Class AccessRule

java.lang.Object
io.confluent.security.authorizer.AccessRule
All Implemented Interfaces:
AuthorizePolicy
Direct Known Subclasses:
AclAccessRule
public abstract class AccessRule extends Object implements AuthorizePolicy
Encapsulates an access rule which may be derived from an ACL or RBAC policy. Operations and resource types are extensible to enable this to be used for authorization in different components.

  • Nested Class Summary

    Nested classes/interfaces inherited from interface io.confluent.security.authorizer.AuthorizePolicy

    AuthorizePolicy.BrokerUser, AuthorizePolicy.NoMatchingRule, AuthorizePolicy.PolicyType, AuthorizePolicy.SuperUser

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ALL_HOSTS
     
    static final String
    GROUP_PRINCIPAL_TYPE
     
    static final org.apache.kafka.common.security.auth.KafkaPrincipal
    WILDCARD_GROUP_PRINCIPAL
     
    static final org.apache.kafka.common.security.auth.KafkaPrincipal
    WILDCARD_USER_PRINCIPAL
     

    Fields inherited from interface io.confluent.security.authorizer.AuthorizePolicy

    ALLOW_ON_NO_RULE, DENY_ON_NO_RULE, NO_MATCHING_RULE

  • Constructor Summary

    Constructors
    Constructor
    Description
    AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType)
     
    AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType, Collection<org.apache.kafka.common.Uuid> clusterLinkIds)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static org.apache.kafka.common.security.auth.KafkaPrincipal
    asBaseKafkaPrincipal(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
     
    Collection<org.apache.kafka.common.Uuid>
    clusterLinkIds()
     
    boolean
    equals(Object o)
     
    int
    hashCode()
     
    String
    host()
     
    boolean
    matches(String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
     
    static boolean
    matches(String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
     
    boolean
    matches(Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
     
    static boolean
    matches(org.apache.kafka.common.security.auth.KafkaPrincipal rulePrincipal, String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
     
    static Set<org.apache.kafka.common.security.auth.KafkaPrincipal>
    matchingPrincipals(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal, Collection<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardUserPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardGroupPrincipal)
     
    io.confluent.security.roledefinitions.Operation
    operation()
     
    io.confluent.security.roledefinitions.PermissionType
    permissionType()
     
    AuthorizePolicy.PolicyType
    policyType()
     
    org.apache.kafka.common.security.auth.KafkaPrincipal
    principal()
     
    ResourcePattern
    resourcePattern()
     
    String
    toString()
     

    Methods inherited from class java.lang.Object

    getClass, notify, notifyAll, wait, wait, wait

  • Field Details

    • ALL_HOSTS

      public static final String ALL_HOSTS
      See Also:

    • WILDCARD_USER_PRINCIPAL

      public static final org.apache.kafka.common.security.auth.KafkaPrincipal WILDCARD_USER_PRINCIPAL

    • GROUP_PRINCIPAL_TYPE

      public static final String GROUP_PRINCIPAL_TYPE
      See Also:

    • WILDCARD_GROUP_PRINCIPAL

      public static final org.apache.kafka.common.security.auth.KafkaPrincipal WILDCARD_GROUP_PRINCIPAL

  • Constructor Details

    • AccessRule

      public AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType)

    • AccessRule

      public AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType, Collection<org.apache.kafka.common.Uuid> clusterLinkIds)

  • Method Details

    • resourcePattern

      public ResourcePattern resourcePattern()

    • principal

      public org.apache.kafka.common.security.auth.KafkaPrincipal principal()

    • permissionType

      public io.confluent.security.roledefinitions.PermissionType permissionType()

    • host

      public String host()

    • operation

      public io.confluent.security.roledefinitions.Operation operation()

    • policyType

      public AuthorizePolicy.PolicyType policyType()
      Specified by:
      policyType in interface AuthorizePolicy

    • clusterLinkIds

      public Collection<org.apache.kafka.common.Uuid> clusterLinkIds()

    • matches

      public boolean matches(Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)

    • matches

      public boolean matches(String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • matchingPrincipals

      public static Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal, Collection<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardUserPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardGroupPrincipal)

    • asBaseKafkaPrincipal

      public static org.apache.kafka.common.security.auth.KafkaPrincipal asBaseKafkaPrincipal(org.apache.kafka.common.security.auth.KafkaPrincipal principal)

    • matches

      public static boolean matches(org.apache.kafka.common.security.auth.KafkaPrincipal rulePrincipal, String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)

    • matches

      public static boolean matches(String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)