ZooKeeper ACL权限控制机制深度解析：从原理到实战

ZooKeeper ACL权限控制机制深度解析：从原理到实战

• • 一、ACL概述
  • • 1.1 什么是ACL？
    • 1.2 为什么需要ACL？
  • 二、ACL的组成要素
  • • 2.1 权限（Permissions）
    • 2.2 授权方案（Scheme）
    • 2.3 授权ID（ID）
  • 三、ACL的工作流程
  • • 3.1 完整的ACL验证流程
    • 3.2 权限验证规则
  • 四、ACL的使用方法
  • • 4.1 命令行操作
    • • 4.1.1 查看ACL
      • 4.1.2 设置ACL
      • 4.1.3 创建时直接设置ACL
    • 4.2 Java API操作
  • 五、五种认证方案详解
  • • 5.1 world方案：最简单但最不安全
    • 5.2 auth方案：当前认证用户
    • 5.3 digest方案：最常用
    • 5.4 ip方案：基于网络位置
    • 5.5 sasl方案：企业级认证
  • 六、内置ACL常量
  • 七、ACL的继承与覆盖
  • • 7.1 ACL的继承规则
    • 7.2 默认ACL
  • 八、超级管理员模式
  • • 8.1 超级用户配置
    • 8.2 超级用户的作用
  • 九、ACL管理最佳实践
  • • 9.1 权限分配原则
    • 9.2 常见场景配置
    • 9.3 安全审计脚本
  • 十、总结
  • • 10.1 ACL核心要点
    • 10.2 安全建议
    • 10.3 一句话总结

摘要：在分布式系统中，数据安全是至关重要的。ZooKeeper作为分布式协调服务，存储着大量敏感配置和元数据，必须提供完善的访问控制机制。ACL（Access Control List，访问控制列表）就是ZooKeeper实现精细化权限管理的核心机制。本文将深入剖析ZooKeeper ACL的工作原理、权限类型、认证方案以及实战应用。

一、ACL概述

1.1 什么是ACL？

ACL（Access Control List）是ZooKeeper提供的访问控制列表机制，用于定义谁可以对ZNode执行什么操作。它与传统的UNIX文件权限类似，但更加灵活和精细化。

#mermaid-svg-6LxeShEJiIxFppFu{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-6LxeShEJiIxFppFu .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-6LxeShEJiIxFppFu .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-6LxeShEJiIxFppFu .error-icon{fill:#552222;}#mermaid-svg-6LxeShEJiIxFppFu .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-6LxeShEJiIxFppFu .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-6LxeShEJiIxFppFu .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-6LxeShEJiIxFppFu .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-6LxeShEJiIxFppFu .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-6LxeShEJiIxFppFu .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-6LxeShEJiIxFppFu .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-6LxeShEJiIxFppFu .marker{fill:#333333;stroke:#333333;}#mermaid-svg-6LxeShEJiIxFppFu .marker.cross{stroke:#333333;}#mermaid-svg-6LxeShEJiIxFppFu svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-6LxeShEJiIxFppFu p{margin:0;}#mermaid-svg-6LxeShEJiIxFppFu .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-6LxeShEJiIxFppFu .cluster-label text{fill:#333;}#mermaid-svg-6LxeShEJiIxFppFu .cluster-label span{color:#333;}#mermaid-svg-6LxeShEJiIxFppFu .cluster-label span p{background-color:transparent;}#mermaid-svg-6LxeShEJiIxFppFu .label text,#mermaid-svg-6LxeShEJiIxFppFu span{fill:#333;color:#333;}#mermaid-svg-6LxeShEJiIxFppFu .node rect,#mermaid-svg-6LxeShEJiIxFppFu .node circle,#mermaid-svg-6LxeShEJiIxFppFu .node ellipse,#mermaid-svg-6LxeShEJiIxFppFu .node polygon,#mermaid-svg-6LxeShEJiIxFppFu .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-6LxeShEJiIxFppFu .rough-node .label text,#mermaid-svg-6LxeShEJiIxFppFu .node .label text,#mermaid-svg-6LxeShEJiIxFppFu .image-shape .label,#mermaid-svg-6LxeShEJiIxFppFu .icon-shape .label{text-anchor:middle;}#mermaid-svg-6LxeShEJiIxFppFu .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-6LxeShEJiIxFppFu .rough-node .label,#mermaid-svg-6LxeShEJiIxFppFu .node .label,#mermaid-svg-6LxeShEJiIxFppFu .image-shape .label,#mermaid-svg-6LxeShEJiIxFppFu .icon-shape .label{text-align:center;}#mermaid-svg-6LxeShEJiIxFppFu .node.clickable{cursor:pointer;}#mermaid-svg-6LxeShEJiIxFppFu .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-6LxeShEJiIxFppFu .arrowheadPath{fill:#333333;}#mermaid-svg-6LxeShEJiIxFppFu .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-6LxeShEJiIxFppFu .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-6LxeShEJiIxFppFu .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-6LxeShEJiIxFppFu .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-6LxeShEJiIxFppFu .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-6LxeShEJiIxFppFu .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-6LxeShEJiIxFppFu .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-6LxeShEJiIxFppFu .cluster text{fill:#333;}#mermaid-svg-6LxeShEJiIxFppFu .cluster span{color:#333;}#mermaid-svg-6LxeShEJiIxFppFu div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-6LxeShEJiIxFppFu .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-6LxeShEJiIxFppFu rect.text{fill:none;stroke-width:0;}#mermaid-svg-6LxeShEJiIxFppFu .icon-shape,#mermaid-svg-6LxeShEJiIxFppFu .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-6LxeShEJiIxFppFu .icon-shape p,#mermaid-svg-6LxeShEJiIxFppFu .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-6LxeShEJiIxFppFu .icon-shape rect,#mermaid-svg-6LxeShEJiIxFppFu .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-6LxeShEJiIxFppFu .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-6LxeShEJiIxFppFu .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-6LxeShEJiIxFppFu :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

