在策展人中使用ACL [英] Using ACL with Curator

问题描述

使用

如上图所示，ZNode以树形结构组织。每个 ZNode 都可以存储多达1MB的数据。因此，如果要检索存储在ZNode中的数据，则需要知道该ZNode的路径。 （就像您应该知道数据库的表和列以便检索数据一样）。

如果要在给定路径中检索数据，

  client.getData（）。forPath（/ path / to / ZNode）; 
  

当你想与策展人合作时，你必须知道这一切。

还有一件事

Apache Curator中的ACL用于访问控制。也就是说，如果你设置 ACLProvider ，如下所示，

  new ACLProvider（ ）{
 @Override 
 public List< ACL> getDefaultAcl（）{
返回ZooDefs.Ids.CREATOR_ALL_ACL; 
} 
 
 @Override 
 public List< ACL> getAclForPath（String path）{
 return ZooDefs.Ids.CREATOR_ALL_ACL; 
} 
} 
  

只有凭证与创作者相同的客户才会稍后可以访问相应的ZNode。 Autherization详细信息设置如下（请参阅客户端构建示例）。还有其他可用的ACL模式，如 OPEN_ACL_UNSAFE ，如果将其设置为ACLProvider，则不执行任何访问控制。

 授权（digest，authorizationString.getBytes（））
  

稍后将使用它们来控制对给定ZNode的访问。

简而言之，如果您想阻止其他人干扰您的ZNode，您可以设置ACLProvider返回 CREATOR_ALL_ACL 并将授权设置为摘要，如上所示。只有使用相同授权字符串（username：password）的CuratorFramework实例才能访问这些ZNode。但它不会阻止其他人在不干扰你的路径中创建ZNode。

希望你找到你想要的东西： - ）

Using CuratorFramework, could someone explain how I can:

1. Create a new path
2. Set data for this path
3. Get this path

Using username foo and password bar? Those that don't know this user/pass would not be able to do anything.

I don't care about SSL or passwords being sent via plaintext for the purpose of this question.

解决方案

ACL in Apache Curator are for access control. Therefore, ZooKeeper do not provide any authentication mechanism like, clients who don't have correct password cannot connect to ZooKeeper or cannot create ZNodes. What it can do is, preventing unauthorized clients from accessing particular Znode/ZNodes. In order to do that, you have to setup CuratorFramework instance as I have described below. Remember, this will guarantee that, a ZNode create with a given ACL, can be again accessed by the same client or by a client presenting the same authentication information.

First you should build the CuratorFramework instane as follows. Here, the connectString means a comma separated list of ip and port combinations of the zookeeper servers in your ensemble.

CuratorFrameworkFactory.Builder builder = CuratorFrameworkFactory.builder()
                .connectString(connectString)
                .retryPolicy(new ExponentialBackoffRetry(retryInitialWaitMs, maxRetryCount))
                .connectionTimeoutMs(connectionTimeoutMs)
                .sessionTimeoutMs(sessionTimeoutMs);
    /*
     * If authorization information is available, those will be added to the client. NOTE: These auth info are
     * for access control, therefore no authentication will happen when the client is being started. These
     * info will only be required whenever a client is accessing an already create ZNode. For another client of
     * another node to make use of a ZNode created by this node, it should also provide the same auth info.
     */
    if (zkUsername != null && zkPassword != null) {
        String authenticationString = zkUsername + ":" + zkPassword;
        builder.authorization("digest", authenticationString.getBytes())
                .aclProvider(new ACLProvider() {
                    @Override
                    public List<ACL> getDefaultAcl() {
                        return ZooDefs.Ids.CREATOR_ALL_ACL;
                    }

                    @Override
                    public List<ACL> getAclForPath(String path) {
                        return ZooDefs.Ids.CREATOR_ALL_ACL;
                    }
                });
    }

CuratorFramework client = builder.build();

Now you have to start it.

client.start();

Creating a path.

client.create().withMode(CreateMode.PERSISTENT).forPath("/your/ZNode/path");

Here, the CreateMode specify what type of a node you want to create. Available types are PERSISTENT,EPHEMERAL,EPHEMERAL_SEQUENTIAL,PERSISTENT_SEQUENTIAL,CONTAINER. Java Docs

If you are not sure whether the path up to /your/ZNode already exists, you can create them as well.

client.create().creatingParentsIfNeeded().withMode(CreateMode.PERSISTENT).forPath("/your/ZNode/path");

Set Data

You can either set data when you are creating the ZNode or later. If you are setting data at the creation time, pass the data as a byte array as the second parameter to the forPath() method.

client.create().withMode(CreateMode.PERSISTENT).forPath("/your/ZNode/path","your data as String".getBytes());

If you are doing it later, (data should be given as a byte array)

client.setData().forPath("/your/ZNode/path",data);

Finally

I don't understand what you mean by get this path. Apache Curator is a java client (more than that with Curator Recipes) which use Apache Zookeeper in the background and hides edge cases and complexities of Zookeeper. In Zookeeper, they use the concept of ZNodes to store data. You can consider it as the Linux directory structure. All ZNodePaths should start with / (root) and you can go on specifying directory like ZNodePaths as you like. Ex: /someName/another/test/sample.

As shown in the above diagram, ZNode are organized in a tree structure. Every ZNode can store up to 1MB of data. Therefore, if you want to retrieve data stored in a ZNode, you need to know the path to that ZNode. (Just like you should know the table and column of a database in order to retrive data).

If you want to retrive data in a given path,

client.getData().forPath("/path/to/ZNode");

That's all you have to know when you want to work with Curator.

One more thing

ACL in Apache Curator are for access control. That is, if you set ACLProvider as follows,

new ACLProvider() {
    @Override
    public List<ACL> getDefaultAcl () {
        return ZooDefs.Ids.CREATOR_ALL_ACL;
    }

    @Override
    public List<ACL> getAclForPath (String path){
        return ZooDefs.Ids.CREATOR_ALL_ACL;
    }
}

only the client with the credentials identical to the creator will be given access to the corresponding ZNode later on. Autherization details are set as follows (See the client building example). There are other modes of ACL availble, like OPEN_ACL_UNSAFE which do not do any access control if you set it as the ACLProvider.

authorization("digest", authorizationString.getBytes())

they will be used later to control access to a given ZNode.

In short, if you want to prevent others from interfering your ZNodes, you can set the ACLProvider to return CREATOR_ALL_ACL and set the authorization to digest as shown above. Only the CuratorFramework instances using the same authorization string ("username:password") will be able to access those ZNodes. But it will not prevent others from creating ZNodes in paths which are not interfering with yours.

Hope you found what you want :-)

这篇关于在策展人中使用ACL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！