再分布式系统中。ACL(Access Control)十分重要；Zookeeper也提供了十分好用的ACL接口，以下我记录一下在nodejs下怎样实现zookeeper的訪问控制。
Zookeeper的ACL通常表示为：Scheme:Id:Permission，即Scheme,Id,Permission三个部分。
当中，Scheme表示使用何种方式来进行訪问控制。Id代表用户。Permission表示有什么权限。
ZooKeeeper has the following built in schemes:
ZooKeeper有例如以下几种内置的Schemes
- world has a single id, anyone, that represents anyone.
- auth
- digest uses a username:password string to generate MD5 hash which is then used as an ACL ID identity. Authentication is done by sending the username:password in clear text. When used in the ACL the expression will be the username:base64 encoded SHA1 password digest. 通过用户名密码方式的auth验证。Id的格式为username:base64 encoded SHA1 password digest
- host uses the client host name as an ACL ID identity. The ACL expression is a hostname suffix. For example, the ACL expression host:corp.com matches the ids host:host1.corp.com and host:host2.corp.com, but nothost:host1.store.com.
- ip uses the client host IP as an ACL ID identity. The ACL expression is of the form addr/bits where the most significant bits of addr are matched against the most significant bits
zookeeper眼下支持以下一些权限：
- CREATE(c): 创建权限，能够在在当前node下创建child node
- DELETE(d): 删除权限，能够删除当前的node
- READ(r): 读权限。能够获取当前node的数据，能够list当前node全部的child nodes
- WRITE(w): 写权限，能够向当前node写数据
- ADMIN(a): 管理权限。能够设置当前node的permission
我使用的ZooKeeper client是：node-zookeeper-client模块。项目地址： https://github.com/alexguan/node-zookeeper-client
首先。再创建Node的时候设置ACL,node-zookeeper-client创建node的接口为：
void create(path, [data], [acls], [mode], callback)
Create a node with given path, data, acls and mode.
Arguments
- path
String
- data
Buffer
- acls
Array
- - An array of ACL objects, optional, defaults to
ACL.OPEN_ACL_UNSAFE
- mode
CreateMode
- - The creation mode, optional, defaults to
CreateMode.PERSISTENT
- callback(error, path)
Function
能够通过new zookeeper.ACL（permission, id）来创建ACL实例，须要传入两个參数，zookeeper.Permission.ADMIN,
new zookeeper.Id('ip', '127.0.0.1');
完整代码例如以下：
var zookeeper = require('node-zookeeper-client');
var id = new zookeeper.Id('ip', '192.168.1.123');
var client = zookeeper.createClient('192.168.1.100:2181');
var acl = new zookeeper.ACL(zookeeper.Permission.ADMIN, id);
client.create('/test', new Buffer('test'), [acl], zookeeper.CreateMode.PERSISTENT, function (err, path) {
//handler callback
});
怎样有客户端想訪问/test节点，则须要通过上面的訪问控制，详细代码例如以下:
var zookeeper = require('node-zookeeper-client');var client = zookeeper.createClient('192.168.1.100:2181');zookeeper.addAuthInfo('ip', new Buffer('192.168.1.123'));
client.getData('/test', null, function() {
//handler callback
});
再分布式系统中。ACL(Access Control)十分重要；Zookeeper也提供了十分好用的ACL接口，以下我记录一下在nodejs下怎样实现zookeeper的訪问控制。
Zookeeper的ACL通常表示为：Scheme:Id:Permission，即Scheme,Id,Permission三个部分。
当中，Scheme表示使用何种方式来进行訪问控制。Id代表用户。Permission表示有什么权限。
ZooKeeeper has the following built in schemes:
ZooKeeper有例如以下几种内置的Schemes
- world has a single id, anyone, that represents anyone.
- auth
- digest uses a username:password string to generate MD5 hash which is then used as an ACL ID identity. Authentication is done by sending the username:password in clear text. When used in the ACL the expression will be the username:base64 encoded SHA1 password digest. 通过用户名密码方式的auth验证。Id的格式为username:base64 encoded SHA1 password digest
- host uses the client host name as an ACL ID identity. The ACL expression is a hostname suffix. For example, the ACL expression host:corp.com matches the ids host:host1.corp.com and host:host2.corp.com, but nothost:host1.store.com.
- ip uses the client host IP as an ACL ID identity. The ACL expression is of the form addr/bits where the most significant bits of addr are matched against the most significant bits
zookeeper眼下支持以下一些权限：
- CREATE(c): 创建权限，能够在在当前node下创建child node
- DELETE(d): 删除权限，能够删除当前的node
- READ(r): 读权限。能够获取当前node的数据，能够list当前node全部的child nodes
- WRITE(w): 写权限，能够向当前node写数据
- ADMIN(a): 管理权限。能够设置当前node的permission
我使用的ZooKeeper client是：node-zookeeper-client模块。项目地址： https://github.com/alexguan/node-zookeeper-client
首先。再创建Node的时候设置ACL,node-zookeeper-client创建node的接口为：
void create(path, [data], [acls], [mode], callback)
Create a node with given path, data, acls and mode.
Arguments
- path
String
- data
Buffer
- acls
Array
- - An array of ACL objects, optional, defaults to
ACL.OPEN_ACL_UNSAFE
- mode
CreateMode
- - The creation mode, optional, defaults to
CreateMode.PERSISTENT
- callback(error, path)
Function
能够通过new zookeeper.ACL（permission, id）来创建ACL实例，须要传入两个參数，zookeeper.Permission.ADMIN,
new zookeeper.Id('ip', '127.0.0.1');
完整代码例如以下：
var zookeeper = require('node-zookeeper-client');
var id = new zookeeper.Id('ip', '192.168.1.123');
var client = zookeeper.createClient('192.168.1.100:2181');
var acl = new zookeeper.ACL(zookeeper.Permission.ADMIN, id);
client.create('/test', new Buffer('test'), [acl], zookeeper.CreateMode.PERSISTENT, function (err, path) {
//handler callback
});
怎样有客户端想訪问/test节点，则须要通过上面的訪问控制，详细代码例如以下:
var zookeeper = require('node-zookeeper-client');var client = zookeeper.createClient('192.168.1.100:2181');zookeeper.addAuthInfo('ip', new Buffer('192.168.1.123'));
client.getData('/test', null, function() {
//handler callback
});
