Class AccessRule

java.lang.Object

io.confluent.security.authorizer.AccessRule

All Implemented Interfaces:

AuthorizePolicy

Direct Known Subclasses:

AclAccessRule

public abstract class AccessRule
extends Object
implements AuthorizePolicy

Encapsulates an access rule which may be derived from an ACL or RBAC policy. Operations and resource types are extensible to enable this to be used for authorization in different components.

Nested Class Summary

Nested classes/interfaces inherited from interface AuthorizePolicy

AuthorizePolicy.BrokerTypeTopicUser, AuthorizePolicy.BrokerUser, AuthorizePolicy.NoMatchingRule, AuthorizePolicy.PolicyType, AuthorizePolicy.SuperUser

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ALL_HOSTS
static final String	GROUP_PRINCIPAL_TYPE
static final org.apache.kafka.common.security.auth.KafkaPrincipal	WILDCARD_GROUP_PRINCIPAL
static final org.apache.kafka.common.security.auth.KafkaPrincipal	WILDCARD_USER_PRINCIPAL

Fields inherited from interface AuthorizePolicy

ALLOW_ON_NO_RULE, DENY_ON_NO_RULE, NO_MATCHING_RULE

Constructor Summary

Constructors

Constructor	Description
AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType)
AccessRule(ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal principal, io.confluent.security.roledefinitions.PermissionType permissionType, String host, io.confluent.security.roledefinitions.Operation operation, AuthorizePolicy.PolicyType policyType, Collection<org.apache.kafka.common.Uuid> clusterLinkIds)

Method Summary

Modifier and Type	Method	Description
static org.apache.kafka.common.security.auth.KafkaPrincipal	asBaseKafkaPrincipal(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
Collection<org.apache.kafka.common.Uuid>	clusterLinkIds()
boolean	equals(Object o)
int	hashCode()
String	host()
boolean	matches(String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
static boolean	matches(String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
boolean	matches(Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
static boolean	matches(org.apache.kafka.common.security.auth.KafkaPrincipal rulePrincipal, String ruleHost, io.confluent.security.roledefinitions.Operation ruleOperation, io.confluent.security.roledefinitions.PermissionType rulePermissionType, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals, String host, io.confluent.security.roledefinitions.Operation requestedOperation, io.confluent.security.roledefinitions.PermissionType permissionType)
static Set<org.apache.kafka.common.security.auth.KafkaPrincipal>	matchingPrincipals(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal, Collection<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardUserPrincipal, org.apache.kafka.common.security.auth.KafkaPrincipal wildcardGroupPrincipal)
io.confluent.security.roledefinitions.Operation	operation()
io.confluent.security.roledefinitions.PermissionType	permissionType()
AuthorizePolicy.PolicyType	policyType()
org.apache.kafka.common.security.auth.KafkaPrincipal	principal()
ResourcePattern	resourcePattern()
String	toString()

Methods inherited from class Object

getClass, notify, notifyAll, wait, wait, wait

Field Details

ALL_HOSTS

public static final String ALL_HOSTS

See Also:

• Constant Field Values

WILDCARD_USER_PRINCIPAL

public static final org.apache.kafka.common.security.auth.KafkaPrincipal WILDCARD_USER_PRINCIPAL

GROUP_PRINCIPAL_TYPE

public static final String GROUP_PRINCIPAL_TYPE

See Also:

• Constant Field Values

WILDCARD_GROUP_PRINCIPAL

public static final org.apache.kafka.common.security.auth.KafkaPrincipal WILDCARD_GROUP_PRINCIPAL

Constructor Details

AccessRule

public AccessRule(ResourcePattern resourcePattern,
 org.apache.kafka.common.security.auth.KafkaPrincipal principal,
 io.confluent.security.roledefinitions.PermissionType permissionType,
 String host,
 io.confluent.security.roledefinitions.Operation operation,
 AuthorizePolicy.PolicyType policyType)

AccessRule

public AccessRule(ResourcePattern resourcePattern,
 org.apache.kafka.common.security.auth.KafkaPrincipal principal,
 io.confluent.security.roledefinitions.PermissionType permissionType,
 String host,
 io.confluent.security.roledefinitions.Operation operation,
 AuthorizePolicy.PolicyType policyType,
 Collection<org.apache.kafka.common.Uuid> clusterLinkIds)

Method Details

resourcePattern

public ResourcePattern resourcePattern()

principal

public org.apache.kafka.common.security.auth.KafkaPrincipal principal()

permissionType

public io.confluent.security.roledefinitions.PermissionType permissionType()

host

public String host()

operation

public io.confluent.security.roledefinitions.Operation operation()

policyType

public AuthorizePolicy.PolicyType policyType()

Specified by:

policyType in interface AuthorizePolicy

clusterLinkIds

public Collection<org.apache.kafka.common.Uuid> clusterLinkIds()

matches

public boolean matches(Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals,
 String host,
 io.confluent.security.roledefinitions.Operation requestedOperation,
 io.confluent.security.roledefinitions.PermissionType permissionType)

matches

public boolean matches(String host,
 io.confluent.security.roledefinitions.Operation requestedOperation,
 io.confluent.security.roledefinitions.PermissionType permissionType)

equals

public boolean equals(Object o)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object

matchingPrincipals

public static Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals(org.apache.kafka.common.security.auth.KafkaPrincipal userPrincipal,
 Collection<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
 org.apache.kafka.common.security.auth.KafkaPrincipal wildcardUserPrincipal,
 org.apache.kafka.common.security.auth.KafkaPrincipal wildcardGroupPrincipal)

asBaseKafkaPrincipal

public static org.apache.kafka.common.security.auth.KafkaPrincipal asBaseKafkaPrincipal(org.apache.kafka.common.security.auth.KafkaPrincipal principal)

matches

public static boolean matches(org.apache.kafka.common.security.auth.KafkaPrincipal rulePrincipal,
 String ruleHost,
 io.confluent.security.roledefinitions.Operation ruleOperation,
 io.confluent.security.roledefinitions.PermissionType rulePermissionType,
 Set<org.apache.kafka.common.security.auth.KafkaPrincipal> matchingPrincipals,
 String host,
 io.confluent.security.roledefinitions.Operation requestedOperation,
 io.confluent.security.roledefinitions.PermissionType permissionType)

matches

public static boolean matches(String ruleHost,
 io.confluent.security.roledefinitions.Operation ruleOperation,
 io.confluent.security.roledefinitions.PermissionType rulePermissionType,
 String host,
 io.confluent.security.roledefinitions.Operation requestedOperation,
 io.confluent.security.roledefinitions.PermissionType permissionType)