All Classes and Interfaces
Class
Description
Cache containing authorization and authentication metadata.
Cross-component embedded authorizer that implements common authorization logic.
This holds metadata passed from CCloud related to this physical cluster
These util methods are used in KafkaAuthWriter and DbAuthWriter (metadata-service repo)
projects
In-memory snapshot of the two-category Cedar policy bundle,
{"L2": {policyId -> cedar}, "L3": {policyId -> cedar}}, loaded from
the broker config key ConfluentConfigs.S2S_AUTHZ_POLICIES.RBAC provider for CPC (Confluent Private Cloud).
Default implementation of
MTlsTruststoreManager that manages CA certificates in a truststore file.ErrorHandlingJsonSerde that catches exceptions while deserializing key/value of the
records and returns the value as per the user provided handleDeserializationExceptionFunction
This class is a dry run implementation of the IpFilteringProvider.
Input passed to
S2SDecisionSource.evaluate(EvaluationInput).Interface for managing metadata from an external store, for example an LDAP server.
Listener for entries from an external store, for example an LDAP server.
Metrics for IP Filtering authorization rule evaluation, modeled on
EmbeddedAuthorizer.AuthorizerMetrics.Writer that initiates updates to metadata.
Writer for one metadata topic partition that encapsulates all the state associated with
the partition including master writer generation.
LDAP authentication callback handler that can be used for simple username/password
authentication.
Node manager for Metadata Service.
Coordinator for the Metadata Service used to track active nodes
and elect master writer.
Rebalance listener implemented by the writer manager.
Represents logical cluster metadata
Password verifier for comparing passwords during authentication.
Per-layer S2S AuthZ decision metric:
s2s-authz-checks-rate, tagged layer
(L2/L3b), outcome (allow/deny/continue/abstain), and tokenType.L2 connection-level S2S AuthZ GATE: evaluates the calling service's SPIRE-mTLS cert SPIFFE-ID
against the
L2 Cedar policy category and emits a S2SDenyRule on a veto.SRJ Cedar integration point for the L2 connection-level AuthZ provider.
Pluggable decision source for the S2S AuthZ provider.
Outcome of
S2SDecisionSource.evaluate(EvaluationInput), widened beyond the tri-state S2SDecisionSource.Decision with the
diagnostic detail the observability layer needs: an outcome label (one of
allow/deny/continue/abstain, layer-specific — see
S2SConnectionLevelDecisionSource / S2SServiceLevelDecisionSource), and the
SRJ Decision's determining policy IDs
(reasons) and passName, when the underlying SRJ authorizer actually ran
(both are empty when no authorizer is installed, i.e.DENY-only rule carrying the SPIFFE-ID that triggered the denial.
ALLOW-only rule carrying the system-LAT
sub SPIFFE-ID that earned the grant.L3b — the service-level AuthZ VERDICT, dispatched by
EmbeddedAuthorizer as the sole
verdict for any request whose principal carries a system LAT (tokenType ==
SYSTEM_LOGICAL_ACCESS_TOKEN), in place of the traditional RBAC/ACL chain.SRJ Cedar integration point for the L3b service-level AuthZ provider.
AccessRuleStore to be used only for CP RBAC.
AccessRuleStore to be used only for Cloud RBAC.
Interface to listener for failure status of KafkaStore readers and writers