ACL的核心组成

ACL

Scheme授权方案

ID授权ID

Permissions权限位

1.2 为什么需要ACL？

ZooKeeper中存储着大量敏感信息，如：

• 配置信息：数据库连接串、密码、密钥
• 服务元数据：服务注册信息、路由规则
• 分布式锁：锁节点可能包含业务敏感信息
• 集群状态：节点存活状态、角色信息

没有ACL，任何客户端都可以随意读取、修改这些数据，造成严重的安全隐患。

二、ACL的组成要素

2.1 权限（Permissions）

ZooKeeper定义了5种基本权限，使用字母表示，可以组合使用：

权限组合示例：

// 权限组合计算
int READ_WRITE = 4 | 8 = 12; // rw
int ALL = 1 | 2 | 4 | 8 | 16 = 31; // cdwra
int READ_ONLY = 4; // r

#mermaid-svg-4AaiyZ78u68TM0rt{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-4AaiyZ78u68TM0rt .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-4AaiyZ78u68TM0rt .error-icon{fill:#552222;}#mermaid-svg-4AaiyZ78u68TM0rt .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-4AaiyZ78u68TM0rt .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-4AaiyZ78u68TM0rt .marker{fill:#333333;stroke:#333333;}#mermaid-svg-4AaiyZ78u68TM0rt .marker.cross{stroke:#333333;}#mermaid-svg-4AaiyZ78u68TM0rt svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-4AaiyZ78u68TM0rt p{margin:0;}#mermaid-svg-4AaiyZ78u68TM0rt .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-4AaiyZ78u68TM0rt .cluster-label text{fill:#333;}#mermaid-svg-4AaiyZ78u68TM0rt .cluster-label span{color:#333;}#mermaid-svg-4AaiyZ78u68TM0rt .cluster-label span p{background-color:transparent;}#mermaid-svg-4AaiyZ78u68TM0rt .label text,#mermaid-svg-4AaiyZ78u68TM0rt span{fill:#333;color:#333;}#mermaid-svg-4AaiyZ78u68TM0rt .node rect,#mermaid-svg-4AaiyZ78u68TM0rt .node circle,#mermaid-svg-4AaiyZ78u68TM0rt .node ellipse,#mermaid-svg-4AaiyZ78u68TM0rt .node polygon,#mermaid-svg-4AaiyZ78u68TM0rt .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-4AaiyZ78u68TM0rt .rough-node .label text,#mermaid-svg-4AaiyZ78u68TM0rt .node .label text,#mermaid-svg-4AaiyZ78u68TM0rt .image-shape .label,#mermaid-svg-4AaiyZ78u68TM0rt .icon-shape .label{text-anchor:middle;}#mermaid-svg-4AaiyZ78u68TM0rt .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-4AaiyZ78u68TM0rt .rough-node .label,#mermaid-svg-4AaiyZ78u68TM0rt .node .label,#mermaid-svg-4AaiyZ78u68TM0rt .image-shape .label,#mermaid-svg-4AaiyZ78u68TM0rt .icon-shape .label{text-align:center;}#mermaid-svg-4AaiyZ78u68TM0rt .node.clickable{cursor:pointer;}#mermaid-svg-4AaiyZ78u68TM0rt .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-4AaiyZ78u68TM0rt .arrowheadPath{fill:#333333;}#mermaid-svg-4AaiyZ78u68TM0rt .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-4AaiyZ78u68TM0rt .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-4AaiyZ78u68TM0rt .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-4AaiyZ78u68TM0rt .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-4AaiyZ78u68TM0rt .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-4AaiyZ78u68TM0rt .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-4AaiyZ78u68TM0rt .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-4AaiyZ78u68TM0rt .cluster text{fill:#333;}#mermaid-svg-4AaiyZ78u68TM0rt .cluster span{color:#333;}#mermaid-svg-4AaiyZ78u68TM0rt div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-4AaiyZ78u68TM0rt .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-4AaiyZ78u68TM0rt rect.text{fill:none;stroke-width:0;}#mermaid-svg-4AaiyZ78u68TM0rt .icon-shape,#mermaid-svg-4AaiyZ78u68TM0rt .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-4AaiyZ78u68TM0rt .icon-shape p,#mermaid-svg-4AaiyZ78u68TM0rt .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-4AaiyZ78u68TM0rt .icon-shape rect,#mermaid-svg-4AaiyZ78u68TM0rt .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-4AaiyZ78u68TM0rt .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-4AaiyZ78u68TM0rt .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-4AaiyZ78u68TM0rt :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

