Created 03-24-2020 06:56 AM
How can i delete an acl in zookeeper.
I seen a blog which has outlines steps in hortonworks. I am not using Horton.
[desind@zookeeper1~]$ zookeeper-shell localhost:2181 rmr /kafka-acl/Topic
Connecting to localhost:2181
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
Authentication is not valid : /kafka-acl/Topic
desind@zookeeper-1~]$ zookeeper-shell localhost:2181 getAcl /kafka-acl/Topic
Connecting to localhost:2181
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
'world,'anyone
: r
'sasl,'desind
: cdrwa
I need to delete the sasl,desind:cdrwa
Created 03-24-2020 07:53 AM
Created 03-24-2020 08:01 AM
Cloudera
Created 03-24-2020 09:26 AM
I tweaked it a little bit it should work in Cloudera
Go to Cloudera zookeeper server home
# cd $CDH_HOME/zookeeper-server
Run below command
java -cp "./zookeeper.jar:lib/slf4j-api-1.6.1.jar" org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:password
The output should look like below
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See <a href="<a href="http://www.slf4j.org/codes.html#StaticLoggerBinder" target="_blank">http://www.slf4j.org/codes.html#StaticLoggerBinder</a>" target="_blank"><a href="http://www.slf4j.org/codes.html#StaticLoggerBinder</a" target="_blank">http://www.slf4j.org/codes.html#StaticLoggerBinder</a</a>> for further details.
super:password->super:DyNYQEQvajljsxlhf5uS4PJ9R28=
Copy the super:DyNYQEQvajljsxlhf5uS4PJ9R28= text and login to Cloudera Manager and goto zookeeper config.
Add below to zookeeper-env template config
export SERVER_JVMFLAGS="$SERVER_JVMFLAGS -Dzookeeper.DigestAuthenticationProvider.superDigest=super:DyNYQEQvajljsxlhf5uS4PJ9R28="
Save and Restart Zookeeper and launch zookeeper shell on CDH cli
# . /bin/zkCli.sh -server your_server.com
addauth as below
Now to removing the ACL should work
Now try to delete an ACL in zookeeper this should work.
addauth digest super:password
Unfortunately, I don't have a CDH sandbox so you might have to adjust some cmds
Created on 03-24-2020 09:46 AM - edited 03-24-2020 09:46 AM
Can you explain at a high level if possible what these steps are doing and why we are doing these ?
Technically there is an acl under my name and when i get a token as myself i should be able to delete the acls.
Created 03-24-2020 10:06 AM
By default, Zookeeper runs without the option of becoming a superuser to administrate znodes in the ZK ensemble, for example, to fix ACLs, remove znodes that are not required anymore, or create new ones in specific locations. Zookeeper grants permissions through ACLs through different schemas or authentication methods, such as 'world', 'digest', or 'sasl' if we use Kerberos. We can potentially we locked out if we were to grant everyone just read permissions to a znode, as we would not be able to delete it or modify it anymore.
Created on 03-24-2020 01:38 PM - edited 03-24-2020 01:42 PM
@SheltonI am still getting the same error . How can i verify that the SERVER_JVMFLAGS have taken effect ? I dont see it in running config. (ps -ef | grep -i zookeeper) . I also dont see it in zoo.cfg
[zk: xxx.unx.sas.com(CONNECTED) 0] addauth digest super:password
[zk: xxx.unx.sas.com(CONNECTED) 1] ls /kafka
kafka-acl kafka-acl-changes kafka-acl-extended kafka kafka-acl-extended-changes
[zk: xxx.unx.sas.com(CONNECTED) 1] ls /kafka-acl
[Group, Cluster, Topic, TransactionalId, DelegationToken]
[zk: xxx.unx.sas.com(CONNECTED) 2] deleteall /kafka-acl/Topic
Authentication is not valid : /kafka-acl/Topic
Created 03-25-2020 05:42 AM
I can see the error Authentication is not valid but it seems you didn't use the format
super:password->super:DyNYQEQvajljsxlhf5uS4PJ9R28=
instead, your input was as below according to the steps you shared.
addauth digest super:password
And then delete the znode that should work
[zk: xxx.unx.sas.com(CONNECTED) 2] deleteall /kafka-acl/Topic
Please do that and revert