public class DataplaneAuthWriter extends Object implements AuthWriter, io.confluent.security.trustservice.store.TrustWriter, Writer, Closeable
Constructor and Description |
---|
DataplaneAuthWriter() |
Modifier and Type | Method and Description |
---|---|
CompletionStage<Void> |
addClusterRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal,
String role,
io.confluent.security.authorizer.Scope scope,
String reason)
Adds a new cluster-level role binding without any resources.
|
CompletionStage<Void> |
addIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
int version,
String issuer,
String subjectClaim,
String serviceAccount,
String policy,
String orgId,
String reason) |
CompletionStage<Void> |
addJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
org.jose4j.jwk.JsonWebKeySet jwks,
String reason) |
CompletionStage<Void> |
addResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePattern> resources,
String reason)
Adds resources to a role binding.
|
void |
close() |
CompletionStage<Void> |
createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBinding aclBinding)
Creates ACL rules for a given AclBinding.
|
Map<org.apache.kafka.common.acl.AclBinding,CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
io.confluent.security.authorizer.Scope scope,
List<org.apache.kafka.common.acl.AclBinding> aclBindings)
Creates ACLs for the specified scope using the minimal number of batched updates.
|
CompletionStage<Collection<org.apache.kafka.common.acl.AclBinding>> |
deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBindingFilter aclBindingFilter,
Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
Deletes all ACL rules that match the provided filters.
|
Map<org.apache.kafka.common.acl.AclBindingFilter,CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
io.confluent.security.authorizer.Scope scope,
List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters,
Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
Deletes ACLs that match any of the provided filters using batched update.
|
boolean |
ready()
Returns true if this is the master writer and is ready to process requests
|
CompletionStage<Void> |
removeIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
String reason) |
CompletionStage<Void> |
removeJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
String reason) |
CompletionStage<Void> |
removeResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePatternFilter> patternFilters,
String reason)
Removes resources from an existing role binding.
|
CompletionStage<Void> |
removeRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal,
String role,
io.confluent.security.authorizer.Scope scope,
String reason)
Removes a role binding.
|
CompletionStage<Void> |
replaceIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
int version,
String issuer,
String subjectClaim,
String serviceAccount,
String policy,
String orgId,
String reason) |
CompletionStage<Void> |
replaceJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
org.jose4j.jwk.JsonWebKeySet jwks,
String reason) |
CompletionStage<Void> |
replaceResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePattern> resources,
String reason)
Sets resources for an existing role binding.
|
void |
startWriter(int i)
Starts master writer with the specified generation id.
|
void |
stopWriter(Integer integer)
Stops this writer because a new master writer was elected.
|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
addClusterRoleBinding, addResourceRoleBinding, createAcls, createAcls, deleteAcls, deleteAcls, removeResourceRoleBinding, removeRoleBinding, replaceResourceRoleBinding
public CompletionStage<Void> addClusterRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal, String role, io.confluent.security.authorizer.Scope scope, String reason)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
addClusterRoleBinding
in interface AuthWriter
callingPrincipal
- Optional principal of the requestortargetPrincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignedpublic CompletionStage<Void> removeRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal, String role, io.confluent.security.authorizer.Scope scope, String reason)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
removeRoleBinding
in interface AuthWriter
callingPrincipal
- Optional principal of the requestortargetPrincipal
- User or group principal from which role is removedrole
- Name of rolescope
- Scope at which role is assignedpublic CompletionStage<Void> addResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePattern> resources, String reason)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
addResourceRoleBinding
in interface AuthWriter
callingPrincipal
- Optional principal of the requestortargetPrincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignedresources
- Resources to add to role bindingpublic CompletionStage<Void> removeResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePatternFilter> patternFilters, String reason)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
removeResourceRoleBinding
in interface AuthWriter
callingPrincipal
- Optional principal of the requestortargetPrincipal
- User or group principal from which role is removedrole
- Name of rolescope
- Scope at which role is assignedpatternFilters
- Filter for resources being removed for the role bindingpublic CompletionStage<Void> replaceResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal targetPrincipal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePattern> resources, String reason)
AuthWriter
Requestor should have Alter permission for SecurityMetadata to perform this operation.
replaceResourceRoleBinding
in interface AuthWriter
callingPrincipal
- Optional principal of the requestortargetPrincipal
- User or group principal to which role is assignedrole
- Name of rolescope
- Scope at which role is assignedresources
- Updated collection of resources for the role bindingpublic CompletionStage<Void> addJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, org.jose4j.jwk.JsonWebKeySet jwks, String reason)
addJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> removeJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, String reason)
removeJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> replaceJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, org.jose4j.jwk.JsonWebKeySet jwks, String reason)
replaceJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> addIdentityPool(Optional<Principal> requesterPrincipal, String poolId, int version, String issuer, String subjectClaim, String serviceAccount, String policy, String orgId, String reason)
addIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> removeIdentityPool(Optional<Principal> requesterPrincipal, String poolId, String reason)
removeIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> replaceIdentityPool(Optional<Principal> requesterPrincipal, String poolId, int version, String issuer, String subjectClaim, String serviceAccount, String policy, String orgId, String reason)
replaceIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBinding aclBinding)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
createAcls
in interface AuthWriter
callingPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedaclBinding
- AclBinding to addpublic Map<org.apache.kafka.common.acl.AclBinding,CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, io.confluent.security.authorizer.Scope scope, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
createAcls
in interface AuthWriter
callingPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedaclBindings
- List of ACLs to createpublic CompletionStage<Collection<org.apache.kafka.common.acl.AclBinding>> deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBindingFilter aclBindingFilter, Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
AuthWriter
Requestor should have AlterAccess permission for the specified resources to perform this operation.
deleteAcls
in interface AuthWriter
callingPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are deletedaclBindingFilter
- AclBindingFilter to match the rulesresourceAccess
- predicate to check delete permission on resourcespublic Map<org.apache.kafka.common.acl.AclBindingFilter,CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> callingPrincipal, io.confluent.security.authorizer.Scope scope, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters, Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
AuthWriter
deleteAcls
in interface AuthWriter
callingPrincipal
- Optional principal of the requestorscope
- Scope at which ACL bindings are addedaclBindingFilters
- Filters whose matching ACLs are deletedresourceAccess
- predicate to check delete permission on resourcespublic void startWriter(int i)
Writer
MetadataServiceCoordinator
during writer election.startWriter
in interface Writer
i
- Generation id of writerpublic void stopWriter(Integer integer)
Writer
stopWriter
in interface Writer
integer
- Generation id of writer being stopped or null to stop regardless of
current writer generationpublic boolean ready()
Writer
public void close()
close
in interface Closeable
close
in interface AutoCloseable