权限位运算

cdwr

rwa

all

CREATE = 1

组合权限

DELETE = 2

READ = 4

WRITE = 8

ADMIN = 16

1|2|4|8 = 15

4|8|16 = 28

31

2.2 授权方案（Scheme）

Scheme定义了ACL的验证方式，ZooKeeper支持多种方案：

2.3 授权ID（ID）

ID是与Scheme配合使用的具体标识符：

三、ACL的工作流程

3.1 完整的ACL验证流程

ACL模块

ZooKeeper服务器

客户端

ACL模块

ZooKeeper服务器

客户端

#mermaid-svg-KNbpzn0lmvpUrOOl{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-KNbpzn0lmvpUrOOl .error-icon{fill:#552222;}#mermaid-svg-KNbpzn0lmvpUrOOl .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-KNbpzn0lmvpUrOOl .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-KNbpzn0lmvpUrOOl .marker{fill:#333333;stroke:#333333;}#mermaid-svg-KNbpzn0lmvpUrOOl .marker.cross{stroke:#333333;}#mermaid-svg-KNbpzn0lmvpUrOOl svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-KNbpzn0lmvpUrOOl p{margin:0;}#mermaid-svg-KNbpzn0lmvpUrOOl .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KNbpzn0lmvpUrOOl text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-KNbpzn0lmvpUrOOl .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-KNbpzn0lmvpUrOOl .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-KNbpzn0lmvpUrOOl #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-KNbpzn0lmvpUrOOl .sequenceNumber{fill:white;}#mermaid-svg-KNbpzn0lmvpUrOOl #sequencenumber{fill:#333;}#mermaid-svg-KNbpzn0lmvpUrOOl #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-KNbpzn0lmvpUrOOl .messageText{fill:#333;stroke:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KNbpzn0lmvpUrOOl .labelText,#mermaid-svg-KNbpzn0lmvpUrOOl .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .loopText,#mermaid-svg-KNbpzn0lmvpUrOOl .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-KNbpzn0lmvpUrOOl .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-KNbpzn0lmvpUrOOl .noteText,#mermaid-svg-KNbpzn0lmvpUrOOl .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-KNbpzn0lmvpUrOOl .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KNbpzn0lmvpUrOOl .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KNbpzn0lmvpUrOOl .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KNbpzn0lmvpUrOOl .actorPopupMenu{position:absolute;}#mermaid-svg-KNbpzn0lmvpUrOOl .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-KNbpzn0lmvpUrOOl .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KNbpzn0lmvpUrOOl .actor-man circle,#mermaid-svg-KNbpzn0lmvpUrOOl line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-KNbpzn0lmvpUrOOl :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

创建受保护节点

未认证的访问

添加认证信息

重新访问

create /secure secret

设置ACL: digest:user:pass:cdwra

get /secure

检查权限

权限不足

NoAuth异常

addauth digest user:pass

get /secure

检查权限

权限通过

返回数据

3.2 权限验证规则

当客户端请求访问ZNode时，ZooKeeper按照以下规则进行权限验证：

public class ACLCheckProcess {

/**
* 权限验证的核心逻辑
*/
public boolean checkPermission(ClientInfo client, ZNode node, int requiredPerm) {
// 1. 获取节点的ACL列表
List<ACL> acls = node.getAcl();

// 2. 如果ACL为空，拒绝访问（默认安全）
if (acls == null || acls.isEmpty()) {
return false;
}

// 3. 遍历ACL，查找匹配项
for (ACL acl : acls) {
// 检查scheme是否匹配
if (!matchesScheme(client, acl)) {
continue;
}

// 检查ID是否匹配
if (!matchesId(client, acl)) {
continue;
}

// 检查权限是否包含所需权限
if ((acl.getPerms() & requiredPerm) == requiredPerm) {
return true; // 权限验证通过
}
}

// 4. 没有匹配的ACL，拒绝访问
return false;
}
}

验证顺序：

四、ACL的使用方法

4.1 命令行操作

4.1.1 查看ACL

# 查看节点的ACL
[zk: localhost:2181(CONNECTED) 0] getAcl /config

# 输出示例
'world,'anyone
: cdrwa

4.1.2 设置ACL

# 1. world方案（任何人可读）
[zk: localhost:2181(CONNECTED) 0] create /public "public-data"
[zk: localhost:2181(CONNECTED) 1] setAcl /public world:anyone:r

# 2. digest方案（用户名密码认证）
[zk: localhost:2181(CONNECTED) 2] addauth digest admin:admin123
[zk: localhost:2181(CONNECTED) 3] create /secure "secret"
[zk: localhost:2181(CONNECTED) 4] setAcl /secure auth:admin:admin123:cdwra

# 3. ip方案（IP限制）
[zk: localhost:2181(CONNECTED) 5] create /ip-limited "internal"
[zk: localhost:2181(CONNECTED) 6] setAcl /ip-limited ip:192.168.1.0/24:cdrwa

4.1.3 创建时直接设置ACL

# 创建节点时指定ACL
[zk: localhost:2181(CONNECTED) 0] create /secure-node "data" digest:admin:admin123:cdwra

4.2 Java API操作

import org.apache.zookeeper.*;
import org.apache.zookeeper.data.ACL;
import org.apache.zookeeper.data.Id;
import org.apache.zookeeper.data.Stat;

import java.util.ArrayList;
import java.util.List;

public class ACLExample {
private ZooKeeper zk;

/**
* 创建带ACL的节点
*/
public void createNodeWithAcl() throws Exception {
// 1. 创建ACL列表
List<ACL> acls = new ArrayList<>();

// 添加digest认证ACL
Id id1 = new Id("digest", "admin:W5R8ZqN7nYqY9YqY"); // 密码哈希
acls.add(new ACL(ZooDefs.Perms.ALL, id1)); // 所有权限

// 添加IP限制ACL
Id id2 = new Id("ip", "192.168.1.100");
acls.add(new ACL(ZooDefs.Perms.READ, id2)); // 只读权限

// 2. 创建节点
String path = zk.create("/secure-node",
"sensitive-data".getBytes(),
acls,
CreateMode.PERSISTENT);
System.out.println("节点创建成功: " + path);
}

/**
* 添加认证信息
*/
public void addAuth() throws Exception {
// 添加digest认证
zk.addAuthInfo("digest", "admin:admin123".getBytes());
System.out.println("认证信息已添加");
}

/**
* 获取节点的ACL
*/
public void getNodeAcl(String path) throws Exception {
Stat stat = new Stat();
List<ACL> acls = zk.getACL(path, stat);

System.out.println("节点 " + path + " 的ACL:");
for (ACL acl : acls) {
System.out.println(" Scheme: " + acl.getId().getScheme() +
", ID: " + acl.getId().getId() +
", Perms: " + acl.getPerms());
}
}

/**
* 设置节点的ACL
*/
public void setNodeAcl(String path) throws Exception {
// 创建新的ACL
List<ACL> acls = ZooDefs.Ids.CREATOR_ALL_ACL; // 仅创建者有所有权限

Stat stat = new Stat();
zk.getData(path, false, stat);

// 使用版本号更新ACL
zk.setACL(path, acls, stat.getAversion());
System.out.println("ACL更新成功");
}
}

五、五种认证方案详解

5.1 world方案：最简单但最不安全

# world方案
[zk: localhost:2181(CONNECTED) 0] create /public "open"
[zk: localhost:2181(CONNECTED) 1] setAcl /public world:anyone:r

# 任何人都可以读
[zk: localhost:2181(CONNECTED) 2] get /public
open

特点：

• 不进行任何认证
• ID固定为anyone
• 适合公开的配置信息

5.2 auth方案：当前认证用户

# 1. 先添加认证
[zk: localhost:2181(CONNECTED) 0] addauth digest user1:pass1
[zk: localhost:2181(CONNECTED) 1] addauth digest user2:pass2

# 2. 创建节点，使用auth方案
[zk: localhost:2181(CONNECTED) 2] create /shared "shared-data"
[zk: localhost:2181(CONNECTED) 3] setAcl /shared auth::cdrwa

# 3. 所有已认证用户都有权限
[zk: localhost:2181(CONNECTED) 4] getAcl /shared
'digest,'user1:W5R8ZqN7nYqY9YqY
: cdrwa
'digest,'user2:rX8ZpK6mXpX8XpX
: cdrwa

