Helix ZkClient times out after successful ZooKeeper SASL DIGEST-MD5 authentication

Abierto
  • ¿Algo no está bien?
#3,184 0 comentarios 0 reacciones 0 asignados Ver en GitHub

@adityaanikam ya está trabajando en esto.

Desde el 29/9/2026.

  • #3185 de @adityaanikam — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
java
Área
authentication, distributed-systems, testing

Línea de trabajo

Start at ZkClient.waitUntilConnected and the isKerberosAuthEnabled check described in the issue. Reproduce the controller or participant timeout with the provided DIGEST-MD5 JAAS configuration, then add the requested regression test covering successful authentication while preserving Kerberos behavior. Done means the authenticated session is treated as connected and startup succeeds.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Describe the bug

When a ZooKeeper server requires SASL DIGEST-MD5 authentication, an Apache Helix controller and participant establish ZooKeeper sessions and receive SaslAuthenticated, but Helix subsequently reports that its ZooKeeper client is not connected and times out.

I reproduced the controller failure with unmodified Helix 1.4.3 and 2.0.1, and the participant failure with Helix 1.4.3. The same DIGEST-MD5 credentials work for a ZooKeeper client and for bootstrapping the Helix cluster.

To Reproduce
  1. Start ZooKeeper with org.apache.zookeeper.server.auth.SASLAuthenticationProvider and sessionRequireClientSASLAuth=true.
  2. Configure the Helix JVM with a JAAS Client entry using org.apache.zookeeper.server.auth.DigestLoginModule and set -Djava.security.auth.login.config=<JAAS file> and -Dzookeeper.sasl.client=true.
  3. Bootstrap a Helix cluster using the same ZooKeeper client configuration
  4. Start org.apache.helix.controller.HelixControllerMain with that cluster, or connect a participant through HelixManagerFactory.getZKHelixManager(..., InstanceType.PARTICIPANT, ...).

The controller's ZooKeeper events reach SyncConnected and then SaslAuthenticated, followed by:

org.apache.helix.zookeeper.zkclient.exception.ZkTimeoutException:
Waiting to be connected to ZK server has timed out.

The Helix 1.4.3 participant shows the same state transition, then:

zkClient is not connected, wait for 10000ms.
zkClient is not connected after waiting 10000ms.
org.apache.helix.HelixException: HelixManager is not connected within retry timeout
Expected behavior

Helix should treat a successful SASL DIGEST-MD5 authentication as a connected session and allow the controller and participant to start.

Additional context

In Helix 2.0.1, ZkClient.waitUntilConnected expects SaslAuthenticated only when isKerberosAuthEnabled() finds a JAAS Krb5LoginModule. A DigestLoginModule client instead waits for SyncConnected. After successful DIGEST-MD5 authentication, the current state becomes SaslAuthenticated, and the exact-state wait can time out.

As a local proof of concept, extending that JAAS module check to include DigestLoginModule allowed the controller to authenticate and become leader. This was only a diagnostic class override, not a proposed production patch. A fix should include a regression test for DIGEST-MD5 and preserve Kerberos behavior.

This appears related to #3101 (Kerberos connection timeout). The Kerberos fix does not cover DIGEST-MD5.

Lenguaje dominante
Java
Estrellas
505
Forks
258
Merge medio
4 d 20 h
PR fusionados (30 d)
3

Preparar el entorno

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/helix

Todos los issues de apache/helix

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.