{"action":"created","comment":{"url":"https://api.github.com/repos/apache/kafka/pulls/comments/42888328","id":42888328,"diff_hunk":"@@ -0,0 +1,240 @@\n+/**\n+ * Licensed to the Apache Software Foundation (ASF) under one or more\n+ * contributor license agreements.  See the NOTICE file distributed with\n+ * this work for additional information regarding copyright ownership.\n+ * The ASF licenses this file to You under the Apache License, Version 2.0\n+ * (the \"License\"); you may not use this file except in compliance with\n+ * the License.  You may obtain a copy of the License at\n+ *\n+ *    http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+\n+package kafka.admin\n+\n+import java.util.concurrent.LinkedBlockingQueue\n+import java.util.concurrent.ThreadPoolExecutor\n+import java.util.concurrent.TimeUnit\n+import joptsimple.OptionParser\n+import org.I0Itec.zkclient.exception.ZkException\n+import kafka.utils.{Logging, ZkUtils, CommandLineUtils}\n+import org.apache.log4j.Level\n+import org.apache.kafka.common.security.JaasUtils\n+import org.apache.zookeeper.AsyncCallback.{ChildrenCallback, StatCallback}\n+import org.apache.zookeeper.data.Stat\n+import org.apache.zookeeper.KeeperException\n+import org.apache.zookeeper.KeeperException.Code\n+import scala.annotation.tailrec\n+import scala.collection.JavaConverters._\n+import scala.collection._\n+import scala.collection.mutable.Queue\n+import scala.concurrent._\n+import scala.concurrent.duration._\n+\n+/**\n+ * This tool is to be used when making access to ZooKeeper authenticated or \n+ * the other way around, when removing authenticated access. The exact steps\n+ * to migrate a Kafka cluster from unsecure to secure with respect to ZooKeeper\n+ * access are the following:\n+ * \n+ * 1- Perform a rolling upgrade of Kafka servers, setting zookeeper.set.acl to false\n+ * and passing a valid JAAS login file via the system property \n+ * java.security.auth.login.config\n+ * 2- Perform a second rolling upgrade keeping the system property for the login file\n+ * and now setting zookeeper.set.acl to true\n+ * 3- Finally run this tool. There is a script under ./bin. Run \n+ *   ./bin/zookeeper-security-migration --help\n+ * to see the configuration parameters. An example of running it is the following:\n+ *  ./bin/zookeeper-security-migration --zookeeper.acl=secure --zookeeper.connection=localhost:2181\n+ * \n+ * To convert a cluster from secure to unsecure, we need to perform the following\n+ * steps:\n+ * 1- Perform a rolling upgrade setting zookeeper.set.acl to false for each server\n+ * 2- Run this migration tool, setting zookeeper.acl to unsecure\n+ * 3- Perform another rolling upgrade to remove the system property setting the\n+ * login file (java.security.auth.login.config).\n+ */\n+\n+object ZkSecurityMigrator extends Logging {\n+  val usageMessage = (\"ZooKeeper Migration Tool Help. This tool updates the ACLs of \"\n+                      + \"znodes as part of the process of setting up ZooKeeper \"\n+                      + \"authentication.\")\n+\n+  def run(args: Array[String]) {\n+    var jaasFile = System.getProperty(JaasUtils.JAVA_LOGIN_CONFIG_PARAM)\n+    val parser = new OptionParser()\n+\n+    val goOpt = parser.accepts(\"zookeeper.acl\", \"Indicates whether to make the Kafka znodes in ZooKeeper secure or unsecure.\"\n+        + \" The options are 'secure' and 'unsecure'\").withRequiredArg().ofType(classOf[String])\n+    val jaasFileOpt = parser.accepts(\"jaas.file\", \"JAAS Config file.\").withOptionalArg().ofType(classOf[String])\n+    val zkUrlOpt = parser.accepts(\"zookeeper.connect\", \"Sets the ZooKeeper connect string (ensemble). This parameter \" +\n+      \"takes a comma-separated list of host:port pairs.\").withRequiredArg().defaultsTo(\"localhost:2181\").\n+      ofType(classOf[String])\n+    val zkSessionTimeoutOpt = parser.accepts(\"zookeeper.session.timeout\", \"Sets the ZooKeeper session timeout.\").\n+      withRequiredArg().ofType(classOf[java.lang.Integer]).defaultsTo(30000)\n+    val zkConnectionTimeoutOpt = parser.accepts(\"zookeeper.connection.timeout\", \"Sets the ZooKeeper connection timeout.\").\n+      withRequiredArg().ofType(classOf[java.lang.Integer]).defaultsTo(30000)\n+    val helpOpt = parser.accepts(\"help\", \"Print usage information.