特点：

• 自动将当前所有已认证用户添加到ACL
• 无需重复指定ID
• 适合多用户协作场景

5.3 digest方案：最常用

#mermaid-svg-2S4o7iWyzDUJQtXi{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-2S4o7iWyzDUJQtXi .error-icon{fill:#552222;}#mermaid-svg-2S4o7iWyzDUJQtXi .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-2S4o7iWyzDUJQtXi .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-2S4o7iWyzDUJQtXi .marker{fill:#333333;stroke:#333333;}#mermaid-svg-2S4o7iWyzDUJQtXi .marker.cross{stroke:#333333;}#mermaid-svg-2S4o7iWyzDUJQtXi svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-2S4o7iWyzDUJQtXi p{margin:0;}#mermaid-svg-2S4o7iWyzDUJQtXi .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster-label text{fill:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster-label span{color:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster-label span p{background-color:transparent;}#mermaid-svg-2S4o7iWyzDUJQtXi .label text,#mermaid-svg-2S4o7iWyzDUJQtXi span{fill:#333;color:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi .node rect,#mermaid-svg-2S4o7iWyzDUJQtXi .node circle,#mermaid-svg-2S4o7iWyzDUJQtXi .node ellipse,#mermaid-svg-2S4o7iWyzDUJQtXi .node polygon,#mermaid-svg-2S4o7iWyzDUJQtXi .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-2S4o7iWyzDUJQtXi .rough-node .label text,#mermaid-svg-2S4o7iWyzDUJQtXi .node .label text,#mermaid-svg-2S4o7iWyzDUJQtXi .image-shape .label,#mermaid-svg-2S4o7iWyzDUJQtXi .icon-shape .label{text-anchor:middle;}#mermaid-svg-2S4o7iWyzDUJQtXi .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-2S4o7iWyzDUJQtXi .rough-node .label,#mermaid-svg-2S4o7iWyzDUJQtXi .node .label,#mermaid-svg-2S4o7iWyzDUJQtXi .image-shape .label,#mermaid-svg-2S4o7iWyzDUJQtXi .icon-shape .label{text-align:center;}#mermaid-svg-2S4o7iWyzDUJQtXi .node.clickable{cursor:pointer;}#mermaid-svg-2S4o7iWyzDUJQtXi .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-2S4o7iWyzDUJQtXi .arrowheadPath{fill:#333333;}#mermaid-svg-2S4o7iWyzDUJQtXi .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-2S4o7iWyzDUJQtXi .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-2S4o7iWyzDUJQtXi .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-2S4o7iWyzDUJQtXi .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-2S4o7iWyzDUJQtXi .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-2S4o7iWyzDUJQtXi .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster text{fill:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi .cluster span{color:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-2S4o7iWyzDUJQtXi .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-2S4o7iWyzDUJQtXi rect.text{fill:none;stroke-width:0;}#mermaid-svg-2S4o7iWyzDUJQtXi .icon-shape,#mermaid-svg-2S4o7iWyzDUJQtXi .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-2S4o7iWyzDUJQtXi .icon-shape p,#mermaid-svg-2S4o7iWyzDUJQtXi .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-2S4o7iWyzDUJQtXi .icon-shape rect,#mermaid-svg-2S4o7iWyzDUJQtXi .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-2S4o7iWyzDUJQtXi .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-2S4o7iWyzDUJQtXi .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-2S4o7iWyzDUJQtXi :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

digest认证流程

addauth digest user:pass

SHA-1加密

存储认证信息

设置ACL

客户端

ZooKeeper

密码哈希

会话认证状态

用户创建节点

存储: digest:user:hash

# 1. 添加认证
[zk: localhost:2181(CONNECTED) 0] addauth digest admin:admin123

# 2. 创建受保护节点
[zk: localhost:2181(CONNECTED) 1] create /secret "top-secret"
[zk: localhost:2181(CONNECTED) 2] setAcl /secret digest:admin:admin123:cdwra

# 3. 查看ACL（密码已哈希）
[zk: localhost:2181(CONNECTED) 3] getAcl /secret
'digest,'admin:W5R8ZqN7nYqY9YqY
: cdrwa

# 4. 另一个客户端尝试访问
[zk: localhost:2181(CONNECTED) 0] get /secret
KeeperErrorCode = NoAuth for /secret

# 5. 添加正确认证后可以访问
[zk: localhost:2181(CONNECTED) 1] addauth digest admin:admin123
[zk: localhost:2181(CONNECTED) 2] get /secret
top-secret

密码生成工具：

import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;

public class PasswordGenerator {
public static void main(String[] args) throws Exception {
String userPass = "admin:admin123";
String hash = DigestAuthenticationProvider.generateDigest(userPass);
System.out.println("密码哈希: " + hash);
// 输出: admin:W5R8ZqN7nYqY9YqY
}
}

5.4 ip方案：基于网络位置

# 允许特定IP访问
[zk: localhost:2181(CONNECTED) 0] create /internal "internal-data"
[zk: localhost:2181(CONNECTED) 1] setAcl /internal ip:192.168.1.100:cdrwa

# 允许整个网段
[zk: localhost:2181(CONNECTED) 2] setAcl /internal ip:192.168.1.0/24:cdrwa

特点：

• 基于客户端IP地址认证
• 可以指定单个IP或CIDR网段
• 适合内部网络服务

5.5 sasl方案：企业级认证

# zoo.cfg中启用SASL
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000

# jaas.conf配置
Server {
org.apache.zookeeper.server.auth.DigestLoginModule required
user_super="admin-secret"
user_user1="pass1";
};

