookeeper/bin/zkCli.sh 进入命令行
输入ls / 查看当前位置节点, 默认只有zookeeper节点
ls /
创建pomelo的master节点，在命令行下输入
create /pomelo pomelo
Created /pomleo
create /pomelo/master pomelomaster
Created /pomleo/master
ls /
现在当master断开时，在启动master，提示
console - on promote!
/node_modules/pomelo/lib/master/master.js - server : "master-server-1" now is promoted to master!
有个小问题：我现在是断开master以后，以文档的第二种方式启动的节点, 但是我看文档时可以自动切换是如何实现？
默认zookeeper无权限认证功能, 修改些代码实现认证
zookeeper包括四个内置的scheme，包括world,auth,digest,ip，默认为world，权限相当于任何人可操作。我们现在要做的是加入一种认证方式，使用digest这种username:password方式比较适合我们。 但是zookeeper带的zkCli.sh在设置Acl时，如果scheme为digest密码采用明文会有问题
经过研究发现digest的密码生成方式是Sha1摘要的base64形式，所以我们可以用其它语言生成密码摘要然后操作。
在cli下使用getAcl查看权限, 使用setAcl为/加权限，操作有权限的节点要先使用
setAcl /pomelo digest:pomelo:zOL5mkauOP5kV9xnATsWSNNqEdw=:cdrwa
cZxid = 0x271
ctime = Thu Jul 18 18:54:57 CST 2013
mZxid = 0x271
mtime = Thu Jul 18 18:54:57 CST 2013
pZxid = 0x272
cversion = 1
dataVersion = 0
aclVersion = 1
ephemeralOwner = 0x0
dataLength = 6
numChildren = 1
getAcl /pomelo
'digest,'pomelo:zOL5mkauOP5kV9xnATsWSNNqEdw=
: cdrwa
getAcl /
'world,'anyone
: cdrwa
ls /pomelo
Authentication is not valid : /pomelo
addauth digest pomelo:pomelo
ls /pomelo
修改pomelo app.js配置, 如果配置setACL: true在连接时会自动为path下的节点设置密码。如果要访问的节点原来有权限的话可以设置为setACL: false
app.enable('masterHA');
app.set('masterHAConfig',
{
server : '127.0.0.1:2181',
path : '/pomelo/master',
setACL: true,
username : 'pomelo',
password : 'pomelo'
});
修改/pomelo/lib/master/zookeeper.js
var logger = require('pomelo-logger').getLogger(__filename);
var crypto = require('crypto');
var zookeeperClient = null;
function getClient(app) {
if (!zookeeperClient) {
zookeeperClient = new Zookeeper(app);
}
return zookeeperClient;
}
function Zookeeper(app, opts) {
this.app = app;
var config = app.get('masterHAConfig');
var timeout = config.timeout || 5000;
this.hosts = config.server || '127.0.0.1:2181';
this.path = config.path || '/pomelo/master';
this.username = config.username || 'pomelo';
this.password = config.password || 'pomelo';
this.setACL = config.setACL;
this.lockPath = this.path + '/lock';
this.nodePath = this.lockPath + '/' + this.app.serverId + '-';
this.version = null;
this.onDataSet = false;
this.authentication = this.username + ':' + this.password;
var shaDigest = crypto.createHash('sha1').update(this.authentication).digest('base64');
this.acls = [
new zookeeper.ACL(
zookeeper.Permission.ALL,
new zookeeper.Id('digest', this.username+':'+shaDigest)
)
];
this.client = zookeeper.createClient(this.hosts, {sessionTimeout: timeout});
var self = this;
this.client.once('connected', function () {
if(self.setACL) {
self.client.addAuthInfo('digest', new Buffer(self.authentication));
self.client.setACL(self.path, self.acls, -1, function (error, stat) {
if (error) {
console.log('Failed to set ACL: %s.', error);
return;
}
console.log('ACL is set to: %j', self.acls);
});
}
watchNode(self.client, self.path, onMasterUpdate.bind(self));
});
this.client.connect();
}
代码已提交到github上
页:
[1]