Class CpcAuthorizer

java.lang.Object
io.confluent.security.authorizer.EmbeddedAuthorizer
io.confluent.kafka.security.authorizer.ConfluentServerAuthorizer
io.confluent.kafka.cpc.multitenant.CpcAuthorizer
All Implemented Interfaces:
io.confluent.security.authorizer.Authorizer, Closeable, AutoCloseable, org.apache.kafka.common.Configurable, org.apache.kafka.common.Reconfigurable, org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer, org.apache.kafka.server.authorizer.Authorizer, org.apache.kafka.server.authorizer.ProviderGetter
public class CpcAuthorizer extends ConfluentServerAuthorizer
Simplified tenant-aware authorizer for CPC (Confluent Private Cloud).

Works with CpcPrincipalBuilder which creates MultiTenantPrincipal from SNI hostnames, and the TenantAclProvider (MULTI_TENANT access rule provider) for tenant principal matching.

This is a streamlined version of the cloud MultiTenantAuthorizer, deliberately excluding resource-ID conversion, cluster-link ACL aggregation, and complex metrics. These can be added incrementally as CPC matures.

  • Nested Class Summary

    Nested classes/interfaces inherited from class io.confluent.security.authorizer.EmbeddedAuthorizer

    io.confluent.security.authorizer.EmbeddedAuthorizer.AuthorizerMetrics

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    MAX_ACLS_PER_TENANT_PROP
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    CpcAuthorizer()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    Iterable<org.apache.kafka.common.acl.AclBinding>
    acls(org.apache.kafka.common.acl.AclBindingFilter filter)
     
    void
    applyAclChanges(Map<org.apache.kafka.common.Uuid, Optional<org.apache.kafka.metadata.authorizer.ConfluentStandardAcl>> aclChanges)
     
    io.confluent.security.authorizer.Action
    buildAction(org.apache.kafka.server.authorizer.Action kafkaAction, org.apache.kafka.common.resource.ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, io.confluent.security.authorizer.Scope scope)
     
    Optional<org.apache.kafka.server.authorizer.AuthorizerConfig>
    config()
     
    void
    configure(Map<String,?> configs)
     
    void
    configureAccessRuleProviders(Map<String,Object> configs)
     
    List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>>
    createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
     
    List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>>
    createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings, Optional<String> clusterId)
     
    List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>>
    deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
     
    void
    loadAclSnapshot(Map<org.apache.kafka.common.Uuid, org.apache.kafka.metadata.authorizer.ConfluentStandardAcl> acls)
     

    Methods inherited from class ConfluentServerAuthorizer

    aclCount, aclMutatorOrException, acls, authorize, authorizeByResourceType, completeInitialLoad, completeInitialLoad, configureServerInfo, deleteAcls, reconfigurableConfigs, reconfigure, setAclMutator, start, validateReconfiguration

    Methods inherited from class io.confluent.security.authorizer.EmbeddedAuthorizer

    accessRuleProvider, accessRuleProviders, auditLogProvider, authorize, clearAuthorizerProvidersMap, close, getRbacGroupProvider, groupProvider, metadataProvider, removeFromAuthorizerProvidersMap, start

    Methods inherited from class Object

    equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface io.confluent.security.authorizer.Authorizer

    authorize, authorize, authorize

    Methods inherited from interface org.apache.kafka.server.authorizer.Authorizer

    registerAclUpdateListener

    Methods inherited from interface Closeable

    close

    Methods inherited from interface org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer

    createAcls, createInactiveAcls, hardDeleteAcls, validateCreateAclState, validateDeleteAclState

  • Field Details

  • Constructor Details

    • CpcAuthorizer

      public CpcAuthorizer()

  • Method Details

    • configureAccessRuleProviders

      public void configureAccessRuleProviders(Map<String,Object> configs)

    • configure

      public void configure(Map<String,?> configs)
      Specified by:
      configure in interface org.apache.kafka.common.Configurable
      Overrides:
      configure in class ConfluentServerAuthorizer

    • config

      public Optional<org.apache.kafka.server.authorizer.AuthorizerConfig> config()

    • loadAclSnapshot

      public void loadAclSnapshot(Map<org.apache.kafka.common.Uuid, org.apache.kafka.metadata.authorizer.ConfluentStandardAcl> acls)
      Specified by:
      loadAclSnapshot in interface org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer
      Overrides:
      loadAclSnapshot in class ConfluentServerAuthorizer

    • applyAclChanges

      public void applyAclChanges(Map<org.apache.kafka.common.Uuid, Optional<org.apache.kafka.metadata.authorizer.ConfluentStandardAcl>> aclChanges)
      Specified by:
      applyAclChanges in interface org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer
      Overrides:
      applyAclChanges in class ConfluentServerAuthorizer

    • buildAction

      public io.confluent.security.authorizer.Action buildAction(org.apache.kafka.server.authorizer.Action kafkaAction, org.apache.kafka.common.resource.ResourcePattern resourcePattern, org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, io.confluent.security.authorizer.Scope scope)
      Overrides:
      buildAction in class ConfluentServerAuthorizer

    • createAcls

      public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings)
      Specified by:
      createAcls in interface org.apache.kafka.server.authorizer.Authorizer
      Specified by:
      createAcls in interface org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer
      Overrides:
      createAcls in class ConfluentServerAuthorizer

    • createAcls

      public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclCreateResult>> createAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBinding> aclBindings, Optional<String> clusterId)
      Specified by:
      createAcls in interface org.apache.kafka.server.authorizer.Authorizer
      Overrides:
      createAcls in class ConfluentServerAuthorizer

    • deleteAcls

      public List<? extends CompletionStage<org.apache.kafka.server.authorizer.AclDeleteResult>> deleteAcls(org.apache.kafka.server.authorizer.AuthorizableRequestContext requestContext, List<org.apache.kafka.common.acl.AclBindingFilter> aclBindingFilters)
      Specified by:
      deleteAcls in interface org.apache.kafka.server.authorizer.Authorizer
      Specified by:
      deleteAcls in interface org.apache.kafka.metadata.authorizer.ClusterMetadataAuthorizer
      Overrides:
      deleteAcls in class ConfluentServerAuthorizer

    • acls

      public Iterable<org.apache.kafka.common.acl.AclBinding> acls(org.apache.kafka.common.acl.AclBindingFilter filter)
      Specified by:
      acls in interface org.apache.kafka.server.authorizer.Authorizer
      Overrides:
      acls in class ConfluentServerAuthorizer