public class ConfluentProvider extends Object implements io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.GroupProvider, io.confluent.security.authorizer.provider.MetadataProvider, org.apache.kafka.server.authorizer.Authorizer, org.apache.kafka.common.ClusterResourceListener, io.confluent.security.authorizer.provider.Auditable, io.confluent.security.authorizer.AclMigrationAware, io.confluent.security.authorizer.provider.SharedProvider
Constructor and Description |
---|
ConfluentProvider() |
Modifier and Type | Method and Description |
---|---|
Iterable<org.apache.kafka.common.acl.AclBinding> |
acls(org.apache.kafka.common.acl.AclBindingFilter filter) |
void |
addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules,
org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Operation operation,
io.confluent.security.authorizer.Scope scope,
io.confluent.security.authorizer.ResourceType resourceType) |
Optional<org.apache.kafka.server.authorizer.Authorizer> |
asAuthorizer() |
void |
auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider) |
List<org.apache.kafka.server.authorizer.AuthorizationResult> |
authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.server.authorizer.Action> actions) |
io.confluent.security.auth.metadata.AuthStore |
authStore() |
io.confluent.security.authorizer.Scope |
authStoreScope() |
void |
close() |
void |
configure(Map<String,?> configs) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBinding> aclBindings) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> |
createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBinding> aclBindings,
Optional<String> aclClusterId) |
io.confluent.security.authorizer.EmbeddedAuthorizer |
createRbacAuthorizer() |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters) |
List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> |
deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext,
List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters,
Optional<String> aclClusterId,
org.apache.kafka.common.acl.AclState aclState) |
io.confluent.security.authorizer.provider.AuthorizeRule |
findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
String host,
io.confluent.security.authorizer.Action action) |
Set<org.apache.kafka.common.security.auth.KafkaPrincipal> |
groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal) |
boolean |
isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
io.confluent.security.authorizer.Scope scope) |
boolean |
mayDeny() |
Runnable |
migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer) |
void |
onUpdate(org.apache.kafka.common.ClusterResource clusterResource) |
boolean |
providerConfigured(Map<String,?> configs)
Brokers running ConfluentProvider should be either:
- in the metadata cluster, running MDS.
|
String |
providerName() |
void |
setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics) |
Map<org.apache.kafka.common.Endpoint,? extends CompletionStage<Void>> |
start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo) |
CompletionStage<Void> |
start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo,
Map<String,?> interBrokerListenerConfigs)
Starts the RBAC provider.
|
boolean |
usesMetadataFromThisKafkaCluster()
Returns true if this broker or controller is running in Metadata service cluster
as indicated by
MetadataServerConfig.METADATA_SERVER_CONTROLLER_KRAFT_ENABLED_PROP |
public void onUpdate(org.apache.kafka.common.ClusterResource clusterResource)
onUpdate
in interface org.apache.kafka.common.ClusterResourceListener
public void configure(Map<String,?> configs)
configure
in interface org.apache.kafka.common.Configurable
public io.confluent.security.authorizer.Scope authStoreScope()
public String providerName()
providerName
in interface io.confluent.security.authorizer.provider.Provider
public boolean providerConfigured(Map<String,?> configs)
providerConfigured
in interface io.confluent.security.authorizer.provider.GroupProvider
providerConfigured
in interface io.confluent.security.authorizer.provider.MetadataProvider
public CompletionStage<Void> start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo, Map<String,?> interBrokerListenerConfigs)
On brokers running metadata service, the start up sequence is:
MDS brokers complete the provider's start future only when both service future and reader future have completed. If either fails, broker start up is terminated.
start
in interface io.confluent.security.authorizer.provider.Provider
public boolean mayDeny()
mayDeny
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public boolean usesMetadataFromThisKafkaCluster()
MetadataServerConfig.METADATA_SERVER_CONTROLLER_KRAFT_ENABLED_PROP
usesMetadataFromThisKafkaCluster
in interface io.confluent.security.authorizer.provider.Provider
public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
isSuperUser
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
findRule
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Operation operation, io.confluent.security.authorizer.Scope scope, io.confluent.security.authorizer.ResourceType resourceType)
addMatchingRules
in interface io.confluent.security.authorizer.provider.AccessRuleProvider
public Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)
groups
in interface io.confluent.security.authorizer.provider.GroupProvider
public void close()
close
in interface Closeable
close
in interface AutoCloseable
public void auditLogProvider(org.apache.kafka.server.audit.AuditLogProvider auditLogProvider)
auditLogProvider
in interface io.confluent.security.authorizer.provider.Auditable
public io.confluent.security.auth.metadata.AuthStore authStore()
public io.confluent.security.authorizer.EmbeddedAuthorizer createRbacAuthorizer()
public Map<org.apache.kafka.common.Endpoint,? extends CompletionStage<Void>> start(org.apache.kafka.server.authorizer.AuthorizerServerInfo serverInfo)
start
in interface org.apache.kafka.server.authorizer.Authorizer
public List<org.apache.kafka.server.authorizer.AuthorizationResult> authorize(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.server.authorizer.Action> actions)
authorize
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings, Optional<String> aclClusterId)
createAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters, Optional<String> aclClusterId, org.apache.kafka.common.acl.AclState aclState)
deleteAcls
in interface org.apache.kafka.server.authorizer.Authorizer
public Iterable<org.apache.kafka.common.acl.AclBinding> acls(org.apache.kafka.common.acl.AclBindingFilter filter)
acls
in interface org.apache.kafka.server.authorizer.Authorizer
public Runnable migrationTask(org.apache.kafka.server.authorizer.Authorizer sourceAuthorizer)
migrationTask
in interface io.confluent.security.authorizer.AclMigrationAware
public void setKafkaMetrics(org.apache.kafka.common.metrics.Metrics metrics)
public Optional<org.apache.kafka.server.authorizer.Authorizer> asAuthorizer()
asAuthorizer
in interface io.confluent.security.authorizer.provider.AccessRuleProvider