public class ConfluentProvider
extends java.lang.Object
implements io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.GroupProvider, io.confluent.security.authorizer.provider.MetadataProvider, org.apache.kafka.server.authorizer.Authorizer, org.apache.kafka.common.ClusterResourceListener, io.confluent.security.authorizer.provider.Auditable, io.confluent.security.authorizer.AclMigrationAware, org.apache.kafka.common.Reconfigurable
Constructor and Description |
---|
ConfluentProvider() |
Modifier and Type | Method and Description |
---|---|
java.lang.Iterable<org.apache.kafka.common.acl.AclBinding> |
acls(org.apache.kafka.common.acl.AclBindingFilter filter) |
void |
auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider) |
java.util.List<org.apache.kafka.server.authorizer.AuthorizationResult> |
authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.server.authorizer.Action> actions) |
AuthStore |
authStore() |
void |
close() |
void |
configure(java.util.Map<java.lang.String,?> configs) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings,
java.util.Optional<java.lang.String> aclClusterId) |
protected AuthStore |
createAuthStore(io.confluent.security.authorizer.Scope scope,
org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> configs) |
protected org.apache.kafka.clients.admin.ConfluentAdmin |
createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> clientConfigs) |
io.confluent.security.authorizer.EmbeddedAuthorizer |
createRbacAuthorizer() |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters) |
java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters,
java.util.Optional<java.lang.String> aclClusterId) |
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
java.lang.String host,
io.confluent.security.authorizer.Action action) |
java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> |
groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal) |
protected boolean |
isConfluentCloud() |
boolean |
isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
io.confluent.security.authorizer.Scope scope) |
boolean |
mayDeny() |
java.lang.Runnable |
migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer) |
void |
onUpdate(org.apache.kafka.common.ClusterResource clusterResource) |
boolean |
providerConfigured(java.util.Map<java.lang.String,?> configs)
Brokers running ConfluentProvider should be either:
- in the metadata cluster, running MDS.
|
java.lang.String |
providerName() |
java.util.Set<java.lang.String> |
reconfigurableConfigs() |
void |
reconfigure(java.util.Map<java.lang.String,?> configs) |
protected void |
setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics) |
java.util.Map<org.apache.kafka.common.Endpoint,? extends java.util.concurrent.CompletionStage<java.lang.Void>> |
start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo) |
java.util.concurrent.CompletionStage<java.lang.Void> |
start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
java.util.Map<java.lang.String,?> interBrokerListenerConfigs)
Starts the RBAC provider.
|
boolean |
usesMetadataFromThisKafkaCluster()
Returns true if this broker is running the centralized Metadata Service in the embedded
MetadataServer as indicated by MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP . |
void |
validateReconfiguration(java.util.Map<java.lang.String,?> configs) |
public void onUpdate(org.apache.kafka.common.ClusterResource clusterResource)
onUpdate
in interface org.apache.kafka.common.ClusterResourceListener
public void configure(java.util.Map<java.lang.String,?> configs)
configure
in interface org.apache.kafka.common.Configurable
public java.util.Set<java.lang.String> reconfigurableConfigs()
reconfigurableConfigs
in interface org.apache.kafka.common.Reconfigurable
public void validateReconfiguration(java.util.Map<java.lang.String,?> configs) throws org.apache.kafka.common.config.ConfigException
validateReconfiguration
in interface org.apache.kafka.common.Reconfigurable
org.apache.kafka.common.config.ConfigException
public void reconfigure(java.util.Map<java.lang.String,?> configs)
reconfigure
in interface org.apache.kafka.common.Reconfigurable
public java.lang.String providerName()
providerName
in interface io.confluent.security.authorizer.provider.Provider
public boolean providerConfigured(java.util.Map<java.lang.String,?> configs)
providerConfigured
in interface io.confluent.security.authorizer.provider.GroupProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.MetadataProvider
public java.util.concurrent.CompletionStage<java.lang.Void> start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> interBrokerListenerConfigs)
On brokers running metadata service, the start up sequence is:
MDS brokers complete the provider's start future only when both service future and reader future have completed. If either fails, broker start up is terminated.
start
in interface io.confluent.security.authorizer.provider.Provider
public boolean mayDeny()
mayDeny
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public boolean usesMetadataFromThisKafkaCluster()
MetadataServer
as indicated by MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP
.
Otherwise returns false and AuthStore
listens to Metadata Service in another cluster
configured using KafkaStoreConfig.BOOTSTRAP_SERVERS_PROP
.usesMetadataFromThisKafkaCluster
in interface io.confluent.security.authorizer.provider.Provider
public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
isSuperUser
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, java.lang.String host, io.confluent.security.authorizer.Action action)
findRule
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public java.util.Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)
groups
in interface io.confluent.security.authorizer.provider.GroupProvider
public void close()
close
in interface java.io.Closeable
close
in interface java.lang.AutoCloseable
public void auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider)
auditLogProvider
in interface io.confluent.security.authorizer.provider.Auditable
public AuthStore authStore()
public io.confluent.security.authorizer.EmbeddedAuthorizer createRbacAuthorizer()
protected org.apache.kafka.clients.admin.ConfluentAdmin createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> clientConfigs)
protected boolean isConfluentCloud()
protected AuthStore createAuthStore(io.confluent.security.authorizer.Scope scope, org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, java.util.Map<java.lang.String,?> configs)
public java.util.Map<org.apache.kafka.common.Endpoint,? extends java.util.concurrent.CompletionStage<java.lang.Void>> start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo)
start
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<org.apache.kafka.server.authorizer.AuthorizationResult> authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.server.authorizer.Action> actions)
authorize
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings, java.util.Optional<java.lang.String> aclClusterId)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.util.List<? extends java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, java.util.List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters, java.util.Optional<java.lang.String> aclClusterId)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.lang.Iterable<org.apache.kafka.common.acl.AclBinding> acls(org.apache.kafka.common.acl.AclBindingFilter filter)
acls
in interface org.apache.kafka.server.authorizer.Authorizer
public java.lang.Runnable migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer)
migrationTask
in interface io.confluent.security.authorizer.AclMigrationAware
protected void setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics)