public class ConfluentProvider
extends java.lang.Object
implements io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.GroupProvider, io.confluent.security.authorizer.provider.MetadataProvider, org.apache.kafka.server.authorizer.Authorizer, org.apache.kafka.common.ClusterResourceListener, io.confluent.security.authorizer.provider.Auditable, io.confluent.security.authorizer.AclMigrationAware, org.apache.kafka.common.Reconfigurable
Constructor and Description |
---|
ConfluentProvider() |
Modifier and Type | Method and Description |
---|---|
java.lang.Iterable<org.apache.kafka.common.acl.AclBinding> |
acls(org.apache.kafka.common.acl.AclBindingFilter filter) |
void |
auditLogProvider(io.confluent.security.authorizer.provider.AuditLogProvider auditLogProvider) |
java.util.List<org.apache.kafka.server.authorizer.AuthorizationResult> |
authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.server.authorizer.Action> actions) |
AuthStore |
authStore() |
void |
close() |
void |
configure(java.util.Map<java.lang.String,?> configs) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings,
java.util.Optional<java.lang.String> aclClusterId) |
protected AuthStore |
createAuthStore(io.confluent.security.authorizer.Scope scope,
org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> configs) |
protected org.apache.kafka.clients.admin.ConfluentAdmin |
createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> clientConfigs) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters,
java.util.Optional<java.lang.String> aclClusterId) |
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
java.lang.String host,
io.confluent.security.authorizer.Action action) |
java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> |
groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal) |
boolean |
isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
io.confluent.security.authorizer.Scope scope) |
boolean |
mayDeny() |
java.lang.Runnable |
migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer) |
void |
onUpdate(org.apache.kafka.common.ClusterResource clusterResource) |
boolean |
providerConfigured(java.util.Map<java.lang.String,?> configs)
Brokers running ConfluentProvider should be either:
- in the metadata cluster, running MDS.
|
java.lang.String |
providerName() |
java.util.Set<java.lang.String> |
reconfigurableConfigs() |
void |
reconfigure(java.util.Map<java.lang.String,?> configs) |
java.util.Map<org.apache.kafka.common.Endpoint,? extends java.util.concurrent.CompletionStage<java.lang.Void>> |
start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo) |
java.util.concurrent.CompletionStage<java.lang.Void> |
start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> interBrokerListenerConfigs)
Starts the RBAC provider.
|
boolean |
usesMetadataFromThisKafkaCluster()
Returns true if this broker is running the centralized Metadata Service in the embedded
MetadataServer as indicated by MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP . |
void |
validateReconfiguration(java.util.Map<java.lang.String,?> configs) |
public void onUpdate(org.apache.kafka.common.ClusterResource clusterResource)
onUpdate
in interface org.apache.kafka.common.ClusterResourceListener
public void configure(java.util.Map<java.lang.String,?> configs)
configure
in interface org.apache.kafka.common.Configurable
public java.util.Set<java.lang.String> reconfigurableConfigs()
reconfigurableConfigs
in interface org.apache.kafka.common.Reconfigurable
public void validateReconfiguration(java.util.Map<java.lang.String,?> configs) throws org.apache.kafka.common.config.ConfigException
validateReconfiguration
in interface org.apache.kafka.common.Reconfigurable
org.apache.kafka.common.config.ConfigException
public void reconfigure(java.util.Map<java.lang.String,?> configs)
reconfigure
in interface org.apache.kafka.common.Reconfigurable
public java.lang.String providerName()
providerName
in interface io.confluent.security.authorizer.provider.Provider
public boolean providerConfigured(java.util.Map<java.lang.String,?> configs)
providerConfigured
in interface io.confluent.security.authorizer.provider.GroupProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.MetadataProvider
public java.util.concurrent.CompletionStage<java.lang.Void> start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> interBrokerListenerConfigs)
On brokers running metadata service, the start up sequence is:
start
in interface io.confluent.security.authorizer.provider.Provider
public boolean mayDeny()
mayDeny
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public boolean usesMetadataFromThisKafkaCluster()
MetadataServer
as indicated by MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP
.
Otherwise returns false and AuthStore
listens to Metadata Service in another cluster
configured using KafkaStoreConfig.BOOTSTRAP_SERVERS_PROP
.usesMetadataFromThisKafkaCluster
in interface io.confluent.security.authorizer.provider.Provider
public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
isSuperUser
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, java.lang.String host, io.confluent.security.authorizer.Action action)
findRule
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)
groups
in interface io.confluent.security.authorizer.provider.GroupProvider
public void close()
close
in interface java.io.Closeable
close
in interface java.lang.AutoCloseable
public void auditLogProvider(io.confluent.security.authorizer.provider.AuditLogProvider auditLogProvider)
auditLogProvider
in interface io.confluent.security.authorizer.provider.Auditable
public AuthStore authStore()
protected org.apache.kafka.clients.admin.ConfluentAdmin createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> clientConfigs)
protected AuthStore createAuthStore(io.confluent.security.authorizer.Scope scope, org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> configs)
public java.util.Map<org.apache.kafka.common.Endpoint,? extends java.util.concurrent.CompletionStage<java.lang.Void>> start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo)
start
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<org.apache.kafka.server.authorizer.AuthorizationResult> authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.server.authorizer.Action> actions)
authorize
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings, java.util.Optional<java.lang.String> aclClusterId)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters, java.util.Optional<java.lang.String> aclClusterId)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.lang.Iterable<org.apache.kafka.common.acl.AclBinding> acls(org.apache.kafka.common.acl.AclBindingFilter filter)
acls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.lang.Runnable migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer)
migrationTask
in interface io.confluent.security.authorizer.AclMigrationAware