Examples with KafkaListenerAuthentication io.strimzi.api.kafka.model.listener.KafkaListenerAuthentication used on opensource projects

Example 1 with KafkaListenerAuthentication

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthentication in project strimzi-kafka-operator by strimzi.

the class KafkaBrokerConfigurationBuilder method configureAuthentication.

/**
 * Configures authentication for a Kafka listener. This method is used only internally.
 *
 * @param listenerName  Name of the listener as used in the Kafka broker configuration file.
 * @param securityProtocol  List of security protocols enabled int he broker. The method will add the security
 *                          protocol configuration for this listener to this list (e.g. SASL_PLAINTEXT).
 * @param tls   Flag whether this protocol is using TLS or not
 * @param auth  The authentication confgiuration from the Kafka CR
 */
private void configureAuthentication(String listenerName, List<String> securityProtocol, boolean tls, KafkaListenerAuthentication auth) {
    String listenerNameInProperty = listenerName.toLowerCase(Locale.ENGLISH);
    String listenerNameInEnvVar = listenerName.replace("-", "_");
    if (auth instanceof KafkaListenerAuthenticationOAuth) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, true)));
        KafkaListenerAuthenticationOAuth oauth = (KafkaListenerAuthenticationOAuth) auth;
        List<String> options = new ArrayList<>();
        options.addAll(getOAuthOptions(oauth));
        if (oauth.getClientSecret() != null) {
            options.add("oauth.client.secret=\"${STRIMZI_" + listenerNameInEnvVar + "_OAUTH_CLIENT_SECRET}\"");
        }
        if (oauth.getTlsTrustedCertificates() != null && oauth.getTlsTrustedCertificates().size() > 0) {
            options.add(String.format("oauth.ssl.truststore.location=\"/tmp/kafka/oauth-%s.truststore.p12\"", listenerNameInProperty));
            options.add("oauth.ssl.truststore.password=\"${CERTS_STORE_PASSWORD}\"");
            options.add("oauth.ssl.truststore.type=\"PKCS12\"");
        }
        StringBuilder enabledMechanisms = new StringBuilder();
        if (oauth.isEnableOauthBearer()) {
            writer.println(String.format("listener.name.%s.oauthbearer.sasl.server.callback.handler.class=io.strimzi.kafka.oauth.server.JaasServerOauthValidatorCallbackHandler", listenerNameInProperty));
            writer.println(String.format("listener.name.%s.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginStringClaim_sub=\"thePrincipalName\" %s;", listenerNameInProperty, String.join(" ", options)));
            enabledMechanisms.append("OAUTHBEARER");
        }
        if (oauth.isEnablePlain()) {
            addOption(options, ServerPlainConfig.OAUTH_TOKEN_ENDPOINT_URI, oauth.getTokenEndpointUri());
            writer.println(String.format("listener.name.%s.plain.sasl.server.callback.handler.class=io.strimzi.kafka.oauth.server.plain.JaasServerOauthOverPlainValidatorCallbackHandler", listenerNameInProperty));
            writer.println(String.format("listener.name.%s.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required %s;", listenerNameInProperty, String.join(" ", options)));
            if (enabledMechanisms.length() > 0) {
                enabledMechanisms.append(",");
            }
            enabledMechanisms.append("PLAIN");
        }
        writer.println(String.format("listener.name.%s.sasl.enabled.mechanisms=%s", listenerNameInProperty, enabledMechanisms));
        if (oauth.getMaxSecondsWithoutReauthentication() != null) {
            writer.println(String.format("listener.name.%s.connections.max.reauth.ms=%s", listenerNameInProperty, 1000 * oauth.getMaxSecondsWithoutReauthentication()));
        }
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationScramSha512) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, true)));
        writer.println(String.format("listener.name.%s.scram-sha-512.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required;", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.sasl.enabled.mechanisms=SCRAM-SHA-512", listenerNameInProperty));
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationTls) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, false)));
        writer.println(String.format("listener.name.%s.ssl.client.auth=required", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.location=/tmp/kafka/clients.truststore.p12", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.password=${CERTS_STORE_PASSWORD}", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.type=PKCS12", listenerNameInProperty));
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationCustom) {
        KafkaListenerAuthenticationCustom customAuth = (KafkaListenerAuthenticationCustom) auth;
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, customAuth.isSasl())));
        KafkaListenerCustomAuthConfiguration config = new KafkaListenerCustomAuthConfiguration(reconciliation, customAuth.getListenerConfig().entrySet());
        config.asOrderedProperties().asMap().forEach((key, value) -> writer.println(String.format("listener.name.%s.%s=%s", listenerNameInProperty, key, value)));
    } else {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, false)));
    }
}

