public class ConfluentProvider extends Object implements io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.GroupProvider, io.confluent.security.authorizer.provider.MetadataProvider, org.apache.kafka.server.authorizer.Authorizer, org.apache.kafka.common.ClusterResourceListener, io.confluent.security.authorizer.provider.Auditable, io.confluent.security.authorizer.AclMigrationAware
Modifier and Type | Field and Description |
---|---|
protected boolean |
isConfluentCloud |
Constructor and Description |
---|
ConfluentProvider() |
Modifier and Type | Method and Description |
---|---|
Iterable<org.apache.kafka.common.acl.AclBinding> |
acls(org.apache.kafka.common.acl.AclBindingFilter filter) |
void |
addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules,
org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Operation operation,
io.confluent.security.authorizer.Scope scope,
io.confluent.security.authorizer.ResourceType resourceType) |
void |
auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider) |
List<org.apache.kafka.server.authorizer.AuthorizationResult> |
authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.server.authorizer.Action> actions) |
AuthStore |
authStore() |
io.confluent.security.authorizer.Scope |
authStoreScope() |
void |
close() |
void |
configure(Map<String,?> configs) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBinding> aclBindings) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBinding> aclBindings,
Optional<String> aclClusterId) |
protected AuthStore |
createAuthStore(io.confluent.security.authorizer.Scope scope,
org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
Map<String,?> configs) |
protected org.apache.kafka.clients.admin.ConfluentAdmin |
createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo,
Map<String,?> clientConfigs) |
io.confluent.security.authorizer.EmbeddedAuthorizer |
createRbacAuthorizer() |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters,
Optional<String> aclClusterId) |
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Action action) |
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> |
groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal) |
protected boolean |
isConfluentCloud() |
boolean |
isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
io.confluent.security.authorizer.Scope scope) |
boolean |
mayDeny() |
Runnable |
migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer) |
void |
onUpdate(org.apache.kafka.common.ClusterResource clusterResource) |
boolean |
providerConfigured(Map<String,?> configs)
Brokers running ConfluentProvider should be either:
- in the metadata cluster, running MDS.
|
String |
providerName() |
protected void |
setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics) |
Map<org.apache.kafka.common.Endpoint,? extends CompletionStage<Void>> |
start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo) |
CompletionStage<Void> |
start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
Map<String,?> interBrokerListenerConfigs)
Starts the RBAC provider.
|
boolean |
usesMetadataFromThisKafkaCluster()
Returns true if this broker is running the centralized Metadata Service in the embedded
MetadataServer as indicated by
MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP . |
public void onUpdate(org.apache.kafka.common.ClusterResource clusterResource)
onUpdate
in interface org.apache.kafka.common.ClusterResourceListener
public void configure(Map<String,?> configs)
configure
in interface org.apache.kafka.common.Configurable
public io.confluent.security.authorizer.Scope authStoreScope()
public String providerName()
providerName
in interface io.confluent.security.authorizer.provider.Provider
public boolean providerConfigured(Map<String,?> configs)
providerConfigured
in interface io.confluent.security.authorizer.provider.GroupProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.MetadataProvider
public CompletionStage<Void> start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, Map<String,?> interBrokerListenerConfigs)
On brokers running metadata service, the start up sequence is:
MDS brokers complete the provider's start future only when both service future and reader future have completed. If either fails, broker start up is terminated.
start
in interface io.confluent.security.authorizer.provider.Provider
public boolean mayDeny()
mayDeny
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public boolean usesMetadataFromThisKafkaCluster()
MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP
.
Otherwise returns false and AuthStore
listens to Metadata Service in another cluster
configured using KafkaStoreConfig.BOOTSTRAP_SERVERS_PROP
.usesMetadataFromThisKafkaCluster
in interface io.confluent.security.authorizer.provider.Provider
public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
isSuperUser
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
findRule
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Operation operation, io.confluent.security.authorizer.Scope scope, io.confluent.security.authorizer.ResourceType resourceType)
addMatchingRules
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)
groups
in interface io.confluent.security.authorizer.provider.GroupProvider
public void close()
close
in interface Closeable
close
in interface AutoCloseable
public void auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider)
auditLogProvider
in interface io.confluent.security.authorizer.provider.Auditable
public AuthStore authStore()
public io.confluent.security.authorizer.EmbeddedAuthorizer createRbacAuthorizer()
protected org.apache.kafka.clients.admin.ConfluentAdmin createMdsAdminClient(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo, Map<String,?> clientConfigs)
protected boolean isConfluentCloud()
protected AuthStore createAuthStore(io.confluent.security.authorizer.Scope scope, org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, Map<String,?> configs)
public Map<org.apache.kafka.common.Endpoint,? extends CompletionStage<Void>> start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo)
start
in interface org.apache.kafka.server.authorizer.Authorizer
public List<org.apache.kafka.server.authorizer.AuthorizationResult> authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.server.authorizer.Action> actions)
authorize
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings, Optional<String> aclClusterId)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters, Optional<String> aclClusterId)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public Iterable<org.apache.kafka.common.acl.AclBinding> acls(org.apache.kafka.common.acl.AclBindingFilter filter)
acls
in interface org.apache.kafka.server.authorizer.Authorizer
public Runnable migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer)
migrationTask
in interface io.confluent.security.authorizer.AclMigrationAware
protected void setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics)