public class DefaultAuthCache extends Object implements AuthCache, io.confluent.security.trustservice.store.TrustCache, KeyValueStore<AuthKey,AuthValue>
AuthCache.Result
Modifier and Type | Field and Description |
---|---|
protected Map<io.confluent.security.authorizer.Scope,Map<org.apache.kafka.common.security.auth.KafkaPrincipal,NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>>>> |
rbacAccessRules |
protected io.confluent.security.authorizer.Scope |
rootScope |
Constructor and Description |
---|
DefaultAuthCache(io.confluent.security.rbac.RbacRoles rbacRoles,
io.confluent.security.authorizer.Scope rootScope) |
Modifier and Type | Method and Description |
---|---|
Collection<org.apache.kafka.common.acl.AclBinding> |
aclBindings(io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBindingFilter aclBindingFilter,
Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
Returns ACL bindings which match the provided filter.
|
Map<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>> |
aclRules(io.confluent.security.authorizer.Scope scope)
Returns the ACL rules for all resources of given scope
|
void |
addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules,
org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Operation operation,
io.confluent.security.authorizer.Scope resourceScope,
io.confluent.security.authorizer.ResourceType resourceType)
Adds RBAC or ACL rules for the specified principals that match the provided parameters
to `matchingRules`.
|
protected void |
ensureNotFailed() |
void |
fail(int partition,
String errorMessage)
Sets local error for the store with the specified error message.
|
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Action action)
Returns RBAC or ACL rule that matches the specified action.
|
AuthValue |
get(AuthKey key)
Returns the current value associated with key if it exists or null otherwise.
|
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> |
groups(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal)
Returns the groups of the provided user principal.
|
AuthCache.Result |
healthcheck()
health check method which returns the health of the underlying auth store
|
io.confluent.security.trustservice.store.data.IdentityPool |
identityPool(String poolId) |
Map<String,io.confluent.security.trustservice.store.data.IdentityPool> |
identityPools() |
org.jose4j.jwk.JsonWebKeySet |
jsonWebKeySet(String jwtIssuer) |
Map<String,org.jose4j.jwk.JsonWebKeySet> |
jsonWebKeySets() |
Set<io.confluent.security.authorizer.Scope> |
knownScopes()
Returns all Scopes known by the backend, regardless of whether or not they actually exist.
|
Map<? extends AuthKey,? extends AuthValue> |
map(String type) |
protected NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>> |
principalRules(io.confluent.security.authorizer.Scope scope,
Map<io.confluent.security.authorizer.Scope,Map<org.apache.kafka.common.security.auth.KafkaPrincipal,NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>>>> accessRules,
org.apache.kafka.common.security.auth.KafkaPrincipal principal) |
AuthValue |
put(AuthKey key,
AuthValue value)
Updates the entry for key with the specified value.
|
Set<io.confluent.security.rbac.RoleBinding> |
rbacRoleBindings(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
Returns role bindings for the given principal and the principals groups across all
known scopes.
|
Set<io.confluent.security.rbac.RoleBinding> |
rbacRoleBindings(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
Set<io.confluent.security.authorizer.Scope> scopes)
Returns role bindings for the given principal and the principals groups limited to the
defined set of Scopes.
|
Set<io.confluent.security.rbac.RoleBinding> |
rbacRoleBindings(io.confluent.security.rbac.RoleBindingFilter filter)
Returns role bindings that match the specified filter.
|
Set<io.confluent.security.rbac.RoleBinding> |
rbacRoleBindings(io.confluent.security.authorizer.Scope scope)
Returns the role bindings at the specified scope.
|
Set<io.confluent.security.rbac.RoleBinding> |
rbacRoleBindings(Set<io.confluent.security.authorizer.Scope> scopes)
Returns all the role bindings from a set of scopes.
|
io.confluent.security.rbac.RbacRoles |
rbacRoles()
Returns the RBAC role definitions associated with this cache.
|
AuthValue |
remove(AuthKey key)
Removes the entry corresponding to the key if it is present in the store.
|
io.confluent.security.authorizer.Scope |
rootScope()
Returns the root scope of this cache.
|
MetadataStoreStatus |
status(int partition)
Status of the metadata store for the specified partition
|
long |
totalAclAccessRules() |
long |
totalIdentityPools() |
int |
totalJwtIssuers() |
long |
totalRbacAccessRules() |
int |
totalRoleBindings() |
io.confluent.security.rbac.UserMetadata |
userMetadata(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal)
Returns metadata for the specified user principal if available or null if user is not known.
|
Map<org.apache.kafka.common.security.auth.KafkaPrincipal,io.confluent.security.rbac.UserMetadata> |
users()
Returns user metadata for all users.