Example 2 with KafkaListenerAuthentication

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthentication in project strimzi by strimzi.

the class KafkaBrokerConfigurationBuilder method configureAuthentication.

/**
 * Configures authentication for a Kafka listener. This method is used only internally.
 *
 * @param listenerName  Name of the listener as used in the Kafka broker configuration file.
 * @param securityProtocol  List of security protocols enabled int he broker. The method will add the security
 *                          protocol configuration for this listener to this list (e.g. SASL_PLAINTEXT).
 * @param tls   Flag whether this protocol is using TLS or not
 * @param auth  The authentication confgiuration from the Kafka CR
 */
private void configureAuthentication(String listenerName, List<String> securityProtocol, boolean tls, KafkaListenerAuthentication auth) {
    String listenerNameInProperty = listenerName.toLowerCase(Locale.ENGLISH);
    String listenerNameInEnvVar = listenerName.replace("-", "_");
    if (auth instanceof KafkaListenerAuthenticationOAuth) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, true)));
        KafkaListenerAuthenticationOAuth oauth = (KafkaListenerAuthenticationOAuth) auth;
        List<String> options = new ArrayList<>();
        options.addAll(getOAuthOptions(oauth));
        if (oauth.getClientSecret() != null) {
            options.add("oauth.client.secret=\"${STRIMZI_" + listenerNameInEnvVar + "_OAUTH_CLIENT_SECRET}\"");
        }
        if (oauth.getTlsTrustedCertificates() != null && oauth.getTlsTrustedCertificates().size() > 0) {
            options.add(String.format("oauth.ssl.truststore.location=\"/tmp/kafka/oauth-%s.truststore.p12\"", listenerNameInProperty));
            options.add("oauth.ssl.truststore.password=\"${CERTS_STORE_PASSWORD}\"");
            options.add("oauth.ssl.truststore.type=\"PKCS12\"");
        }
        StringBuilder enabledMechanisms = new StringBuilder();
        if (oauth.isEnableOauthBearer()) {
            writer.println(String.format("listener.name.%s.oauthbearer.sasl.server.callback.handler.class=io.strimzi.kafka.oauth.server.JaasServerOauthValidatorCallbackHandler", listenerNameInProperty));
            writer.println(String.format("listener.name.%s.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginStringClaim_sub=\"thePrincipalName\" %s;", listenerNameInProperty, String.join(" ", options)));
            enabledMechanisms.append("OAUTHBEARER");
        }
        if (oauth.isEnablePlain()) {
            addOption(options, ServerPlainConfig.OAUTH_TOKEN_ENDPOINT_URI, oauth.getTokenEndpointUri());
            writer.println(String.format("listener.name.%s.plain.sasl.server.callback.handler.class=io.strimzi.kafka.oauth.server.plain.JaasServerOauthOverPlainValidatorCallbackHandler", listenerNameInProperty));
            writer.println(String.format("listener.name.%s.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required %s;", listenerNameInProperty, String.join(" ", options)));
            if (enabledMechanisms.length() > 0) {
                enabledMechanisms.append(",");
            }
            enabledMechanisms.append("PLAIN");
        }
        writer.println(String.format("listener.name.%s.sasl.enabled.mechanisms=%s", listenerNameInProperty, enabledMechanisms));
        if (oauth.getMaxSecondsWithoutReauthentication() != null) {
            writer.println(String.format("listener.name.%s.connections.max.reauth.ms=%s", listenerNameInProperty, 1000 * oauth.getMaxSecondsWithoutReauthentication()));
        }
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationScramSha512) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, true)));
        writer.println(String.format("listener.name.%s.scram-sha-512.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required;", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.sasl.enabled.mechanisms=SCRAM-SHA-512", listenerNameInProperty));
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationTls) {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, false)));
        writer.println(String.format("listener.name.%s.ssl.client.auth=required", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.location=/tmp/kafka/clients.truststore.p12", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.password=${CERTS_STORE_PASSWORD}", listenerNameInProperty));
        writer.println(String.format("listener.name.%s.ssl.truststore.type=PKCS12", listenerNameInProperty));
        writer.println();
    } else if (auth instanceof KafkaListenerAuthenticationCustom) {
        KafkaListenerAuthenticationCustom customAuth = (KafkaListenerAuthenticationCustom) auth;
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, customAuth.isSasl())));
        KafkaListenerCustomAuthConfiguration config = new KafkaListenerCustomAuthConfiguration(reconciliation, customAuth.getListenerConfig().entrySet());
        config.asOrderedProperties().asMap().forEach((key, value) -> writer.println(String.format("listener.name.%s.%s=%s", listenerNameInProperty, key, value)));
    } else {
        securityProtocol.add(String.format("%s:%s", listenerName, getSecurityProtocol(tls, false)));
    }
}

Example 3 with KafkaListenerAuthentication

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthentication in project strimzi by strimzi.

the class HttpBridgeKafkaExternalListenersST method testWeirdUsername.

@SuppressWarnings({ "checkstyle:MethodLength" })
private void testWeirdUsername(ExtensionContext extensionContext, String weirdUserName, KafkaListenerAuthentication auth, KafkaBridgeSpec spec, SecurityProtocol securityProtocol) {
    final String clusterName = mapWithClusterNames.get(extensionContext.getDisplayName());
    final String topicName = mapWithTestTopics.get(extensionContext.getDisplayName());
    resourceManager.createResource(extensionContext, KafkaTemplates.kafkaEphemeral(clusterName, 3, 1).editMetadata().withNamespace(namespace).endMetadata().editSpec().editKafka().withListeners(new GenericKafkaListenerBuilder().withName(Constants.TLS_LISTENER_DEFAULT_NAME).withPort(9093).withType(KafkaListenerType.INTERNAL).withTls(true).withAuth(auth).build(), new GenericKafkaListenerBuilder().withName(Constants.EXTERNAL_LISTENER_DEFAULT_NAME).withPort(9094).withType(KafkaListenerType.NODEPORT).withTls(true).withAuth(auth).build()).endKafka().endSpec().build());
    BridgeClients kafkaBridgeClientJob = new BridgeClientsBuilder().withProducerName(clusterName + "-" + producerName).withConsumerName(clusterName + "-" + consumerName).withBootstrapAddress(KafkaBridgeResources.serviceName(clusterName)).withTopicName(topicName).withMessageCount(MESSAGE_COUNT).withPort(Constants.HTTP_BRIDGE_DEFAULT_PORT).withNamespaceName(namespace).build();
    // Create topic
    resourceManager.createResource(extensionContext, KafkaTopicTemplates.topic(clusterName, topicName).editMetadata().withNamespace(namespace).endMetadata().build());
    // Create user
    if (auth.getType().equals(Constants.TLS_LISTENER_DEFAULT_NAME)) {
        resourceManager.createResource(extensionContext, KafkaUserTemplates.tlsUser(clusterName, weirdUserName).editMetadata().withNamespace(namespace).endMetadata().build());
    } else {
        resourceManager.createResource(extensionContext, KafkaUserTemplates.scramShaUser(clusterName, weirdUserName).editMetadata().withNamespace(namespace).endMetadata().build());
    }
    final String kafkaClientsName = mapWithKafkaClientNames.get(extensionContext.getDisplayName());
    resourceManager.createResource(extensionContext, KafkaClientsTemplates.kafkaClients(namespace, true, kafkaClientsName).build());
    // Deploy http bridge
    resourceManager.createResource(extensionContext, KafkaBridgeTemplates.kafkaBridge(clusterName, KafkaResources.tlsBootstrapAddress(clusterName), 1).editMetadata().withNamespace(namespace).endMetadata().withNewSpecLike(spec).withBootstrapServers(KafkaResources.tlsBootstrapAddress(clusterName)).withNewHttp(Constants.HTTP_BRIDGE_DEFAULT_PORT).withNewConsumer().addToConfig(ConsumerConfig.AUTO_OFFSET_RESET_CONFIG, "earliest").endConsumer().endSpec().build());
    final Service service = KafkaBridgeUtils.createBridgeNodePortService(clusterName, namespace, BRIDGE_EXTERNAL_SERVICE);
    ServiceResource.createServiceResource(extensionContext, service, namespace);
    resourceManager.createResource(extensionContext, kafkaBridgeClientJob.consumerStrimziBridge());
    final String kafkaProducerExternalName = "kafka-producer-external" + new Random().nextInt(Integer.MAX_VALUE);
    final List<ListenerStatus> listenerStatusList = KafkaResource.kafkaClient().inNamespace(namespace).withName(clusterName).get().getStatus().getListeners();
    final String externalBootstrapServers = listenerStatusList.stream().filter(listener -> listener.getType().equals(Constants.EXTERNAL_LISTENER_DEFAULT_NAME)).findFirst().orElseThrow(RuntimeException::new).getBootstrapServers();
    final KafkaClients externalKafkaProducer = new KafkaClientsBuilder().withProducerName(kafkaProducerExternalName).withBootstrapAddress(externalBootstrapServers).withNamespaceName(namespace).withTopicName(topicName).withMessageCount(100).build();
    if (auth.getType().equals(Constants.TLS_LISTENER_DEFAULT_NAME)) {
        // tls producer
        resourceManager.createResource(extensionContext, externalKafkaProducer.producerTlsStrimzi(clusterName, weirdUserName));
    } else {
        // scram-sha producer
        resourceManager.createResource(extensionContext, externalKafkaProducer.producerScramShaStrimzi(clusterName, weirdUserName));
    }
    ClientUtils.waitForClientSuccess(kafkaProducerExternalName, namespace, MESSAGE_COUNT);
    // delete kafka producer job
    JobUtils.deleteJobWithWait(namespace, kafkaProducerExternalName);
    ClientUtils.waitForClientSuccess(clusterName + "-" + consumerName, namespace, MESSAGE_COUNT);
}

Example 4 with KafkaListenerAuthentication

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthentication in project strimzi-kafka-operator by strimzi.

the class HttpBridgeKafkaExternalListenersST method testWeirdUsername.

