public class KafkaAuthWriter extends Object implements Writer, io.confluent.security.auth.metadata.AuthWriter, io.confluent.security.trustservice.store.TrustWriter, ConsumerListener<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue>
Constructor and Description |
---|
KafkaAuthWriter(String topic,
int numPartitions,
KafkaStoreConfig config,
org.apache.kafka.clients.producer.Producer<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> producer,
Supplier<org.apache.kafka.clients.admin.AdminClient> adminClientSupplier,
AbstractAuthCache authCache,
StatusListener statusListener,
CompletableFuture<Void> existingRecordsFuture,
org.apache.kafka.common.utils.Time time) |
Modifier and Type | Method and Description |
---|---|
CompletionStage<Void> |
addClusterRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
String role,
io.confluent.security.authorizer.Scope scope,
String reason) |
CompletionStage<Void> |
addIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
int version,
String issuer,
String subjectClaim,
String serviceAccount,
String policy,
String orgId,
String reason) |
CompletionStage<Void> |
addJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
org.jose4j.jwk.JsonWebKeySet jwks,
String reason) |
CompletionStage<Void> |
addResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePattern> newResources,
String reason) |
void |
close(Duration closeTimeout) |
CompletionStage<Void> |
createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBinding aclBinding) |
Map<org.apache.kafka.common.acl.AclBinding,CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
List<org.apache.kafka.common.acl.AclBinding> aclBindings) |
protected LdapStore |
createLdapStore(Map<String,?> configs,
AbstractAuthCache authCache) |
CompletionStage<Collection<org.apache.kafka.common.acl.AclBinding>> |
deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
org.apache.kafka.common.acl.AclBindingFilter filter,
Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess) |
Map<org.apache.kafka.common.acl.AclBindingFilter,CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
io.confluent.security.authorizer.Scope scope,
List<org.apache.kafka.common.acl.AclBindingFilter> filters,
Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess) |
org.apache.kafka.common.acl.AclBinding |
normalizeAcl(org.apache.kafka.common.acl.AclBinding acl) |
Collection<io.confluent.security.authorizer.acl.AclRule> |
normalizeAcls(Collection<io.confluent.security.authorizer.acl.AclRule> acls) |
void |
onConsumerRecord(org.apache.kafka.clients.consumer.ConsumerRecord<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> record,
io.confluent.security.auth.store.data.AuthValue oldValue)
Notification of new record consumed by local reader
|
KafkaPartitionWriter<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> |
partitionWriter(int partition) |
boolean |
ready()
Returns true if this is the master writer and is ready to process requests
|
CompletionStage<Void> |
removeIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
String reason) |
CompletionStage<Void> |
removeJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
String reason) |
CompletionStage<Void> |
removeResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePatternFilter> deletedResources,
String reason) |
CompletionStage<Void> |
removeRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
String role,
io.confluent.security.authorizer.Scope scope,
String reason) |
CompletionStage<Void> |
replaceIdentityPool(Optional<Principal> requesterPrincipal,
String poolId,
int version,
String issuer,
String subjectClaim,
String serviceAccount,
String policy,
String orgId,
String reason) |
CompletionStage<Void> |
replaceJwtIssuer(Optional<Principal> requesterPrincipal,
String jwtIssuer,
org.jose4j.jwk.JsonWebKeySet jwks,
String reason) |
CompletionStage<Void> |
replaceResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal,
org.apache.kafka.common.security.auth.KafkaPrincipal principal,
String role,
io.confluent.security.authorizer.Scope scope,
Collection<io.confluent.security.authorizer.ResourcePattern> resources,
String reason) |
void |
startWriter(int generationId)
Starts master writer with the specified generation id.
|
void |
stopWriter(Integer generationId)
Stops this writer because a new master writer was elected.
|
void |
writeExternalEntry(io.confluent.security.auth.store.data.AuthKey key,
io.confluent.security.auth.store.data.AuthValue value,
int expectedGenerationId)
Writes an external metadata entry into the partition corresponding to the provided key.
|
void |
writeExternalStatus(io.confluent.security.store.MetadataStoreStatus status,
String errorMessage,
int generationId) |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
public KafkaAuthWriter(String topic, int numPartitions, KafkaStoreConfig config, org.apache.kafka.clients.producer.Producer<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> producer, Supplier<org.apache.kafka.clients.admin.AdminClient> adminClientSupplier, AbstractAuthCache authCache, StatusListener statusListener, CompletableFuture<Void> existingRecordsFuture, org.apache.kafka.common.utils.Time time)
public void startWriter(int generationId)
Writer
MetadataServiceCoordinator
during writer election.startWriter
in interface Writer
generationId
- Generation id of writerpublic void stopWriter(Integer generationId)
Writer
stopWriter
in interface Writer
generationId
- Generation id of writer being stopped or null to stop regardless of
current writer generationpublic boolean ready()
Writer
public CompletionStage<Void> addClusterRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, String role, io.confluent.security.authorizer.Scope scope, String reason)
addClusterRoleBinding
in interface io.confluent.security.auth.metadata.AuthWriter
public CompletionStage<Void> addResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePattern> newResources, String reason)
addResourceRoleBinding
in interface io.confluent.security.auth.metadata.AuthWriter
public CompletionStage<Void> replaceResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePattern> resources, String reason)
replaceResourceRoleBinding
in interface io.confluent.security.auth.metadata.AuthWriter
public CompletionStage<Void> removeRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, String role, io.confluent.security.authorizer.Scope scope, String reason)
removeRoleBinding
in interface io.confluent.security.auth.metadata.AuthWriter
public CompletionStage<Void> removeResourceRoleBinding(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal principal, String role, io.confluent.security.authorizer.Scope scope, Collection<io.confluent.security.authorizer.ResourcePatternFilter> deletedResources, String reason)
removeResourceRoleBinding
in interface io.confluent.security.auth.metadata.AuthWriter
public CompletionStage<Void> addJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, org.jose4j.jwk.JsonWebKeySet jwks, String reason)
addJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> removeJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, String reason)
removeJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> replaceJwtIssuer(Optional<Principal> requesterPrincipal, String jwtIssuer, org.jose4j.jwk.JsonWebKeySet jwks, String reason)
replaceJwtIssuer
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> addIdentityPool(Optional<Principal> requesterPrincipal, String poolId, int version, String issuer, String subjectClaim, String serviceAccount, String policy, String orgId, String reason)
addIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> removeIdentityPool(Optional<Principal> requesterPrincipal, String poolId, String reason)
removeIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> replaceIdentityPool(Optional<Principal> requesterPrincipal, String poolId, int version, String issuer, String subjectClaim, String serviceAccount, String policy, String orgId, String reason)
replaceIdentityPool
in interface io.confluent.security.trustservice.store.TrustWriter
public CompletionStage<Void> createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBinding aclBinding)
createAcls
in interface io.confluent.security.auth.metadata.AuthWriter
public Map<org.apache.kafka.common.acl.AclBinding,CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
createAcls
in interface io.confluent.security.auth.metadata.AuthWriter
public org.apache.kafka.common.acl.AclBinding normalizeAcl(org.apache.kafka.common.acl.AclBinding acl)
public Collection<io.confluent.security.authorizer.acl.AclRule> normalizeAcls(Collection<io.confluent.security.authorizer.acl.AclRule> acls)
public CompletionStage<Collection<org.apache.kafka.common.acl.AclBinding>> deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, org.apache.kafka.common.acl.AclBindingFilter filter, Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
deleteAcls
in interface io.confluent.security.auth.metadata.AuthWriter
public Map<org.apache.kafka.common.acl.AclBindingFilter,CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(Optional<org.apache.kafka.common.security.auth.KafkaPrincipal> requestorPrincipal, io.confluent.security.authorizer.Scope scope, List<org.apache.kafka.common.acl.AclBindingFilter> filters, Predicate<io.confluent.security.authorizer.ResourcePattern> resourceAccess)
deleteAcls
in interface io.confluent.security.auth.metadata.AuthWriter
public void close(Duration closeTimeout)
public void onConsumerRecord(org.apache.kafka.clients.consumer.ConsumerRecord<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> record, io.confluent.security.auth.store.data.AuthValue oldValue)
ConsumerListener
onConsumerRecord
in interface ConsumerListener<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue>
record
- the record from consumeroldValue
- old value corresponding to record key from local cachepublic void writeExternalEntry(io.confluent.security.auth.store.data.AuthKey key, io.confluent.security.auth.store.data.AuthValue value, int expectedGenerationId)
key
- Key for new recordvalue
- Value for new record, may be null to delete the entryexpectedGenerationId
- Generation id currently associated with the external storepublic void writeExternalStatus(io.confluent.security.store.MetadataStoreStatus status, String errorMessage, int generationId)
public KafkaPartitionWriter<io.confluent.security.auth.store.data.AuthKey,io.confluent.security.auth.store.data.AuthValue> partitionWriter(int partition)
protected LdapStore createLdapStore(Map<String,?> configs, AbstractAuthCache authCache)