public class KafkaAuthWriter extends java.lang.Object implements Writer, AuthWriter, ConsumerListener<AuthKey,AuthValue>
Constructor and Description |
---|
KafkaAuthWriter(java.lang.String topic,
int numPartitions,
KafkaStoreConfig config,
org.apache.kafka.clients.producer.Producer<AuthKey,AuthValue> producer,
java.util.function.Supplier<org.apache.kafka.clients.admin.AdminClient> adminClientSupplier,
DefaultAuthCache authCache,
StatusListener statusListener,
org.apache.kafka.common.utils.Time time) |
Modifier and Type | Method and Description |
---|---|
java.util.concurrent.CompletionStage<java.lang.Void> |
addClusterRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
java.lang.String role,
io.confluent.security.authorizer.Scope scope)
Adds a new cluster-level role binding without any resources.
|
java.util.concurrent.CompletionStage<java.lang.Void> |
addResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
java.lang.String role,
io.confluent.security.authorizer.Scope scope,
java.util.Collection<io.confluent.security.authorizer.ResourcePattern> newResources)
Adds resources to a role binding.
|
void |
close(java.time.Duration closeTimeout) |
java.util.concurrent.CompletionStage<java.lang.Void> |
createAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBinding aclBinding)
Creates ACL rules for a given AclBinding.
|
java.util.Map<org.apache.kafka.common.acl.AclBinding,java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings)
Creates ACLs for the specified scope using the minimal number of batched updates.
|
protected LdapStore |
createLdapStore(java.util.Map<java.lang.String,?> configs,
DefaultAuthCache authCache) |
java.util.concurrent.CompletionStage<java.util.Collection<org.apache.kafka.common.acl.AclBinding>> |
deleteAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBindingFilter filter,
java.util.function.Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
Deletes all ACL rules that match the provided filters.
|
java.util.Map<org.apache.kafka.common.acl.AclBindingFilter,java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
java.util.List<org.apache.kafka.common.acl.AclBindingFilter> filters,
java.util.function.Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
Deletes ACLs that match any of the provided filters using batched update.
|
void |
onConsumerRecord(org.apache.kafka.clients.consumer.ConsumerRecord<AuthKey,AuthValue> record,
AuthValue oldValue)
Notification of new record consumed by local reader
|
boolean |
ready()
Returns true if this is the master writer and is ready to process requests
|
java.util.concurrent.CompletionStage<java.lang.Void> |
removeResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
java.lang.String role,
io.confluent.security.authorizer.Scope scope,
java.util.Collection<io.confluent.security.authorizer.ResourcePatternFilter> deletedResources)
Removes resources from an existing role binding.
|
java.util.concurrent.CompletionStage<java.lang.Void> |
removeRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
java.lang.String role,
io.confluent.security.authorizer.Scope scope)
Removes a role binding.
|
java.util.concurrent.CompletionStage<java.lang.Void> |
replaceResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
java.lang.String role,
io.confluent.security.authorizer.Scope scope,
java.util.Collection<io.confluent.security.authorizer.ResourcePattern> resources)
Sets resources for an existing role binding.
|
void |
startWriter(int generationId)
Starts master writer with the specified generation id.
|
void |
stopWriter(java.lang.Integer generationId)
Stops this writer because a new master writer was elected.
|
void |
writeExternalEntry(AuthKey key,
AuthValue value,
int expectedGenerationId)
Writes an external metadata entry into the partition corresponding to the provided key.
