Class CpcPrincipalBuilder

java.lang.Object
io.confluent.kafka.cpc.multitenant.CpcPrincipalBuilder
All Implemented Interfaces:
org.apache.kafka.common.Configurable, org.apache.kafka.common.security.auth.KafkaPrincipalBuilder, org.apache.kafka.common.security.auth.KafkaPrincipalSerde, org.apache.kafka.common.security.auth.KerberosShortNamerAware, org.apache.kafka.common.security.auth.SslPrincipalMapperAware
public class CpcPrincipalBuilder extends Object implements org.apache.kafka.common.security.auth.KafkaPrincipalBuilder, org.apache.kafka.common.Configurable, org.apache.kafka.common.security.auth.KerberosShortNamerAware, org.apache.kafka.common.security.auth.SslPrincipalMapperAware
Principal builder for CPC (Confluent Private Cloud) multi-tenancy.

For SSL and SASL_SSL connections on multi-tenant listeners (configured via confluent.multitenant.listener.names), this builder first delegates to DefaultKafkaPrincipalBuilder to obtain the actual user identity (ANONYMOUS for plain SSL, certificate DN for mTLS, or SASL username for SASL_SSL), then extracts the LKC ID from the SNI hostname and returns a MultiTenantPrincipal with the correct user and tenant metadata.

For connections without SNI (e.g. PLAINTEXT, health checks), on non-tenant listeners, or when multi-tenancy is not enabled, it returns the default principal from DefaultKafkaPrincipalBuilder.

  • Constructor Summary

    Constructors
    Constructor
    Description
    CpcPrincipalBuilder()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    org.apache.kafka.common.security.auth.KafkaPrincipal
    build(org.apache.kafka.common.security.auth.AuthenticationContext context)
     
    void
    configure(Map<String,?> configs)
     
    org.apache.kafka.common.security.auth.KafkaPrincipal
    deserialize(byte[] bytes)
     
    byte[]
    serialize(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
     
    void
    setKerberosShortNamer(org.apache.kafka.common.security.kerberos.KerberosShortNamer kerberosShortNamer)
     
    void
    setSslPrincipalMapper(org.apache.kafka.common.security.ssl.SslPrincipalMapper sslPrincipalMapper)
     

    Methods inherited from class Object

    equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • CpcPrincipalBuilder

      public CpcPrincipalBuilder()

  • Method Details

    • configure

      public void configure(Map<String,?> configs)
      Specified by:
      configure in interface org.apache.kafka.common.Configurable

    • setKerberosShortNamer

      public void setKerberosShortNamer(org.apache.kafka.common.security.kerberos.KerberosShortNamer kerberosShortNamer)
      Specified by:
      setKerberosShortNamer in interface org.apache.kafka.common.security.auth.KerberosShortNamerAware

    • setSslPrincipalMapper

      public void setSslPrincipalMapper(org.apache.kafka.common.security.ssl.SslPrincipalMapper sslPrincipalMapper)
      Specified by:
      setSslPrincipalMapper in interface org.apache.kafka.common.security.auth.SslPrincipalMapperAware

    • build

      public org.apache.kafka.common.security.auth.KafkaPrincipal build(org.apache.kafka.common.security.auth.AuthenticationContext context)
      Specified by:
      build in interface org.apache.kafka.common.security.auth.KafkaPrincipalBuilder

    • serialize

      public byte[] serialize(org.apache.kafka.common.security.auth.KafkaPrincipal principal) throws org.apache.kafka.common.errors.SerializationException
      Specified by:
      serialize in interface org.apache.kafka.common.security.auth.KafkaPrincipalSerde
      Throws:
      org.apache.kafka.common.errors.SerializationException

    • deserialize

      public org.apache.kafka.common.security.auth.KafkaPrincipal deserialize(byte[] bytes) throws org.apache.kafka.common.errors.SerializationException
      Specified by:
      deserialize in interface org.apache.kafka.common.security.auth.KafkaPrincipalSerde
      Throws:
      org.apache.kafka.common.errors.SerializationException