特点：

• 支持Kerberos认证
• 适合大型企业环境
• 与现有认证系统集成

六、内置ACL常量

ZooKeeper在ZooDefs.Ids中提供了一些常用的ACL常量：

public class BuiltInAclExample {

public void useBuiltInAcl() throws Exception {
ZooKeeper zk = new ZooKeeper("localhost:2181", 5000, null);

// 1. 完全开放的节点（不安全）
zk.create("/public", "data".getBytes(),
ZooDefs.Ids.OPEN_ACL_UNSAFE,
CreateMode.PERSISTENT);

// 2. 仅创建者可访问
zk.addAuthInfo("digest", "admin:admin123".getBytes());
zk.create("/private", "secret".getBytes(),
ZooDefs.Ids.CREATOR_ALL_ACL,
CreateMode.PERSISTENT);

// 3. 全局只读
zk.create("/readonly", "readme".getBytes(),
ZooDefs.Ids.READ_ACL_UNSAFE,
CreateMode.PERSISTENT);
}
}

七、ACL的继承与覆盖

7.1 ACL的继承规则

ZooKeeper中，子节点不会自动继承父节点的ACL。每个节点独立设置自己的ACL。

#mermaid-svg-52aPqHyjM5uKFHXV{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-52aPqHyjM5uKFHXV .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-52aPqHyjM5uKFHXV .error-icon{fill:#552222;}#mermaid-svg-52aPqHyjM5uKFHXV .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-52aPqHyjM5uKFHXV .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-52aPqHyjM5uKFHXV .marker{fill:#333333;stroke:#333333;}#mermaid-svg-52aPqHyjM5uKFHXV .marker.cross{stroke:#333333;}#mermaid-svg-52aPqHyjM5uKFHXV svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-52aPqHyjM5uKFHXV p{margin:0;}#mermaid-svg-52aPqHyjM5uKFHXV .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-52aPqHyjM5uKFHXV .cluster-label text{fill:#333;}#mermaid-svg-52aPqHyjM5uKFHXV .cluster-label span{color:#333;}#mermaid-svg-52aPqHyjM5uKFHXV .cluster-label span p{background-color:transparent;}#mermaid-svg-52aPqHyjM5uKFHXV .label text,#mermaid-svg-52aPqHyjM5uKFHXV span{fill:#333;color:#333;}#mermaid-svg-52aPqHyjM5uKFHXV .node rect,#mermaid-svg-52aPqHyjM5uKFHXV .node circle,#mermaid-svg-52aPqHyjM5uKFHXV .node ellipse,#mermaid-svg-52aPqHyjM5uKFHXV .node polygon,#mermaid-svg-52aPqHyjM5uKFHXV .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-52aPqHyjM5uKFHXV .rough-node .label text,#mermaid-svg-52aPqHyjM5uKFHXV .node .label text,#mermaid-svg-52aPqHyjM5uKFHXV .image-shape .label,#mermaid-svg-52aPqHyjM5uKFHXV .icon-shape .label{text-anchor:middle;}#mermaid-svg-52aPqHyjM5uKFHXV .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-52aPqHyjM5uKFHXV .rough-node .label,#mermaid-svg-52aPqHyjM5uKFHXV .node .label,#mermaid-svg-52aPqHyjM5uKFHXV .image-shape .label,#mermaid-svg-52aPqHyjM5uKFHXV .icon-shape .label{text-align:center;}#mermaid-svg-52aPqHyjM5uKFHXV .node.clickable{cursor:pointer;}#mermaid-svg-52aPqHyjM5uKFHXV .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-52aPqHyjM5uKFHXV .arrowheadPath{fill:#333333;}#mermaid-svg-52aPqHyjM5uKFHXV .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-52aPqHyjM5uKFHXV .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-52aPqHyjM5uKFHXV .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-52aPqHyjM5uKFHXV .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-52aPqHyjM5uKFHXV .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-52aPqHyjM5uKFHXV .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-52aPqHyjM5uKFHXV .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-52aPqHyjM5uKFHXV .cluster text{fill:#333;}#mermaid-svg-52aPqHyjM5uKFHXV .cluster span{color:#333;}#mermaid-svg-52aPqHyjM5uKFHXV div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-52aPqHyjM5uKFHXV .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-52aPqHyjM5uKFHXV rect.text{fill:none;stroke-width:0;}#mermaid-svg-52aPqHyjM5uKFHXV .icon-shape,#mermaid-svg-52aPqHyjM5uKFHXV .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-52aPqHyjM5uKFHXV .icon-shape p,#mermaid-svg-52aPqHyjM5uKFHXV .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-52aPqHyjM5uKFHXV .icon-shape rect,#mermaid-svg-52aPqHyjM5uKFHXV .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-52aPqHyjM5uKFHXV .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-52aPqHyjM5uKFHXV .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-52aPqHyjM5uKFHXV :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

/parentACL: admin:cdrwa

/parent/child1ACL: world:r

/parent/child2ACL: auth::cdw

# 验证继承规则
[zk: localhost:2181(CONNECTED) 0] create /parent "parent"
[zk: localhost:2181(CONNECTED) 1] setAcl /parent digest:admin:admin123:cdrwa

[zk: localhost:2181(CONNECTED) 2] create /parent/child "child"
[zk: localhost:2181(CONNECTED) 3] getAcl /parent/child
'world,'anyone
: cdrwa # 子节点使用默认ACL，没有继承父节点

7.2 默认ACL

如果没有显式设置ACL，ZooKeeper使用默认ACL：

# zoo.cfg中可以配置默认ACL
zookeeper.DigestAuthenticationProvider.superDigest=admin:W5R8ZqN7nYqY9YqY

八、超级管理员模式

8.1 超级用户配置

ZooKeeper允许配置一个超级用户，可以绕过所有ACL检查：

# zoo.cfg中配置超级用户
zookeeper.DigestAuthenticationProvider.superDigest=admin:W5R8ZqN7nYqY9YqY

# 使用超级用户
[zk: localhost:2181(CONNECTED) 0] addauth digest admin:admin123
[zk: localhost:2181(CONNECTED) 1] get /any-node # 即使没有权限也能访问

8.2 超级用户的作用

• 紧急恢复：忘记ACL配置时可以访问
• 运维操作：执行需要特殊权限的维护任务
• 审计绕过：仅限可信管理员使用

九、ACL管理最佳实践

9.1 权限分配原则

#mermaid-svg-29HqCK7LcBVol363{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-29HqCK7LcBVol363 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-29HqCK7LcBVol363 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-29HqCK7LcBVol363 .error-icon{fill:#552222;}#mermaid-svg-29HqCK7LcBVol363 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-29HqCK7LcBVol363 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-29HqCK7LcBVol363 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-29HqCK7LcBVol363 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-29HqCK7LcBVol363 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-29HqCK7LcBVol363 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-29HqCK7LcBVol363 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-29HqCK7LcBVol363 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-29HqCK7LcBVol363 .marker.cross{stroke:#333333;}#mermaid-svg-29HqCK7LcBVol363 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-29HqCK7LcBVol363 p{margin:0;}#mermaid-svg-29HqCK7LcBVol363 .edge{stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .section–1 rect,#mermaid-svg-29HqCK7LcBVol363 .section–1 path,#mermaid-svg-29HqCK7LcBVol363 .section–1 circle,#mermaid-svg-29HqCK7LcBVol363 .section–1 polygon,#mermaid-svg-29HqCK7LcBVol363 .section–1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section–1 text{fill:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .node-icon–1{font-size:40px;color:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .section-edge–1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth–1{stroke-width:17;}#mermaid-svg-29HqCK7LcBVol363 .section–1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-0 rect,#mermaid-svg-29HqCK7LcBVol363 .section-0 path,#mermaid-svg-29HqCK7LcBVol363 .section-0 circle,#mermaid-svg-29HqCK7LcBVol363 .section-0 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-29HqCK7LcBVol363 .section-0 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-0{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-0{stroke-width:14;}#mermaid-svg-29HqCK7LcBVol363 .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-1 rect,#mermaid-svg-29HqCK7LcBVol363 .section-1 path,#mermaid-svg-29HqCK7LcBVol363 .section-1 circle,#mermaid-svg-29HqCK7LcBVol363 .section-1 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-1 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-1{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-1{stroke-width:11;}#mermaid-svg-29HqCK7LcBVol363 .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-2 rect,#mermaid-svg-29HqCK7LcBVol363 .section-2 path,#mermaid-svg-29HqCK7LcBVol363 .section-2 circle,#mermaid-svg-29HqCK7LcBVol363 .section-2 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-2 text{fill:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-2{stroke-width:8;}#mermaid-svg-29HqCK7LcBVol363 .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-3 rect,#mermaid-svg-29HqCK7LcBVol363 .section-3 path,#mermaid-svg-29HqCK7LcBVol363 .section-3 circle,#mermaid-svg-29HqCK7LcBVol363 .section-3 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-3 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-3{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-3{stroke-width:5;}#mermaid-svg-29HqCK7LcBVol363 .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-4 rect,#mermaid-svg-29HqCK7LcBVol363 .section-4 path,#mermaid-svg-29HqCK7LcBVol363 .section-4 circle,#mermaid-svg-29HqCK7LcBVol363 .section-4 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-4 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-4{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-4{stroke-width:2;}#mermaid-svg-29HqCK7LcBVol363 .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-5 rect,#mermaid-svg-29HqCK7LcBVol363 .section-5 path,#mermaid-svg-29HqCK7LcBVol363 .section-5 circle,#mermaid-svg-29HqCK7LcBVol363 .section-5 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-5 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-5{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-5{stroke-width:-1;}#mermaid-svg-29HqCK7LcBVol363 .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-6 rect,#mermaid-svg-29HqCK7LcBVol363 .section-6 path,#mermaid-svg-29HqCK7LcBVol363 .section-6 circle,#mermaid-svg-29HqCK7LcBVol363 .section-6 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-6 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-6{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-6{stroke-width:-4;}#mermaid-svg-29HqCK7LcBVol363 .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-7 rect,#mermaid-svg-29HqCK7LcBVol363 .section-7 path,#mermaid-svg-29HqCK7LcBVol363 .section-7 circle,#mermaid-svg-29HqCK7LcBVol363 .section-7 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-7 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-7{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-7{stroke-width:-7;}#mermaid-svg-29HqCK7LcBVol363 .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-8 rect,#mermaid-svg-29HqCK7LcBVol363 .section-8 path,#mermaid-svg-29HqCK7LcBVol363 .section-8 circle,#mermaid-svg-29HqCK7LcBVol363 .section-8 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-8 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-8{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-8{stroke-width:-10;}#mermaid-svg-29HqCK7LcBVol363 .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-9 rect,#mermaid-svg-29HqCK7LcBVol363 .section-9 path,#mermaid-svg-29HqCK7LcBVol363 .section-9 circle,#mermaid-svg-29HqCK7LcBVol363 .section-9 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-9 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-9{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-9{stroke-width:-13;}#mermaid-svg-29HqCK7LcBVol363 .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-10 rect,#mermaid-svg-29HqCK7LcBVol363 .section-10 path,#mermaid-svg-29HqCK7LcBVol363 .section-10 circle,#mermaid-svg-29HqCK7LcBVol363 .section-10 polygon,#mermaid-svg-29HqCK7LcBVol363 .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-10 text{fill:black;}#mermaid-svg-29HqCK7LcBVol363 .node-icon-10{font-size:40px;color:black;}#mermaid-svg-29HqCK7LcBVol363 .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .edge-depth-10{stroke-width:-16;}#mermaid-svg-29HqCK7LcBVol363 .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-29HqCK7LcBVol363 .disabled,#mermaid-svg-29HqCK7LcBVol363 .disabled circle,#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:lightgray;}#mermaid-svg-29HqCK7LcBVol363 .disabled text{fill:#efefef;}#mermaid-svg-29HqCK7LcBVol363 .section-root rect,#mermaid-svg-29HqCK7LcBVol363 .section-root path,#mermaid-svg-29HqCK7LcBVol363 .section-root circle,#mermaid-svg-29HqCK7LcBVol363 .section-root polygon{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-29HqCK7LcBVol363 .section-root text{fill:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .section-root span{color:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .section-2 span{color:#ffffff;}#mermaid-svg-29HqCK7LcBVol363 .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-29HqCK7LcBVol363 .edge{fill:none;}#mermaid-svg-29HqCK7LcBVol363 .mindmap-node-label{dy:1em;alignment-baseline:middle;text-anchor:middle;dominant-baseline:middle;text-align:center;}#mermaid-svg-29HqCK7LcBVol363 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

ACL分配原则

最小权限原则

只给必要的权限

不滥用ADMIN权限

分层管理

配置中心: auth+ip

服务注册: digest

公共数据: world:r

安全审计

定期检查ACL

监控异常访问

9.2 常见场景配置

9.3 安全审计脚本

#!/bin/bash
# audit_zk_acl.sh – 审计ZooKeeper ACL配置

ZK_CLIENT="./zkCli.sh -server localhost:2181"

echo "===== ZooKeeper ACL审计报告 ====="
echo "时间: $(date)"
echo ""

# 获取所有节点
nodes=$(echo "ls /" | $ZK_CLIENT 2>/dev/null | grep -v "WATCHER" | grep -v "Connecting" | tr -d '[],')

for node in $nodes; do
echo "节点: $node"

# 获取ACL
acl=$(echo "getAcl $node" | $ZK_CLIENT 2>/dev/null | grep -v "WATCHER" | grep -v "Connecting")

# 检查是否存在开放权限
if echo "$acl" | grep -q "world:anyone:cdrwa"; then
echo "⚠️ 警告: 节点 $node 完全开放 (world:anyone:cdrwa)"
fi

# 检查是否有ADMIN权限滥用
if echo "$acl" | grep -q "a"; then
echo "ℹ️ 节点 $node 包含ADMIN权限"
fi

echo "ACL: $acl"
echo "—"
done

十、总结

10.1 ACL核心要点

10.2 安全建议

10.3 一句话总结

ZooKeeper的ACL机制通过Scheme + ID + Permissions的三元组结构，提供了灵活精细的访问控制能力，是保障分布式协调服务数据安全的基石。正确理解和应用ACL，能够有效防止未授权访问，构建安全可靠的分布式系统。