Class S2SConnectionLevelAuthZProvider

java.lang.Object

io.confluent.security.auth.s2s.S2SConnectionLevelAuthZProvider

All Implemented Interfaces:

io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.Provider, Closeable, AutoCloseable, org.apache.kafka.common.Configurable, org.apache.kafka.common.Reconfigurable

public class S2SConnectionLevelAuthZProvider
extends Object
implements io.confluent.security.authorizer.provider.AccessRuleProvider, org.apache.kafka.common.Reconfigurable

L2 connection-level S2S AuthZ GATE: evaluates the calling service's SPIRE-mTLS cert SPIFFE-ID against the L2 Cedar policy category and emits a S2SDenyRule on a veto. Never grants -- see S2SConnectionLevelDecisionSource for the deny-overlay semantics.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROVIDER_NAME

Constructor Summary

Constructors

Constructor	Description
S2SConnectionLevelAuthZProvider()

Method Summary

Modifier and Type	Method	Description
void	addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.roledefinitions.Operation operation, io.confluent.security.authorizer.Scope resourceScope, io.confluent.security.roledefinitions.ResourceType resourceType)
void	close()
void	configure(Map<String,?> configs)	Runs once at provider construction.
io.confluent.security.authorizer.provider.AuthorizeRule	findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
boolean	isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
boolean	mayDeny()
String	providerName()
Set<String>	reconfigurableConfigs()
void	reconfigure(Map<String,?> configs)
CompletionStage<Void>	start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo)	Invoked once by the authorizer framework after configure(Map) and after all providers have been instantiated.
boolean	usesMetadataFromThisKafkaCluster()
void	validateReconfiguration(Map<String,?> configs)

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.confluent.security.authorizer.provider.AccessRuleProvider

asAuthorizer

Field Details

PROVIDER_NAME

public static final String PROVIDER_NAME

See Also:

• Constant Field Values

Constructor Details

S2SConnectionLevelAuthZProvider

public S2SConnectionLevelAuthZProvider()

Method Details

configure

public void configure(Map<String,?> configs)

Runs once at provider construction. Builds the store + source and loads the initial policy snapshot. A malformed initial bundle throws ConfigException out of policyStore.configure() here (fail-closed) and propagates to fail broker startup, rather than silently coming up with no L2 enforcement. SRJ handoff is deferred to start(ConfluentAuthorizerServerInfo).

Specified by:

configure in interface org.apache.kafka.common.Configurable

start

public CompletionStage<Void> start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo)

Invoked once by the authorizer framework after configure(Map) and after all providers have been instantiated. Hands the policy snapshot to SRJ for parse + validate.

Specified by:

start in interface io.confluent.security.authorizer.provider.Provider

isSuperUser

public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal,
 io.confluent.security.authorizer.Scope scope)

Specified by:

isSuperUser in interface io.confluent.security.authorizer.provider.AccessRuleProvider

findRule

public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
 Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
 String host,
 io.confluent.security.authorizer.Action action)

Specified by:

findRule in interface io.confluent.security.authorizer.provider.AccessRuleProvider

addMatchingRules

public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules,
 org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
 Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
 String host,
 io.confluent.security.roledefinitions.Operation operation,
 io.confluent.security.authorizer.Scope resourceScope,
 io.confluent.security.roledefinitions.ResourceType resourceType)

Specified by:

addMatchingRules in interface io.confluent.security.authorizer.provider.AccessRuleProvider

reconfigurableConfigs

public Set<String> reconfigurableConfigs()

Specified by:

reconfigurableConfigs in interface org.apache.kafka.common.Reconfigurable

validateReconfiguration

public void validateReconfiguration(Map<String,?> configs)
                             throws org.apache.kafka.common.config.ConfigException

Specified by:

validateReconfiguration in interface org.apache.kafka.common.Reconfigurable

Throws:

org.apache.kafka.common.config.ConfigException

reconfigure

public void reconfigure(Map<String,?> configs)

Specified by:

reconfigure in interface org.apache.kafka.common.Reconfigurable

mayDeny

public boolean mayDeny()

Specified by:

mayDeny in interface io.confluent.security.authorizer.provider.AccessRuleProvider

providerName

public String providerName()

Specified by:

providerName in interface io.confluent.security.authorizer.provider.Provider

usesMetadataFromThisKafkaCluster

public boolean usesMetadataFromThisKafkaCluster()

Specified by:

usesMetadataFromThisKafkaCluster in interface io.confluent.security.authorizer.provider.Provider

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable