Store SPIFFE creator ACLs as legacy service principals

[bellatrix007]

Description

When X509ZNodeGroupAclProvider.setX509ClientIdAsAcl=true, store automatically assigned ACLs for eligible SPIFFE services in the existing legacy service-principal format. This lets legacy clients use znodes created by their SPIFFE counterparts.

For example, SAN spiffe://example.org/v1/application/example-mp/kafka retains the authenticated identity application/example-mp/kafka, but its automatically generated client ACL is:

[
  {
    "perms": 31,
    "id": {
      "scheme": "x509",
      "id": "servicePrincipal(kafka"
    }
  }
]

The stored ID intentionally has no closing parenthesis.

• Covers SPIFFE v1/wl and complete v1/v2 application/<mp>/<app>[/<tag>] identities.
• Formats only the original authenticated client entry selected for automatic ACL assignment. Certificate extraction, AuthInfo, domain ACLs, and superuser selection remain unchanged.
• Passes request identity into ACL preparation for create variants, multi-create, setACL, and eager validation, including forwarded requests.
• Reuses the existing compatibility parser, retains IDs that cannot be represented safely, and deduplicates identical generated grants.
• Does not add a missing client ACL when storeAuthedClientId=false retains only mapped domains. Flag-off, basic-provider, dedicated-server, explicit-superuser, and non-application identity policies are unchanged.

Standalone follow-up to merged #149, based on branch-3.6.

Tests

Added X509CreatorAclTest (18 tests) covering exact stored IDs, retained AuthInfo, supported SPIFFE forms, type/binding restrictions, mapped domains, duplicate grants, legacy access, and excluded policies.

Added these processor tests, each covering local and decoded forwarded requests:

• testSpiffeAutomaticAclOnLocalAndForwardedCreates
• testSpiffeAutomaticAclOnLocalAndForwardedSetAcl
• testSpiffeAutomaticAclAllowsSubsequentOperationsInMulti

Ran against the exact PR commit:

mvn -q -pl zookeeper-server -am \
  -Dtest=X509CreatorAclTest,TestFixupACL,PrepRequestProcessorTest,X509DirectAclTest,X509ZNodeGroupAclProviderTest,ZkClientUriDomainMappingHelperTest,X509QuorumAuthInfoTest \
  -Djava.rmi.server.hostname=127.0.0.1 \
  -DfailIfNoTests=false -Dsurefire-forkcount=1 test

Result: 107 tests, 0 failures, 0 errors, 0 skipped across seven suites. The RMI property keeps the local JMX test fixture on loopback.

No new external TLS ensemble or failover run was performed for this follow-up.

• Local code review completed

Changes that Break Backward Compatibility (Optional)

With automatic client ACL assignment enabled, eligible SPIFFE client ACLs now store servicePrincipal(<app> rather than the full application ID or bare v1/wl ID. The formatted ACL replaces the original client entry; it is not an additional alias. Existing stored ACLs are not automatically migrated, but an authorized setACL under this policy applies the new format.

These ACLs are application-name scoped: they grant their permissions to matching SPIFFE applications across products/tags and to legacy clients with the exact service-principal identity. Use the unchanged explicit/full-ID policy when product/tag isolation is required. Mixed-version servers can generate different stored ACL forms until all servers support this change.

Documentation (Optional)

Updated zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md and the setX509ClientIdAsAcl configuration Javadoc with the format, scope, exclusions, mapping-retention behavior, and rollout caveats.

🤖 Generated with GitHub Copilot CLI