During leader activation(leader-election) phase, all the servers in an ensemble will participate to form quorum. By default this communication is not authenticated. This guide describes how to enable secure communication between the quorum peer servers using SASL mechanism. ZooKeeper supports Kerberos Kerberos or DIGEST-MD5 as your authentication scheme.

Presently, this feature is supported only in ZooKeeper 3.4.10+ version and is implemented using JIRA ZOOKEEPER-1045. The feature code will be forward ported to ZooKeeper 3.5.x and 3.6.x versions in a separate JIRA task ZOOKEEPER-2639.

...

quorum.auth.enableSasl=true
quorum.auth.learnerRequireSasl=true
quorum.auth.serverRequireSasl=true
quorum.auth.learner.loginContext=QuorumLearner
quorum.auth.server.loginContext=QuorumServer
quorum.auth.kerberos.servicePrincipal=servicename/_HOST
quorum.cnxn.threads.size=20 

2.1) Sets to enable quorum authentication using SASL.

...

Following section describes the details of supported authentication schemes, Kerberos or DIGEST-MD5.

Kerberos based authentication:

...

Configure service name and host details servicename/fully.qualified.domain.name of quorum peer server to the following configuration property in zoo.cfg file. This service principal will be used by the quorum learner to send authentication packet to the peer quorum server.

  quorum.auth.kerberos.servicePrincipal

The principal name should be in either of the following formats:

...