@SuppressWarnings({ "checkstyle:MethodLength" })
private void testWeirdUsername(ExtensionContext extensionContext, String weirdUserName, KafkaListenerAuthentication auth, KafkaBridgeSpec spec, SecurityProtocol securityProtocol) {
    final String clusterName = mapWithClusterNames.get(extensionContext.getDisplayName());
    final String topicName = mapWithTestTopics.get(extensionContext.getDisplayName());
    resourceManager.createResource(extensionContext, KafkaTemplates.kafkaEphemeral(clusterName, 3, 1).editMetadata().withNamespace(namespace).endMetadata().editSpec().editKafka().withListeners(new GenericKafkaListenerBuilder().withName(Constants.TLS_LISTENER_DEFAULT_NAME).withPort(9093).withType(KafkaListenerType.INTERNAL).withTls(true).withAuth(auth).build(), new GenericKafkaListenerBuilder().withName(Constants.EXTERNAL_LISTENER_DEFAULT_NAME).withPort(9094).withType(KafkaListenerType.NODEPORT).withTls(true).withAuth(auth).build()).endKafka().endSpec().build());
    BridgeClients kafkaBridgeClientJob = new BridgeClientsBuilder().withProducerName(clusterName + "-" + producerName).withConsumerName(clusterName + "-" + consumerName).withBootstrapAddress(KafkaBridgeResources.serviceName(clusterName)).withTopicName(topicName).withMessageCount(MESSAGE_COUNT).withPort(Constants.HTTP_BRIDGE_DEFAULT_PORT).withNamespaceName(namespace).build();
    // Create topic
    resourceManager.createResource(extensionContext, KafkaTopicTemplates.topic(clusterName, topicName).editMetadata().withNamespace(namespace).endMetadata().build());
    // Create user
    if (auth.getType().equals(Constants.TLS_LISTENER_DEFAULT_NAME)) {
        resourceManager.createResource(extensionContext, KafkaUserTemplates.tlsUser(clusterName, weirdUserName).editMetadata().withNamespace(namespace).endMetadata().build());
    } else {
        resourceManager.createResource(extensionContext, KafkaUserTemplates.scramShaUser(clusterName, weirdUserName).editMetadata().withNamespace(namespace).endMetadata().build());
    }
    final String kafkaClientsName = mapWithKafkaClientNames.get(extensionContext.getDisplayName());
    resourceManager.createResource(extensionContext, KafkaClientsTemplates.kafkaClients(namespace, true, kafkaClientsName).build());
    // Deploy http bridge
    resourceManager.createResource(extensionContext, KafkaBridgeTemplates.kafkaBridge(clusterName, KafkaResources.tlsBootstrapAddress(clusterName), 1).editMetadata().withNamespace(namespace).endMetadata().withNewSpecLike(spec).withBootstrapServers(KafkaResources.tlsBootstrapAddress(clusterName)).withNewHttp(Constants.HTTP_BRIDGE_DEFAULT_PORT).withNewConsumer().addToConfig(ConsumerConfig.AUTO_OFFSET_RESET_CONFIG, "earliest").endConsumer().endSpec().build());
    final Service service = KafkaBridgeUtils.createBridgeNodePortService(clusterName, namespace, BRIDGE_EXTERNAL_SERVICE);
    ServiceResource.createServiceResource(extensionContext, service, namespace);
    resourceManager.createResource(extensionContext, kafkaBridgeClientJob.consumerStrimziBridge());
    final String kafkaProducerExternalName = "kafka-producer-external" + new Random().nextInt(Integer.MAX_VALUE);
    final List<ListenerStatus> listenerStatusList = KafkaResource.kafkaClient().inNamespace(namespace).withName(clusterName).get().getStatus().getListeners();
    final String externalBootstrapServers = listenerStatusList.stream().filter(listener -> listener.getType().equals(Constants.EXTERNAL_LISTENER_DEFAULT_NAME)).findFirst().orElseThrow(RuntimeException::new).getBootstrapServers();
    final KafkaClients externalKafkaProducer = new KafkaClientsBuilder().withProducerName(kafkaProducerExternalName).withBootstrapAddress(externalBootstrapServers).withNamespaceName(namespace).withTopicName(topicName).withMessageCount(100).build();
    if (auth.getType().equals(Constants.TLS_LISTENER_DEFAULT_NAME)) {
        // tls producer
        resourceManager.createResource(extensionContext, externalKafkaProducer.producerTlsStrimzi(clusterName, weirdUserName));
    } else {
        // scram-sha producer
        resourceManager.createResource(extensionContext, externalKafkaProducer.producerScramShaStrimzi(clusterName, weirdUserName));
    }
    ClientUtils.waitForClientSuccess(kafkaProducerExternalName, namespace, MESSAGE_COUNT);
    // delete kafka producer job
    JobUtils.deleteJobWithWait(namespace, kafkaProducerExternalName);
    ClientUtils.waitForClientSuccess(clusterName + "-" + consumerName, namespace, MESSAGE_COUNT);
}