Examples with AclOperation org.apache.kafka.common.acl.AclOperation used on opensource projects

Example 1 with AclOperation

use of org.apache.kafka.common.acl.AclOperation in project kafka by apache.

the class StandardAuthorizerTest method testFindResultImplication.

@Test
public void testFindResultImplication() throws Exception {
    // These permissions all imply DESCRIBE.
    for (AclOperation op : asList(DESCRIBE, READ, WRITE, DELETE, ALTER)) {
        assertEquals(ALLOWED, findResult(newAction(DESCRIBE, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(op, ALLOW)));
    }
    // CREATE does not imply DESCRIBE
    assertEquals(null, findResult(newAction(DESCRIBE, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(CREATE, ALLOW)));
    // Deny ACLs don't do "implication".
    for (AclOperation op : asList(READ, WRITE, DELETE, ALTER)) {
        assertEquals(null, findResult(newAction(DESCRIBE, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(op, DENY)));
    }
    // Exact match
    assertEquals(DENIED, findResult(newAction(DESCRIBE, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(DESCRIBE, DENY)));
    // These permissions all imply DESCRIBE_CONFIGS.
    for (AclOperation op : asList(DESCRIBE_CONFIGS, ALTER_CONFIGS)) {
        assertEquals(ALLOWED, findResult(newAction(DESCRIBE_CONFIGS, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(op, ALLOW)));
    }
    // Deny ACLs don't do "implication".
    assertEquals(null, findResult(newAction(DESCRIBE_CONFIGS, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(ALTER_CONFIGS, DENY)));
    // Exact match
    assertEquals(DENIED, findResult(newAction(ALTER_CONFIGS, TOPIC, "foo_bar"), new MockAuthorizableRequestContext.Builder().setPrincipal(new KafkaPrincipal(USER_TYPE, "bob")).build(), newFooAcl(ALTER_CONFIGS, DENY)));
}

Example 2 with AclOperation

use of org.apache.kafka.common.acl.AclOperation in project ksql by confluentinc.

the class EmbeddedSingleNodeKafkaCluster method addUserAcl.

/**
 * Writes the supplied ACL information to ZK, where it will be picked up by the brokes authorizer.
 *
 * @param username    the who.
 * @param permission  the allow|deny.
 * @param resource    the thing
 * @param ops         the what.
 */
public void addUserAcl(final String username, final AclPermissionType permission, final Resource resource, final Set<AclOperation> ops) {
    final KafkaPrincipal principal = new KafkaPrincipal("User", username);
    final PermissionType scalaPermission = PermissionType$.MODULE$.fromJava(permission);
    final Set<Acl> javaAcls = ops.stream().map(Operation$.MODULE$::fromJava).map(op -> new Acl(principal, scalaPermission, "*", op)).collect(Collectors.toSet());
    final scala.collection.immutable.Set<Acl> scalaAcls = JavaConversions.asScalaSet(javaAcls).toSet();
    kafka.security.auth.ResourceType scalaResType = ResourceType$.MODULE$.fromJava(resource.resourceType());
    final kafka.security.auth.Resource scalaResource = new kafka.security.auth.Resource(scalaResType, resource.name());
    authorizer.addAcls(scalaAcls, scalaResource);
    addedAcls.add(scalaResource);
}

Example 3 with AclOperation

use of org.apache.kafka.common.acl.AclOperation in project kafka by apache.

the class DescribeConsumerGroupsHandler method handleResponse.

@Override
public ApiResult<CoordinatorKey, ConsumerGroupDescription> handleResponse(Node coordinator, Set<CoordinatorKey> groupIds, AbstractResponse abstractResponse) {
    final DescribeGroupsResponse response = (DescribeGroupsResponse) abstractResponse;
    final Map<CoordinatorKey, ConsumerGroupDescription> completed = new HashMap<>();
    final Map<CoordinatorKey, Throwable> failed = new HashMap<>();
    final Set<CoordinatorKey> groupsToUnmap = new HashSet<>();
    for (DescribedGroup describedGroup : response.data().groups()) {
        CoordinatorKey groupIdKey = CoordinatorKey.byGroupId(describedGroup.groupId());
        Errors error = Errors.forCode(describedGroup.errorCode());
        if (error != Errors.NONE) {
            handleError(groupIdKey, error, failed, groupsToUnmap);
            continue;
        }
        final String protocolType = describedGroup.protocolType();
        if (protocolType.equals(ConsumerProtocol.PROTOCOL_TYPE) || protocolType.isEmpty()) {
            final List<DescribedGroupMember> members = describedGroup.members();
            final List<MemberDescription> memberDescriptions = new ArrayList<>(members.size());
            final Set<AclOperation> authorizedOperations = validAclOperations(describedGroup.authorizedOperations());
            for (DescribedGroupMember groupMember : members) {
                Set<TopicPartition> partitions = Collections.emptySet();
                if (groupMember.memberAssignment().length > 0) {
                    final Assignment assignment = ConsumerProtocol.deserializeAssignment(ByteBuffer.wrap(groupMember.memberAssignment()));
                    partitions = new HashSet<>(assignment.partitions());
                }
                memberDescriptions.add(new MemberDescription(groupMember.memberId(), Optional.ofNullable(groupMember.groupInstanceId()), groupMember.clientId(), groupMember.clientHost(), new MemberAssignment(partitions)));
            }
            final ConsumerGroupDescription consumerGroupDescription = new ConsumerGroupDescription(groupIdKey.idValue, protocolType.isEmpty(), memberDescriptions, describedGroup.protocolData(), ConsumerGroupState.parse(describedGroup.groupState()), coordinator, authorizedOperations);
            completed.put(groupIdKey, consumerGroupDescription);
        } else {
            failed.put(groupIdKey, new IllegalArgumentException(String.format("GroupId %s is not a consumer group (%s).", groupIdKey.idValue, protocolType)));
        }
    }
    return new ApiResult<>(completed, failed, new ArrayList<>(groupsToUnmap));
}