前言由于之前的服务都是在内网，Zookeeper集群配置都是走的内网IP，外网不开放相关端口。最近由于业务升级，购置了阿里云的服务，需要对外开放Zookeeper服务。 问题Zookeeper+dubbo，如何设置安全认证？不想让其他服务连接Zookeeper，因为这个Zookeeper服务器在外网。 查询官方文档： Zookeeper 是 Apacahe Hadoop 的子项目，是一个树型的目录服务，支持变更推送，适合作为 Dubbo 服务的注册中心，工业强度较高，可用于生产环境，并推荐使用。
流程说明：
支持以下功能：
官网文档第五条，明确说明了可以通过username和 password字段设置zookeeper 登录信息。 以下是registry参数说明：
但是，如果在Zookeeper上通过digest方式设置ACL，然后在dubbo registry上配置相应的用户、密码，服务就注册不到Zookeeper上了，会报KeeperErrorCode = NoAuth错误。 但是查阅ZookeeperRegistry相关源码并没有发现相关认证的地方，搜遍全网很少有问类似的问题，这个问题似乎并没有多少人关注。 Zookeeper中的ACL概述传统的文件系统中，ACL分为两个维度，一个是属组，一个是权限，子目录/文件默认继承父目录的ACL。而在Zookeeper中，node的ACL是没有继承关系的，是独立控制的。Zookeeper的ACL，可以从三个维度来理解：一是scheme; 二是user; 三是permission，通常表示为 scheme:id:permissions 下面从这三个方面分别来介绍： scheme: scheme对应于采用哪种方案来进行权限管理，zookeeper实现了一个pluggable的ACL方案，可以通过扩展scheme，来扩展ACL的机制。zookeeper-3.4.4缺省支持下面几种scheme:
permission: zookeeper目前支持下面一些权限：
客户端管理我们可以通过以下命令连接客户端进行操作： ./zkCli.sh 帮助[zk: localhost:2181(CONNECTED) 2] helpZooKeeper -server host:port cmd args connect host:port get path [watch] ls path [watch] set path data [version] rmr path delquota [-n|-b] path quit printwatches on|off create [-s] [-e] path data acl stat path [watch] close ls2 path [watch] history listquota path setAcl path acl getAcl path sync path redo cmdno addauth scheme auth delete path [version] setquota -n|-b val path 简单操作[zk: localhost:2181(CONNECTED) 12] ls / [dubbo, test, zookeeper] [zk: localhost:2181(CONNECTED) 13] create /itstyle data ip:192.168.1.190:cdrw Created /itstyle [zk: localhost:2181(CONNECTED) 14] getAcl /itstyle'ip,'192.168.1.190: cdrw zkclient操作代码import java.security.NoSuchAlgorithmException;import java.util.ArrayList;import java.util.List;import java.util.Map;import org.I0Itec.zkclient.ZkClient;import org.apache.zookeeper.ZooDefs;import org.apache.zookeeper.data.ACL;import org.apache.zookeeper.data.Id;import org.apache.zookeeper.data.Stat;import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;public class Acl { private static final String zkAddress = "192.168.1.190:2181";
private static final String testNode = "/dubbo";
private static final String readAuth = "read-user:123456";
private static final String writeAuth = "write-user:123456";
private static final String deleteAuth = "delete-user:123456";
private static final String allAuth = "super-user:123456";
private static final String adminAuth = "admin-user:123456";
private static final String digest = "digest";
private static void initNode() throws NoSuchAlgorithmException {
ZkClient zkClient = new ZkClient(zkAddress);
System.out.println(DigestAuthenticationProvider.generateDigest(allAuth));
zkClient.addAuthInfo(digest, allAuth.getBytes());
if (zkClient.exists(testNode)) {
zkClient.delete(testNode);
System.out.println("节点删除成功！");
}
List<ACL> acls = new ArrayList<ACL>();
acls.add(new ACL(ZooDefs.Perms.ALL, new Id(digest, DigestAuthenticationProvider.generateDigest(allAuth))));
acls.add(new ACL(ZooDefs.Perms.ALL, new Id(digest, DigestAuthenticationProvider.generateDigest(allAuth))));
acls.add(new ACL(ZooDefs.Perms.READ, new Id(digest, DigestAuthenticationProvider.generateDigest(readAuth))));
