Class ConfluentFipsValidator

java.lang.Object
io.confluent.kafka.security.fips.ConfluentFipsValidator
All Implemented Interfaces:
org.apache.kafka.common.security.fips.FipsValidator
public class ConfluentFipsValidator extends Object implements org.apache.kafka.common.security.fips.FipsValidator

This class centralizes FIPS validation for cipher suites, SSL/TLS versions and kafka broker protocols. One of its primary uses is to validate FIPS requirements.

Important: When using the default constructor (for ServiceLoader), you must call configure(FipsSecurityConfig.FipsMode) before calling any validation methods. Otherwise, an IllegalStateException will be thrown.

  • Constructor Details

    • ConfluentFipsValidator

      public ConfluentFipsValidator()

  • Method Details

    • configure

      public final void configure(org.apache.kafka.common.security.fips.FipsSecurityConfig.FipsMode fipsMode)
      Specified by:
      configure in interface org.apache.kafka.common.security.fips.FipsValidator

    • fipsEnabled

      public boolean fipsEnabled()
      Specified by:
      fipsEnabled in interface org.apache.kafka.common.security.fips.FipsValidator

    • validateFipsTls

      public void validateFipsTls(Map<String,?> configs)
      Validate FIPS requirements on cipher suites, TLS protocols versions.
      Specified by:
      validateFipsTls in interface org.apache.kafka.common.security.fips.FipsValidator
      Parameters:
      configs - the configuration contains cipher suites, TLS protocols.
      Throws:
      InvalidFipsTlsCipherSuiteException - if cipher suites not FIPS compliant.
      InvalidFipsTlsVersionException - if TLS protocols not FIPS compliant.
      IllegalStateException - if configure() has not been called

    • validateFipsBrokerProtocol

      public void validateFipsBrokerProtocol(Map<String, org.apache.kafka.common.security.auth.SecurityProtocol> securityProtocolMap)
      Validate broker protocol, make sure broker uses either SSL or SASL_SSL protocol.
      Specified by:
      validateFipsBrokerProtocol in interface org.apache.kafka.common.security.fips.FipsValidator
      Parameters:
      securityProtocolMap - the Map contains map relationship between listener name and security protocol.
      Throws:
      InvalidFipsBrokerProtocolException - if broker protocols not FIPS compliant.
      IllegalStateException - if configure() has not been called

    • validateRestProtocol

      public void validateRestProtocol(String restProtocolOrUrl)
      Validate rest server protocol, make sure connect uses https protocol. Accepts either a protocol string (e.g., "https") or a URL (e.g., "https://localhost:8080").
      Specified by:
      validateRestProtocol in interface org.apache.kafka.common.security.fips.FipsValidator
      Parameters:
      restProtocolOrUrl - protocol or URL used by rest servers of listeners.
      Throws:
      InvalidFipsRestProtocolException - if rest server protocol is not FIPS compliant.
      IllegalStateException - if configure() has not been called

    • validateFipsTlsCipherSuite

      public void validateFipsTlsCipherSuite(Map<String,?> configs)
      Validate cipher suites are FIPS compliant or not.
      Parameters:
      configs - the configuration contains cipher suites.
      Throws:
      InvalidFipsTlsCipherSuiteException - if cipher suites not FIPS compliant.

    • validateFipsTlsVersion

      public void validateFipsTlsVersion(Map<String,?> configs)
      Validate TLS versions are FIPS compliant or not.
      Parameters:
      configs - the configuration contains TLS versions.
      Throws:
      InvalidFipsTlsVersionException - if TLS protocol not FIPS compliant.

    • validateFipsTlsCipherSuite

      public void validateFipsTlsCipherSuite(Collection<String> cipherSuites)
      Validate cipher suites are FIPS compliant or not.
      Parameters:
      cipherSuites - a collection of cipher suites
      Throws:
      InvalidFipsTlsCipherSuiteException - if cipher suites not FIPS compliant.
      IllegalStateException - if configure() has not been called

    • validateFipsTlsVersion

      public void validateFipsTlsVersion(Collection<String> tlsVersions)
      Validate TLS versions are FIPS compliant or not.
      Parameters:
      tlsVersions - a collection of TLS protocol version.
      Throws:
      InvalidFipsTlsVersionException - if TLS protocol not FIPS compliant.
      IllegalStateException - if configure() has not been called

    • validateFipsLdapProtocol

      public void validateFipsLdapProtocol(String providerUrls)
      Validate LDAP protocol, make sure only LDAPS protocol is used in all provider URLs. The providerUrls can contain multiple space-separated URLs.
      Specified by:
      validateFipsLdapProtocol in interface org.apache.kafka.common.security.fips.FipsValidator
      Parameters:
      providerUrls - LDAP provider URLs from ldap.java.naming.provider.url config
      Throws:
      InvalidFipsLdapProtocolException - if any LDAP URL uses insecure ldap:// protocol.
      IllegalStateException - if configure() has not been called