\")\n+\n+    val options = parser.parse(args : _*)\n+    if (options.has(helpOpt))\n+      CommandLineUtils.printUsageAndDie(parser, usageMessage)\n+\n+    if ((jaasFile == null) && !options.has(jaasFileOpt)) {\n+     val errorMsg = (\"No JAAS configuration file has been specified. Please make sure that you have set either \" + \n+                    \"the system property %s or the option %s\".format(JaasUtils.JAVA_LOGIN_CONFIG_PARAM, \"--jaas.file\")) \n+     error(errorMsg)\n+     System.err.println(\"ERROR: %s\".format(errorMsg))\n+     throw new IllegalArgumentException(\"Incorrect configuration\")\n+    }\n+\n+    if (jaasFile == null) {\n+      jaasFile = options.valueOf(jaasFileOpt)\n+      System.setProperty(JaasUtils.JAVA_LOGIN_CONFIG_PARAM, jaasFile)\n+    }\n+\n+    if (!JaasUtils.isZkSecurityEnabled(jaasFile)) {\n+      val errorMsg = \"Security isn't enabled, most likely the file isn't set properly: %s\".format(jaasFile)\n+      error(errorMsg)\n+      System.err.println(\"ERROR: %s\".format(errorMsg))\n+      throw new IllegalArgumentException(\"Incorrect configuration\") \n+    }\n+\n+    val goSecure: Boolean = options.valueOf(goOpt) match {","path":"core/src/main/scala/kafka/admin/ZkSecurityMigrator.scala","position":108,"original_position":108,"commit_id":"332b12554a1a5cc12fe71573727c098690c0cd39","original_commit_id":"332b12554a1a5cc12fe71573727c098690c0cd39","user":{"login":"junrao","id":132330,"avatar_url":"https://avatars.githubusercontent.com/u/132330?v=3","gravatar_id":"","url":"https://api.github.com/users/junrao","html_url":"https://github.com/junrao","followers_url":"https://api.github.com/users/junrao/followers","following_url":"https://api.github.com/users/junrao/following{/other_user}","gists_url":"https://api.github.com/users/junrao/gists{/gist_id}","starred_url":"https://api.github.com/users/junrao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/junrao/subscriptions","organizations_url":"https://api.github.com/users/junrao/orgs","repos_url":"https://api.github.com/users/junrao/repos","events_url":"https://api.github.com/users/junrao/events{/privacy}","received_events_url":"https://api.github.com/users/junrao/received_events","type":"User","site_admin":false},"body":"Could we rename goSecure to sth like zkAclMode?","created_at":"2015-10-23T17:01:32Z","updated_at":"2015-10-23T17:01:32Z","html_url":"https://github.com/apache/kafka/pull/313#discussion_r42888328","pull_request_url":"https://api.github.com/repos/apache/kafka/pulls/313","_links":{"self":{"href":"https://api.github.com/repos/apache/kafka/pulls/comments/42888328"},"html":{"href":"https://github.com/apache/kafka/pull/313#discussion_r42888328"},"pull_request":{"href":"https://api.github.com/repos/apache/kafka/pulls/313"}}},"pull_request":{"url":"https://api.github.com/repos/apache/kafka/pulls/313","id":47760187,"html_url":"https://github.com/apache/kafka/pull/313","diff_url":"https://github.com/apache/kafka/pull/313.diff","patch_url":"https://github.com/apache/kafka/pull/313.patch","issue_url":"https://api.github.com/repos/apache/kafka/issues/313","number":313,"state":"open","locked":false,"title":"KAFKA-2641: Upgrade path for ZK authentication","user":{"login":"fpj","id":572920,"avatar_url":"https://avatars.githubusercontent.com/u/572920?v=3","gravatar_id":"","url":"https://api.github.com/users/fpj","html_url":"https://github.com/fpj","followers_url":"https://api.github.com/users/fpj/followers","following_url":"https://api.github.com/users/fpj/following{/other_user}","gists_url":"https://api.github.com/users/fpj/gists{/gist_id}","starred_url":"https://api.github.com/users/fpj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpj/subscriptions","organizations_url":"https://api.github.com/users/fpj/orgs","repos_url":"https://api.github.com/users/fpj/repos","events_url":"https://api.github.com/users/fpj/events{/privacy}","received_events_url":"https://api.github.com/users/fpj/received_events","type":"User","site_admin":false},"body":"This pull request adds a configuration parameter and a migration tool. It is also based on pull request #303, which should go in