Class S2SServiceLevelAuthZProvider

java.lang.Object
io.confluent.security.auth.s2s.S2SServiceLevelAuthZProvider
All Implemented Interfaces:
io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.Provider, Closeable, AutoCloseable, org.apache.kafka.common.Configurable, org.apache.kafka.common.Reconfigurable
public class S2SServiceLevelAuthZProvider extends Object implements io.confluent.security.authorizer.provider.AccessRuleProvider, org.apache.kafka.common.Reconfigurable
L3b — the service-level AuthZ VERDICT, dispatched by EmbeddedAuthorizer as the sole verdict for any request whose principal carries a system LAT (tokenType == SYSTEM_LOGICAL_ACCESS_TOKEN), in place of the traditional RBAC/ACL chain. Mirrors S2SConnectionLevelAuthZProvider (the L2 GATE) structurally, but plays the opposite SRJ role: L2 can only veto (deny-overlay); L3b can positively grant.

Evaluates the system LAT's sub SPIFFE-ID -- MultiTenantPrincipal.tokenSubSpiffe(), the request originator -- against the L3 Cedar policy category (via S2SServiceLevelDecisionSource), as opposed to L2's cert spiffeId() evaluated against L2 policies.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    PROVIDER_NAME
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    S2SServiceLevelAuthZProvider()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.roledefinitions.Operation operation, io.confluent.security.authorizer.Scope resourceScope, io.confluent.security.roledefinitions.ResourceType resourceType)
     
    void
    close()
     
    void
    configure(Map<String,?> configs)
    Runs once at provider construction.
    io.confluent.security.authorizer.provider.AuthorizeRule
    findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
     
    boolean
    isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
     
    boolean
    mayDeny()
     
    String
    providerName()
     
    Set<String>
    reconfigurableConfigs()
     
    void
    reconfigure(Map<String,?> configs)
     
    CompletionStage<Void>
    start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo)
    Invoked once by the authorizer framework after configure(Map) and after all providers have been instantiated.
    boolean
    usesMetadataFromThisKafkaCluster()
     
    void
    validateReconfiguration(Map<String,?> configs)
     

    Methods inherited from class Object

    equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface io.confluent.security.authorizer.provider.AccessRuleProvider

    asAuthorizer

  • Field Details

  • Constructor Details

    • S2SServiceLevelAuthZProvider

      public S2SServiceLevelAuthZProvider()

  • Method Details

    • configure

      public void configure(Map<String,?> configs)
      Runs once at provider construction. Builds the store + source and loads the initial policy snapshot. A malformed initial bundle throws ConfigException out of policyStore.configure() here (fail-closed) and propagates to fail broker startup, rather than silently coming up denying every system-LAT request. SRJ handoff is deferred to start(ConfluentAuthorizerServerInfo).
      Specified by:
      configure in interface org.apache.kafka.common.Configurable

    • start

      public CompletionStage<Void> start(org.apache.kafka.server.authorizer.internals.ConfluentAuthorizerServerInfo serverInfo)
      Invoked once by the authorizer framework after configure(Map) and after all providers have been instantiated. Hands the policy snapshot to SRJ for parse + validate.
      Specified by:
      start in interface io.confluent.security.authorizer.provider.Provider

    • isSuperUser

      public boolean isSuperUser(org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.authorizer.Scope scope)
      Specified by:
      isSuperUser in interface io.confluent.security.authorizer.provider.AccessRuleProvider

    • findRule

      public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
      Specified by:
      findRule in interface io.confluent.security.authorizer.provider.AccessRuleProvider

    • addMatchingRules

      public void addMatchingRules(io.confluent.security.authorizer.provider.ResourceAuthorizeRules matchingRules, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.roledefinitions.Operation operation, io.confluent.security.authorizer.Scope resourceScope, io.confluent.security.roledefinitions.ResourceType resourceType)
      Specified by:
      addMatchingRules in interface io.confluent.security.authorizer.provider.AccessRuleProvider

    • reconfigurableConfigs

      public Set<String> reconfigurableConfigs()
      Specified by:
      reconfigurableConfigs in interface org.apache.kafka.common.Reconfigurable

    • validateReconfiguration

      public void validateReconfiguration(Map<String,?> configs) throws org.apache.kafka.common.config.ConfigException
      Specified by:
      validateReconfiguration in interface org.apache.kafka.common.Reconfigurable
      Throws:
      org.apache.kafka.common.config.ConfigException

    • reconfigure

      public void reconfigure(Map<String,?> configs)
      Specified by:
      reconfigure in interface org.apache.kafka.common.Reconfigurable

    • mayDeny

      public boolean mayDeny()
      Specified by:
      mayDeny in interface io.confluent.security.authorizer.provider.AccessRuleProvider

    • providerName

      public String providerName()
      Specified by:
      providerName in interface io.confluent.security.authorizer.provider.Provider

    • usesMetadataFromThisKafkaCluster

      public boolean usesMetadataFromThisKafkaCluster()
      Specified by:
      usesMetadataFromThisKafkaCluster in interface io.confluent.security.authorizer.provider.Provider

    • close

      public void close()
      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable