Configuring ZooKeeper to use Kerberos for client-server or server-server authentication requires that your organization's Kerberos instance (MIT Kerberos, Microsoft Active Directory) be up and running, and reachable by the ZooKeeper server or client during the configuration processes detailed below. See Configuring Hadoop Security in CDH 5 for details.

Before enabling mutual authentication, the ZooKeeper servers in the cluster must be configured to authenticate using Kerberos.

  Note: Cloudera recommends that you ensure your ZooKeeper ensemble is working properly, before you attempt to integrate Kerberos authentication. See ZooKeeper Installation for details.

Follow the steps below for each ZooKeeper server in the ensemble. To maintain consistency across ZooKeeper servers in the ensemble, use the same name for the keytab file you deploy to each server, for example, zookeeper.keytab (step 2, below). Each keytab file will contain its respective host's fully-qualified domain name (FQDN).

1. Create a service principal for the ZooKeeper server using the fully-qualified domain name (FQDN) of the host on which ZooKeeper server is running and the name of your Kerberos realm using the pattern zookeeper/fqdn.example.com@ YOUR-REALM. This principal will be used to authenticate the ZooKeeper server with the Hadoop cluster. Create this service principal as follows:

   kadmin: addprinc -randkey zookeeper/fqdn.example.com@YOUR-REALM

2. Create a keytab file for the ZooKeeper server:

   $ kadmin
   kadmin: xst -k zookeeper.keytab zookeeper/fqdn.example.com@YOUR-REALM

     Note: For consistency across ZooKeeper Servers, use the same name for the keytab file you create for each subsequent ZooKeeper Server host system you configure using these steps, for example, zookeeper.keytab.
3. Copy the zookeeper.keytab file to the ZooKeeper configuration directory on the ZooKeeper server host, using the appropriate ZooKeeper configuration directory for your installation type, as follows:
   • Package installation: /etc/zookeeper/conf/
   • Tarball installation: EXPANDED_DIR/conf
   The zookeeper.keytab file should be owned by the zookeeper user, with owner-only read permissions.
4. Add the following lines to the ZooKeeper configuration file zoo.cfg:

   authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider jaasLoginRenew=3600000

5. Set up the Java Authentication and Authorization Service (JAAS) by creating a jaas.conf file in the ZooKeeper configuration directory with the settings shown below, replacing fqdn.example.com with the ZooKeeper server's hostname.

   Server {
     com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
     keyTab="/etc/zookeeper/conf/zookeeper.keytab"
     storeKey=true
     useTicketCache=false
     principal="zookeeper/fqdn.example.com
     @YOUR-REALM";
   };
   

6. Add the following setting to the java.env file located in the ZooKeeper configuration directory, creating the file if necessary:

   export JVMFLAGS="-Djava.security.auth.login.config=/etc/zookeeper/conf/jaas.conf"

7. Repeat these steps for each ZooKeeper server in the ensemble.
8. Restart the ZooKeeper server to have the configuration changes take effect. See ZooKeeper Installation for details.

In addition to configuring ZooKeeper Server hosts to use Kerberos for authentication, you should also configure the ZooKeeper client shell (the ZooKeeper CLI) to authenticate to the ZooKeeper service using Kerberos credentials. As with the ZooKeeper Server, you must create a Kerberos principal for the client, as detailed below:

1. Create a Kerberos principal for the zookeeper-client, zkcli@YOUR-REALM, replacing YOUR-REALM with the name of your organization's Kerberos realm:

   kadmin: addprinc -randkey zkcli@YOUR-REALM

2. Create a keytab file for the ZooKeeper client shell using the -norandkey option.
     Note: Not all versions of kadmin support the -norandkey option, in which case, simply omit this option from the command. Using the kadmin command without the -norandkey option invalidates previously exported keytabs and generates a new password.

   $ kadmin
   kadmin: xst -norandkey -k zkcli.keytab zkcli@YOUR-REALM
   

3. On the host running the ZooKeeper client shell, set up JAAS (Java Authentication and Authorization Service) in the configuration directory appropriate for your installation type:
   • Package installation: /etc/zookeeper/conf/
   • Tarball installation: EXPANDED_DIR/conf
4. Create a jaas.conf file containing the following settings:

   Client {
     com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
     keyTab="/path/to/zkcli.keytab"
     storeKey=true
     useTicketCache=false
     principal="zkcli@YOUR-REALM";
   };

5. In this same configuration directory, add the following setting to the java.env file, creating the file if necessary.

   export JVMFLAGS="-Djava.security.auth.login.config=/etc/zookeeper/conf/jaas.conf"

As of Cloudera Manager 5.11, support for mutual authentication between ZooKeeper Servers can be enabled through the Cloudera Manager Admin Console. For secured networks, server-to-server authentication is considered an optional security enhancement, so the capability is disabled by default:

Server-to-server SASL authentication requires all servers in the ZooKeeper ensemble to authenticate using Kerberos, as detailed in Configuring ZooKeeper Server for Kerberos Authentication.

To disable server-to-server SASL authentication, simply return to the Cloudera Manager Admin Console page shown above, de-select Enable Server to Server SASL Authentication (by clicking the checked box), and restart the cluster.