kafka.security.auth.Resource Java Examples

The following examples show how to use kafka.security.auth.Resource. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public Set<Acl> getAcls(Resource resource) {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.getAcls(Resource)");
	}
	
	Set<Acl> ret = null;
	
	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.getAcls(resource);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.getAcls(Resource)");
	}

	return ret;
}
Example #2
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public scala.collection.immutable.Map<Resource, Set<Acl>> getAcls() {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.getAcls()");
	}

	scala.collection.immutable.Map<Resource, Set<Acl>> ret = null;

	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.getAcls();
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.getAcls()");
	}

	return ret;
}
Example #3
Source File: TestAclsCrud.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Test
public void testAddAclsForNonExistentRole() {
  sentryKafkaAuthorizer = new SentryKafkaAuthorizer();
  java.util.Map<String, String> configs = new HashMap<>();
  configs.put(KafkaAuthConf.SENTRY_KAFKA_SITE_URL, "file://" + sentrySitePath.getAbsolutePath());
  sentryKafkaAuthorizer.configure(configs);

  final String role1 = "role1";
  Set<Acl> acls = new HashSet<>();
  final Acl acl = new Acl(new KafkaPrincipal("role", role1),
      Allow$.MODULE$,
      "127.0.0.1",
      Operation$.MODULE$.fromString("READ"));
  acls.add(acl);
  scala.collection.immutable.Set<Acl> aclsScala = scala.collection.JavaConversions.asScalaSet(acls).toSet();
  Resource resource = new Resource(ResourceType$.MODULE$.fromString("TOPIC"), "test-topic");
  try {
    sentryKafkaAuthorizer.addAcls(aclsScala, resource);
  } catch (Exception ex) {
    assertCausedMessage(ex, "Can not add Acl for non-existent Role: role1");
  }
}
Example #4
Source File: ConvertUtil.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
public static List<Authorizable> convertResourceToAuthorizable(String hostname,
    final Resource resource) {
  List<Authorizable> authorizables = Lists.newArrayList();
  authorizables.add(new Host(hostname));
  authorizables.add(new Authorizable() {
    @Override
    public String getTypeName() {
      final String resourceTypeName = resource.resourceType().name();
      // Kafka's GROUP resource is referred as CONSUMERGROUP within Sentry.
      if (resourceTypeName.equalsIgnoreCase("group")) {
        return KafkaAuthorizable.AuthorizableType.CONSUMERGROUP.name();
      } else {
        return resourceTypeName;
      }
    }

    @Override
    public String getName() {
      return resource.name();
    }
  });
  return authorizables;
}
Example #5
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public scala.collection.immutable.Map<Resource, Set<Acl>> getAcls(KafkaPrincipal principal) {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.getAcls(KafkaPrincipal)");
	}

	scala.collection.immutable.Map<Resource, Set<Acl>> ret = null;

	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.getAcls(principal);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.getAcls(KafkaPrincipal)");
	}

	return ret;
}
Example #6
Source File: KafkaAdminClientTest.java    From common-kafka with Apache License 2.0 6 votes vote down vote up 
@Test
public void getAcls() {
    KafkaPrincipal user = new KafkaPrincipal(KafkaPrincipal.USER_TYPE, "my_user");
    Resource topic1 = Resource.fromString(Topic.name() + Resource.Separator() + "topic1");
    Resource topic2 = Resource.fromString(Topic.name() + Resource.Separator() + "topic2");

    Set<Acl> readAcl = Collections.singleton(new Acl(user, Allow$.MODULE$, Acl.WildCardHost(), Read$.MODULE$));

    client.addAcls(readAcl, topic1);
    client.addAcls(readAcl, topic2);

    Map<Resource, Set<Acl>> allAcls = new HashMap<>();
    allAcls.put(topic1, readAcl);
    allAcls.put(topic2, readAcl);

    assertThat(client.getAcls(), is(allAcls));
}
Example #7
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
public void addAcls(scala.collection.immutable.Set<Acl> acls, final Resource resource) {
    verifyAcls(acls);
    LOG.info("Adding Acl: acl->" + acls + " resource->" + resource);

    final Iterator<Acl> iterator = acls.iterator();
    while (iterator.hasNext()) {
        final Acl acl = iterator.next();
        final String role = getRole(acl);
        if (!roleExists(role)) {
            throw new KafkaException("Can not add Acl for non-existent Role: " + role);
        }
        execute(new Command<Void>() {
            @Override
            public Void run(SentryGenericServiceClient client) throws Exception {
                client.grantPrivilege(
                    requestorName, role, COMPONENT_NAME, toTSentryPrivilege(acl, resource));
                return null;
            }
        });
    }
}
Example #8
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
public boolean removeAcls(scala.collection.immutable.Set<Acl> acls, final Resource resource) {
    verifyAcls(acls);
    LOG.info("Removing Acl: acl->" + acls + " resource->" + resource);
    final Iterator<Acl> iterator = acls.iterator();
    while (iterator.hasNext()) {
        final Acl acl = iterator.next();
        final String role = getRole(acl);
        try {
            execute(new Command<Void>() {
                @Override
                public Void run(SentryGenericServiceClient client) throws Exception {
                    client.dropPrivilege(
                            requestorName, role, toTSentryPrivilege(acl, resource));
                    return null;
                }
            });
        } catch (KafkaException kex) {
            LOG.error("Failed to remove acls.", kex);
            return false;
        }
    }