|
protected final io.confluent.security.authorizer.Scope rootScope
protected final Map<io.confluent.security.authorizer.Scope,Map<org.apache.kafka.common.security.auth.KafkaPrincipal,NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>>>> rbacAccessRules
public DefaultAuthCache(io.confluent.security.rbac.RbacRoles rbacRoles, io.confluent.security.authorizer.Scope rootScope)
public Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal)
public Set<io.confluent.security.rbac.RoleBinding> rbacRoleBindings(io.confluent.security.authorizer.Scope scope)
AuthCache
rbacRoleBindings
in interface AuthCache
scope
- Scope for which role bindings are requested.public Set<io.confluent.security.rbac.RoleBinding> rbacRoleBindings(Set<io.confluent.security.authorizer.Scope> scopes)
AuthCache
rbacRoleBindings
in interface AuthCache
scopes
- Scopes for which role bindings are requested.public Set<io.confluent.security.rbac.RoleBinding> rbacRoleBindings(io.confluent.security.rbac.RoleBindingFilter filter)
AuthCache
rbacRoleBindings
in interface AuthCache
filter
- The filter used for matching role bindingspublic Set<io.confluent.security.rbac.RoleBinding> rbacRoleBindings(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
AuthCache
rbacRoleBindings
in interface AuthCache
principal
- The the principal to lookup rolebindings forpublic Set<io.confluent.security.rbac.RoleBinding> rbacRoleBindings(org.apache.kafka.common.security.auth.KafkaPrincipal principal, Set<io.confluent.security.authorizer.Scope> scopes)
AuthCache
rbacRoleBindings
in interface AuthCache
principal
- The the principal to lookup rolebindings forpublic Map<String,org.jose4j.jwk.JsonWebKeySet> jsonWebKeySets()
jsonWebKeySets
in interface io.confluent.security.trustservice.store.TrustCache
public org.jose4j.jwk.JsonWebKeySet jsonWebKeySet(String jwtIssuer)
jsonWebKeySet
in interface io.confluent.security.trustservice.store.TrustCache
public io.confluent.security.trustservice.store.data.IdentityPool identityPool(String poolId)
identityPool
in interface io.confluent.security.trustservice.store.TrustCache
public Map<String,io.confluent.security.trustservice.store.data.IdentityPool> identityPools()
identityPools
in interface io.confluent.security.trustservice.store.TrustCache
public io.confluent.security.rbac.UserMetadata userMetadata(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal)
AuthCache
userMetadata
in interface AuthCache
userPrincipal
- KafkaPrincipal of userpublic Map<org.apache.kafka.common.security.auth.KafkaPrincipal,io.confluent.security.rbac.UserMetadata> users()
AuthCache
public Set<io.confluent.security.authorizer.Scope> knownScopes()
AuthCache
knownScopes
in interface AuthCache
Scopes
known by this AuthCachepublic io.confluent.security.authorizer.Scope rootScope()
AuthCache
public io.confluent.security.rbac.RbacRoles rbacRoles()
AuthCache
public Map<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>> aclRules(io.confluent.security.authorizer.Scope scope)
AuthCache
public Collection<org.apache.kafka.common.acl.AclBinding> aclBindings(io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBindingFilter aclBindingFilter, Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
AuthCache
aclBindings
in interface AuthCache
scope
- Scope of the acl search.aclBindingFilter
- AclBindingFilter to matchresourceAccess
- predicate to check resource access permissionpublic io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
AuthCache
public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Operation operation, io.confluent.security.authorizer.Scope resourceScope, io.confluent.security.authorizer.ResourceType resourceType)
AuthCache
addMatchingRules
in interface AuthCache
public AuthCache.Result healthcheck()
AuthCache
healthcheck
in interface AuthCache
public AuthValue get(AuthKey key)
KeyValueStore
get
in interface KeyValueStore<AuthKey,AuthValue>
public AuthValue put(AuthKey key, AuthValue value)
KeyValueStore
put
in interface KeyValueStore<AuthKey,AuthValue>
public AuthValue remove(AuthKey key)
KeyValueStore
remove
in interface KeyValueStore<AuthKey,AuthValue>
public Map<? extends AuthKey,? extends AuthValue> map(String type)
map
in interface KeyValueStore<AuthKey,AuthValue>
public void fail(int partition, String errorMessage)
KeyValueStore
fail
in interface KeyValueStore<AuthKey,AuthValue>
public MetadataStoreStatus status(int partition)
KeyValueStore
status
in interface KeyValueStore<AuthKey,AuthValue>
public int totalRoleBindings()
public long totalRbacAccessRules()
public long totalAclAccessRules()
public int totalJwtIssuers()
public long totalIdentityPools()
protected void ensureNotFailed()
protected NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>> principalRules(io.confluent.security.authorizer.Scope scope, Map<io.confluent.security.authorizer.Scope,Map<org.apache.kafka.common.security.auth.KafkaPrincipal,NavigableMap<io.confluent.security.authorizer.ResourcePattern,Set<io.confluent.security.authorizer.AccessRule>>>> accessRules, org.apache.kafka.common.security.auth.KafkaPrincipal principal)