...

quorum.auth.enableSasl=true
quorum.auth.learnerRequireSasl=true
quorum.auth.serverRequireSasl=true
quorum.auth.learner.loginContext=QuorumLearner
quorum.auth.server.loginContext=QuorumServer
quorum.auth.kerberos.servicePrincipal=servicename/_HOST
quorum.cnxn.threads.size=20

...

1. Sets to enable quorum authentication using SASL.
   

   Code Block
   title zoo.cfg
   # Defaulting to false quorum.auth.enableSasl=true

...

1. Sets to connect using quorum authentication. If this is true, quorum peer learner will send authentication packet to quorum peer server then proceeds with LE on successful authentication. If false, then proceeds with LE without any authentication. This can be used while upgrading ZooKeeper server.
   

   Code Block
   title zoo.cfg
   # Defaulting to false quorum.auth.learnerRequireSasl=true

...

1. Sets to connect using quorum authentication. If this is true, then all unauthenticated quorum peer learner connection requests will be rejected. If false, then quorum peer server will accept quorum peer learner connection request and then proceeds with Leader Election even if the authentication did not succeed. This can be used while upgrading ZK server.

   Code Block
   title zoo.cfg
   # Defaulting to false quorum.auth.serverRequireSasl=true

...

1. (Optional) If you want to use different login context for learner/server other than the default values, then configure the following

...

1. .

   Code Block
   title zoo.cfg
   # Defaulting to QuorumLearner quorum.auth.learner.loginContext=QuorumLearner # Defaulting to QuorumServer quorum.auth.server.loginContext=QuorumServer

...

1. The maximum number of threads to allow in the “connectionExecutors” thread pool, which will be used to process quorum server connection requests during Leader Election. This has to be tuned depending on the cluster size.

   Code Block
   title zoo.cfg
   # Defaulting to

...

1. 20 quorum.cnxn.threads.size=20

conf/java.env

Add the following settings to the java.env file located in the ZooKeeper configuration directory. (Create the file if it does not already exist.)

export SERVER_JVMFLAGS="-Djava.security.auth.login.config=/etcpath/zkto/confserver/jaas/file.conf"

 ZooKeeper servers will talk to each other using the credentials configured in “jaas/file.conf” file. They will act like learner-server when creating connections during quorum formation. Set up the Java Authentication and Authorization Service (JAAS) by creating a “jaas/file.conf” file in the ZooKeeper configuration directory and add configuration entries into this file specific to your selected authentication schemes.

...

Following section describes the details of supported authentication schemes, Kerberos or DIGEST-MD5.

Kerberos based authentication

...

ZooKeeper uses Kerberos principals and Keytabs to support quorum peer mutual authentication. Kerberos assigns tickets to Kerberos principals to enable them to do the Kerberos-secured communication.

...

The principal name should be in either of the following formats:

1)  Single shared Kerberos principal nameconfigured in all the servers

...

Code Block
servicename/localhost@EXAMPLE.COM

...

 Important Note: Authorization is not supported in this format.

2)  Host based Kerberos principal name with _HOST wildcard

...

Code Block
servicename/fully.qualified.domain.name@EXAMPLE.COM

...

http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/BasicClientServer.html

DIGEST-MD5 based authentication

...

Code Block
title JAAS configuration file, DIGEST-MD5 mechanism
QuorumServer { org.apache.zookeeper.server.auth.DigestLoginModule required user_test="test"; }; QuorumLearner { org.apache.zookeeper.server.auth.DigestLoginModule required username="test" password="test"; };

Important Note: Authorization is not supported in this format

Rolling upgrade

...

This feature is supported in 3.4 branch which is the current stable branch and is widely used in production clusters. So it is critical to support rolling upgrade of existing cluster without any down time. This section describes the possible rolling upgrade.section describes the possible rolling upgrade to use ZOOKEEPER-1045 feature. The rolling upgrade in ZOOKEEPER-1045 is designed based on a key observation that a Quorum Peer can be configured such that a ZooKeeper ensemble can be composed of a mixed servers, both old and new. Rolling upgrade is achieved by a combination of configuration flags in zoo.cfg configuration file. 

...

quorum.auth.serverRequireSasl: Initially false. Sets to true in third step of rolling upgrade (quorum.auth.learnerRequireSasl should be true) to enable server-to-­server SASL authentication strictly.

How to perform rolling upgrade

...

Prior to enabling ZooKeeper to work with security on your cluster, make sure ZooKeeper cluster works well in no-authentication setup. Rolling upgrade should be completed in three steps. After every step, admin has to ensure that all the servers have completed this step before moving on to the next step.

...