first.","created_at":"2015-10-15T09:01:07Z","updated_at":"2015-10-23T17:01:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"69cee0c83eed800ea28bfe1c8357aecd2c1d0b84","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/apache/kafka/pulls/313/commits","review_comments_url":"https://api.github.com/repos/apache/kafka/pulls/313/comments","review_comment_url":"https://api.github.com/repos/apache/kafka/pulls/comments{/number}","comments_url":"https://api.github.com/repos/apache/kafka/issues/313/comments","statuses_url":"https://api.github.com/repos/apache/kafka/statuses/332b12554a1a5cc12fe71573727c098690c0cd39","head":{"label":"fpj:KAFKA-2641","ref":"KAFKA-2641","sha":"332b12554a1a5cc12fe71573727c098690c0cd39","user":{"login":"fpj","id":572920,"avatar_url":"https://avatars.githubusercontent.com/u/572920?v=3","gravatar_id":"","url":"https://api.github.com/users/fpj","html_url":"https://github.com/fpj","followers_url":"https://api.github.com/users/fpj/followers","following_url":"https://api.github.com/users/fpj/following{/other_user}","gists_url":"https://api.github.com/users/fpj/gists{/gist_id}","starred_url":"https://api.github.com/users/fpj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpj/subscriptions","organizations_url":"https://api.github.com/users/fpj/orgs","repos_url":"https://api.github.com/users/fpj/repos","events_url":"https://api.github.com/users/fpj/events{/privacy}","received_events_url":"https://api.github.com/users/fpj/received_events","type":"User","site_admin":false},"repo":{"id":39900213,"name":"kafka","full_name":"fpj/kafka","owner":{"login":"fpj","id":572920,"avatar_url":"https://avatars.githubusercontent.com/u/572920?v=3","gravatar_id":"","url":"https://api.github.com/users/fpj","html_url":"https://github.com/fpj","followers_url":"https://api.github.com/users/fpj/followers","following_url":"https://api.github.com/users/fpj/following{/other_user}","gists_url":"https://api.github.com/users/fpj/gists{/gist_id}","starred_url":"https://api.github.com/users/fpj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpj/subscriptions","organizations_url":"https://api.github.com/users/fpj/orgs","repos_url":"https://api.github.com/users/fpj/repos","events_url":"https://api.github.com/users/fpj/events{/privacy}","received_events_url":"https://api.github.com/users/fpj/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/fpj/kafka","description":"Mirror of Apache Kafka","fork":true,"url":"https://api.github.com/repos/fpj/kafka","forks_url":"https://api.github.com/repos/fpj/kafka/forks","keys_url":"https://api.github.com/repos/fpj/kafka/keys{/key_id}","collaborators_url":"https://api.github.com/repos/fpj/kafka/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/fpj/kafka/teams","hooks_url":"https://api.github.com/repos/fpj/kafka/hooks","issue_events_url":"https://api.github.com/repos/fpj/kafka/issues/events{/number}","events_url":"https://api.github.com/repos/fpj/kafka/events","assignees_url":"https://api.github.com/repos/fpj/kafka/assignees{/user}","branches_url":"https://api.github.com/repos/fpj/kafka/branches{/branch}","tags_url":"https://api.github.com/repos/fpj/kafka/tags","blobs_url":"https://api.github.com/repos/fpj/kafka/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/fpj/kafka/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/fpj/kafka/git/refs{/sha}","trees_url":"https://api.github.com/repos/fpj/kafka/git/trees{/sha}","statuses_url":"https://api.github.com/repos/fpj/kafka/statuses/{sha}","languages_url":"https://api.github.com/repos/fpj/kafka/languages","stargazers_url":"https://api.github.com/repos/fpj/kafka/stargazers","contributors_url":"https://api.github.com/repos/fpj/kafka/contributors","subscribers_url":"https://api.github.com/repos/fpj/kafka/subscribers","subscription_url":"https://api.github.com/repos/fpj/kafka/subscription","commits_url":"https://api.github.com/repos/fpj/kafka/commits{/sha}","git_commits_url":"https://api.github.com/repos/fpj/kafka/git/commits{/sha}","comments_url":"https://api.github.com/repos/fpj/kafka/comments{/number}","issue_comment_url":"https://api.github.com/repos/fpj/kafka/issues/comments{/number}","contents_url":"https://api.github.com/repos/fpj/kafka/contents/{+path}","compare_url":"https://api.github.com/repos/fpj/kafka/compare/{base}...{head}","merges_url":"https://api.github.com/repos/fpj/kafka/merges","archive_url":"https://api.github.com/repos/fpj/kafka/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/fpj/kafka/downloads","issues_url":"https://api.github.com/repos/fpj/kafka/issues{/number}","pulls_url":"https://api.github.com/repos/fpj/kafka/pulls{/number}","milestones_url":"https://api.github.com/repos/fpj/kafka/milestones{/number}","notifications_url":"https://api.github.com/repos/fpj/kafka/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/fpj/kafka/labels{/name}","releases_url":"https://api.github.com/repos/fpj/kafka/releases{/id}","created_at":"2015-07-29T15:11:21Z","updated_at":"2015-07-29T15:11:24Z","pushed_at":"2015-10-23T13:00:17Z","git_url":"git://github.com/fpj/kafka.git","ssh_url":"git@github.com:fpj/kafka.git","clone_url":"https://github.com/fpj/kafka.git","svn_url":"https://github.com/fpj/kafka","homepage":null,"size":23757,"stargazers_count":0,"watchers_count":0,"language":"Scala","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"trunk"}},"base":{"label":"apache:trunk","ref":"trunk","sha":"241b9ab58dcbde0ca2545fcbaea864d778f4f93d","user":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"repo":{"id":2211243,"name":"kafka","full_name":"apache/kafka","owner":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/apache/kafka","description":"Mirror