public class DataplaneProvider extends ConfluentProvider
Modifier and Type | Field and Description |
---|---|
static String |
PROVIDER_NAME |
isConfluentCloud
Constructor and Description |
---|
DataplaneProvider() |
Modifier and Type | Method and Description |
---|---|
void |
addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules,
org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Operation operation,
io.confluent.security.authorizer.Scope scope,
io.confluent.security.authorizer.ResourceType resourceType) |
io.confluent.security.authorizer.Scope |
authStoreScope()
Set Scope.ROOT_SCOPE as we can have multiple lkcs in MT Cluster
|
protected io.confluent.security.auth.metadata.AuthStore |
createAuthStore(io.confluent.security.authorizer.Scope rootScope,
org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
Map<String,?> configs) |
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Action action) |
boolean |
mayDeny()
We dont have Deny permissions in RBAC and we don't support Centralized ACLs in CCloud
|
protected List<URL> |
metadataServerAdvertisedListeners()
Currently we don't enable MDS for DataPlane RBAC.
|
boolean |
providerConfigured(Map<String,?> configs)
Brokers running ConfluentProvider should be either:
- in the metadata cluster, running MDS.
|
String |
providerName() |
boolean |
usesMetadataFromThisKafkaCluster()
Returns true if this broker is running the centralized Metadata Service in the embedded
MetadataServer as indicated by
MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP . |
acls, asAuthorizer, auditLogProvider, authorize, authStore, close, configure, createAcls, createAcls, createMdsAdminClient, createRbacAuthorizer, deleteAcls, deleteAcls, groups, isConfluentCloud, isSuperUser, migrationTask, onUpdate, setKafkaMetrics, start, start
public static final String PROVIDER_NAME
public String providerName()
providerName
in interface io.confluent.security.authorizer.provider.Provider
providerName
in class ConfluentProvider
public boolean providerConfigured(Map<String,?> configs)
ConfluentProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.GroupProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.MetadataProvider
providerConfigured
in class ConfluentProvider
public boolean usesMetadataFromThisKafkaCluster()
ConfluentProvider
MetadataServerConfig.METADATA_SERVER_LISTENERS_PROP
.
Otherwise returns false and AuthStore
listens to Metadata Service in another cluster
configured using KafkaStoreConfig.BOOTSTRAP_SERVERS_PROP
.usesMetadataFromThisKafkaCluster
in interface io.confluent.security.authorizer.provider.Provider
usesMetadataFromThisKafkaCluster
in class ConfluentProvider
protected io.confluent.security.auth.metadata.AuthStore createAuthStore(io.confluent.security.authorizer.Scope rootScope, org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, Map<String,?> configs)
createAuthStore
in class ConfluentProvider
protected List<URL> metadataServerAdvertisedListeners()
metadataServerAdvertisedListeners
in class ConfluentProvider
public io.confluent.security.authorizer.Scope authStoreScope()
authStoreScope
in class ConfluentProvider
public boolean mayDeny()
mayDeny
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
mayDeny
in class ConfluentProvider
public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
findRule
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
findRule
in class ConfluentProvider
public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Operation operation, io.confluent.security.authorizer.Scope scope, io.confluent.security.authorizer.ResourceType resourceType)
addMatchingRules
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
addMatchingRules
in class ConfluentProvider