|
void |
writeExternalStatus(MetadataStoreStatus status,
java.lang.String errorMessage,
int generationId) |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
addClusterRoleBinding, addResourceRoleBinding, createAcls, createAcls, deleteAcls, deleteAcls, removeResourceRoleBinding, removeRoleBinding, replaceResourceRoleBinding
public KafkaAuthWriter(java.lang.String topic, int numPartitions, KafkaStoreConfig config, org.apache.kafka.clients.producer.Producer<AuthKey,AuthValue> producer, java.util.function.Supplier<org.apache.kafka.clients.admin.AdminClient> adminClientSupplier, DefaultAuthCache authCache, StatusListener statusListener, org.apache.kafka.common.utils.Time time)
public void startWriter(int generationId)
Writer
MetadataServiceCoordinator
during writer election.startWriter
in interface Writer
generationId
- Generation id of writerpublic void stopWriter(java.lang.Integer generationId)
Writer
stopWriter
in interface Writer
generationId
- Generation id of writer being stopped or null to stop regardless of
current writer generationpublic boolean ready()
Writer
public java.util.concurrent.CompletionStage<java.lang.Void> addClusterRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, java.lang.String role, io.confluent.security.authorizer.Scope scope)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
addClusterRoleBinding
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorprincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignedpublic java.util.concurrent.CompletionStage<java.lang.Void> addResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, java.lang.String role, io.confluent.security.authorizer.Scope scope, java.util.Collection<io.confluent.security.authorizer.ResourcePattern> newResources)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
addResourceRoleBinding
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorprincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignednewResources
- Resources to add to role bindingpublic java.util.concurrent.CompletionStage<java.lang.Void> replaceResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, java.lang.String role, io.confluent.security.authorizer.Scope scope, java.util.Collection<io.confluent.security.authorizer.ResourcePattern> resources)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
replaceResourceRoleBinding
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorprincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignedresources
- Updated collection of resources for the role bindingpublic java.util.concurrent.CompletionStage<java.lang.Void> removeRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, java.lang.String role, io.confluent.security.authorizer.Scope scope)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
removeRoleBinding
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorprincipal
- User or group principal from which role is removedrole
- Name of rolescope
- Scope at which role is assignedpublic java.util.concurrent.CompletionStage<java.lang.Void> removeResourceRoleBinding(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, java.lang.String role, io.confluent.security.authorizer.Scope scope, java.util.Collection<io.confluent.security.authorizer.ResourcePatternFilter> deletedResources)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
removeResourceRoleBinding
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorprincipal
- User or group principal from which role is removedrole
- Name of rolescope
- Scope at which role is assigneddeletedResources
- Filter for resources being removed for the role bindingpublic java.util.concurrent.CompletionStage<java.lang.Void> createAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBinding aclBinding)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
createAcls
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedaclBinding
- AclBinding to addpublic java.util.Map<org.apache.kafka.common.acl.AclBinding,java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, java.util.List<org.apache.kafka.common.acl.AclBinding> aclBindings)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
createAcls
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedaclBindings
- List of ACLs to createpublic java.util.concurrent.CompletionStage<java.util.Collection<org.apache.kafka.common.acl.AclBinding>> deleteAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBindingFilter filter, java.util.function.Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
deleteAcls
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are deletedfilter
- AclBindingFilter to match the rulesresourceAccess
- predicate to check delete permission on resourcespublic java.util.Map<org.apache.kafka.common.acl.AclBindingFilter,java.util.concurrent.CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(java.util.Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, java.util.List<org.apache.kafka.common.acl.AclBindingFilter> filters, java.util.function.Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
AuthWriter
deleteAcls
in interface AuthWriter
requestorPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedfilters
- Filters whose matching ACLs are deletedresourceAccess
- predicate to check delete permission on resourcespublic void close(java.time.Duration closeTimeout)
public void onConsumerRecord(org.apache.kafka.clients.consumer.ConsumerRecord<AuthKey,AuthValue> record, AuthValue oldValue)
ConsumerListener
onConsumerRecord
in interface ConsumerListener<AuthKey,AuthValue>
record
- the record from consumeroldValue
- old value corresponding to record key from local cachepublic void writeExternalEntry(AuthKey key, AuthValue value, int expectedGenerationId)
key
- Key for new recordvalue
- Value for new record, may be null to delete the entryexpectedGenerationId
- Generation id currently associated with the external storepublic void writeExternalStatus(MetadataStoreStatus status, java.lang.String errorMessage, int generationId)
protected LdapStore createLdapStore(java.util.Map<java.lang.String,?> configs, DefaultAuthCache authCache)