of Apache Kafka","fork":false,"url":"https://api.github.com/repos/apache/kafka","forks_url":"https://api.github.com/repos/apache/kafka/forks","keys_url":"https://api.github.com/repos/apache/kafka/keys{/key_id}","collaborators_url":"https://api.github.com/repos/apache/kafka/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/apache/kafka/teams","hooks_url":"https://api.github.com/repos/apache/kafka/hooks","issue_events_url":"https://api.github.com/repos/apache/kafka/issues/events{/number}","events_url":"https://api.github.com/repos/apache/kafka/events","assignees_url":"https://api.github.com/repos/apache/kafka/assignees{/user}","branches_url":"https://api.github.com/repos/apache/kafka/branches{/branch}","tags_url":"https://api.github.com/repos/apache/kafka/tags","blobs_url":"https://api.github.com/repos/apache/kafka/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/apache/kafka/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/apache/kafka/git/refs{/sha}","trees_url":"https://api.github.com/repos/apache/kafka/git/trees{/sha}","statuses_url":"https://api.github.com/repos/apache/kafka/statuses/{sha}","languages_url":"https://api.github.com/repos/apache/kafka/languages","stargazers_url":"https://api.github.com/repos/apache/kafka/stargazers","contributors_url":"https://api.github.com/repos/apache/kafka/contributors","subscribers_url":"https://api.github.com/repos/apache/kafka/subscribers","subscription_url":"https://api.github.com/repos/apache/kafka/subscription","commits_url":"https://api.github.com/repos/apache/kafka/commits{/sha}","git_commits_url":"https://api.github.com/repos/apache/kafka/git/commits{/sha}","comments_url":"https://api.github.com/repos/apache/kafka/comments{/number}","issue_comment_url":"https://api.github.com/repos/apache/kafka/issues/comments{/number}","contents_url":"https://api.github.com/repos/apache/kafka/contents/{+path}","compare_url":"https://api.github.com/repos/apache/kafka/compare/{base}...{head}","merges_url":"https://api.github.com/repos/apache/kafka/merges","archive_url":"https://api.github.com/repos/apache/kafka/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/apache/kafka/downloads","issues_url":"https://api.github.com/repos/apache/kafka/issues{/number}","pulls_url":"https://api.github.com/repos/apache/kafka/pulls{/number}","milestones_url":"https://api.github.com/repos/apache/kafka/milestones{/number}","notifications_url":"https://api.github.com/repos/apache/kafka/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/apache/kafka/labels{/name}","releases_url":"https://api.github.com/repos/apache/kafka/releases{/id}","created_at":"2011-08-15T18:06:16Z","updated_at":"2015-10-23T10:08:10Z","pushed_at":"2015-10-23T13:00:17Z","git_url":"git://github.com/apache/kafka.git","ssh_url":"git@github.com:apache/kafka.git","clone_url":"https://github.com/apache/kafka.git","svn_url":"https://github.com/apache/kafka","homepage":null,"size":40027,"stargazers_count":2099,"watchers_count":2099,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1243,"mirror_url":"git://git.apache.org/kafka.git","open_issues_count":98,"forks":1243,"open_issues":98,"watchers":2099,"default_branch":"trunk"}},"_links":{"self":{"href":"https://api.github.com/repos/apache/kafka/pulls/313"},"html":{"href":"https://github.com/apache/kafka/pull/313"},"issue":{"href":"https://api.github.com/repos/apache/kafka/issues/313"},"comments":{"href":"https://api.github.com/repos/apache/kafka/issues/313/comments"},"review_comments":{"href":"https://api.github.com/repos/apache/kafka/pulls/313/comments"},"review_comment":{"href":"https://api.github.com/repos/apache/kafka/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/apache/kafka/pulls/313/commits"},"statuses":{"href":"https://api.github.com/repos/apache/kafka/statuses/332b12554a1a5cc12fe71573727c098690c0cd39"}}}}