acls.add(new ACL(ZooDefs.Perms.WRITE, new Id(digest, DigestAuthenticationProvider.generateDigest(writeAuth))));
acls.add(new ACL(ZooDefs.Perms.DELETE, new Id(digest, DigestAuthenticationProvider.generateDigest(deleteAuth))));
acls.add(new ACL(ZooDefs.Perms.ADMIN, new Id(digest, DigestAuthenticationProvider.generateDigest(adminAuth))));
zkClient.createPersistent(testNode, testNode, acls);
System.out.println(zkClient.readData(testNode));
System.out.println("节点创建成功！");
zkClient.close();
}
private static void readTest() {
ZkClient zkClient = new ZkClient(zkAddress);
try {
System.out.println(zkClient.readData(testNode));//没有认证信息，读取会出错
} catch (Exception e) {
System.err.println(e.getMessage());
}
try {
zkClient.addAuthInfo(digest, adminAuth.getBytes());
System.out.println(zkClient.readData(testNode));//admin权限与read权限不匹配，读取也会出错
} catch (Exception e) {
System.err.println(e.getMessage());
}
try {
zkClient.addAuthInfo(digest, readAuth.getBytes());
System.out.println(zkClient.readData(testNode));//只有read权限的认证信息，才能正常读取
} catch (Exception e) {
System.err.println(e.getMessage());
}
zkClient.close();
}
private static void writeTest() {
ZkClient zkClient = new ZkClient(zkAddress);
try {
zkClient.writeData(testNode, "new-data");//没有认证信息，写入会失败
} catch (Exception e) {
System.err.println(e.getMessage());
}
try {
zkClient.addAuthInfo(digest, writeAuth.getBytes());
zkClient.writeData(testNode, "new-data");//加入认证信息后,写入正常
} catch (Exception e) {
System.err.println(e.getMessage());
}
try {
zkClient.addAuthInfo(digest, readAuth.getBytes());
System.out.println(zkClient.readData(testNode));//读取新值验证
} catch (Exception e) {
System.err.println(e.getMessage());
}
zkClient.close();
}
private static void deleteTest() {
ZkClient zkClient = new ZkClient(zkAddress);
zkClient.addAuthInfo(digest, deleteAuth.getBytes());
try {
System.out.println(zkClient.readData(testNode));
zkClient.delete(testNode);
System.out.println("节点删除成功！");
} catch (Exception e) {
System.err.println(e.getMessage());
}
zkClient.close();
}
private static void changeACLTest() {
ZkClient zkClient = new ZkClient(zkAddress);
//注：zkClient.setAcl方法查看源码可以发现，调用了readData、setAcl二个方法
//所以要修改节点的ACL属性，必须同时具备read、admin二种权限
zkClient.addAuthInfo(digest, adminAuth.getBytes());
zkClient.addAuthInfo(digest, readAuth.getBytes());
try {
List<ACL> acls = new ArrayList<ACL>();
acls.add(new ACL(ZooDefs.Perms.ALL, new Id(digest, DigestAuthenticationProvider.generateDigest(adminAuth))));
zkClient.setAcl(testNode, acls);
Map.Entry<List<ACL>, Stat> aclResult = zkClient.getAcl(testNode);
System.out.println(aclResult.getKey());
} catch (Exception e) {
System.err.println(e.getMessage());
}
zkClient.close();
}
public static void main(String[] args) throws Exception {
initNode();
System.out.println("---------------------");
readTest();
System.out.println("---------------------");
writeTest();
System.out.println("---------------------");
changeACLTest();
System.out.println("---------------------");
deleteTest();
}
}总结大部分服务大都是部署在内网的，基本很少对外网开放，然而Dubbo的zookeeper用户权限认证貌似真的不起作用，如果非要对外开放只能通过iptables或者firewall进行IP Access Control，如果是阿里云服务器的话安全组也是个不错的选择。 作者： 小柒 出处： https://blog.52itstyle.com |