    return true;
}
Example #9
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
public boolean removeAcls(final Resource resource) {
    LOG.info("Removing Acls for Resource: resource->" + resource);
    List<String> roles = getAllRoles();
    final List<TSentryPrivilege> tSentryPrivileges = getAllPrivileges(roles);
    try {
        execute(new Command<Void>() {
            @Override
            public Void run(SentryGenericServiceClient client) throws Exception {
                for (TSentryPrivilege tSentryPrivilege : tSentryPrivileges) {
                    if (isPrivilegeForResource(tSentryPrivilege, resource)) {
                        client.dropPrivilege(
                                requestorName, COMPONENT_NAME, tSentryPrivilege);
                    }
                }
                return null;
            }
        });
    } catch (KafkaException kex) {
        LOG.error("Failed to remove acls.", kex);
        return false;
    }

    return true;
}
Example #10
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public boolean removeAcls(Resource resource) {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.removeAcls(Resource)");
	}
	boolean ret = false;
	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.removeAcls(resource);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.removeAcls(Resource)");
	}

	return ret;
}
Example #11
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public boolean removeAcls(Set<Acl> acls, Resource resource) {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.removeAcls(Set<Acl>, Resource)");
	}
	boolean ret = false;
	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.removeAcls(acls, resource);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.removeAcls(Set<Acl>, Resource)");
	}
	
	return ret;
}
Example #12
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public void addAcls(Set<Acl> acls, Resource resource) {
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerKafkaAuthorizer.addAcls(Set<Acl>, Resource)");
	}

	try {
		activatePluginClassLoader();

		rangerKakfaAuthorizerImpl.addAcls(acls, resource);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.addAcls(Set<Acl>, Resource)");
	}
}
Example #13
Source File: RangerKafkaAuthorizer.java    From ranger with Apache License 2.0 6 votes vote down vote up 
@Override
public boolean authorize(Session session, Operation operation,Resource resource) {	
	if(LOG.isDebugEnabled()) {
		LOG.debug(String.format("==> RangerKafkaAuthorizer.authorize(Session=%s, Operation=%s, Resource=%s)", session, operation, resource));
	}

	boolean ret = false;
	
	try {
		activatePluginClassLoader();

		ret = rangerKakfaAuthorizerImpl.authorize(session, operation, resource);
	} finally {
		deactivatePluginClassLoader();
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerKafkaAuthorizer.authorize: " + ret);
	}
	
	return ret;
}
Example #14
Source File: ConvertUtilTest.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Test
public void testCluster() {
  String hostname = "localhost";
  String clusterName = Resource$.MODULE$.ClusterResourceName();
  Resource clusterResource = new Resource(ResourceType$.MODULE$.fromString("cluster"), clusterName);
  List<Authorizable> authorizables = ConvertUtil.convertResourceToAuthorizable(hostname, clusterResource);
  for (Authorizable auth : authorizables) {
    if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.CLUSTER.name())) {
      Assert.assertEquals(auth.getName(), clusterName);
    } else if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.HOST.name())) {
      Assert.assertEquals(auth.getName(), hostname);
    } else {
      Assert.fail("Unexpected type found: " + auth.getTypeName());
    }
  }
  Assert.assertEquals(authorizables.size(), 2);
}
Example #15
Source File: ConvertUtilTest.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Test
public void testTopic() {
  String hostname = "localhost";
  String topicName = "t1";
  Resource topicResource = new Resource(ResourceType$.MODULE$.fromString("topic"), topicName);
  List<Authorizable> authorizables = ConvertUtil.convertResourceToAuthorizable(hostname, topicResource);
  for (Authorizable auth : authorizables) {
    if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.TOPIC.name())) {
      Assert.assertEquals(auth.getName(), topicName);
    } else if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.HOST.name())) {
      Assert.assertEquals(auth.getName(), hostname);
    } else {
      Assert.fail("Unexpected type found: " + auth.getTypeName());
    }
  }
  Assert.assertEquals(authorizables.size(), 2);
}
Example #16
Source File: ConvertUtilTest.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Test
public void testConsumerGroup() {
  String hostname = "localhost";
  String consumerGroup = "g1";
  Resource consumerGroupResource = new Resource(ResourceType$.MODULE$.fromString("group"), consumerGroup);
  List<Authorizable> authorizables = ConvertUtil.convertResourceToAuthorizable(hostname, consumerGroupResource);
  for (Authorizable auth : authorizables) {
    if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.CONSUMERGROUP.name())) {
      Assert.assertEquals(auth.getName(),consumerGroup);
    } else if (auth.getTypeName().equalsIgnoreCase(KafkaAuthorizable.AuthorizableType.HOST.name())) {
      Assert.assertEquals(auth.getName(),hostname);
    } else {
      Assert.fail("Unexpected type found: " + auth.getTypeName());
    }
  }
  Assert.assertEquals(authorizables.size(), 2);
}
Example #17
Source File: KafkaAdminClientTest.java    From common-kafka with Apache License 2.0 5 votes vote down vote up 
@Test(expected = AdminOperationException.class)
public void removeAcls_zkException() {
    KafkaPrincipal user = new KafkaPrincipal(KafkaPrincipal.USER_TYPE, "user");
    Resource resource = Resource.fromString(Topic.name() + Resource.Separator() + "topic");
    Set<Acl> readAcl = Collections.singleton(new Acl(user, Allow$.MODULE$, Acl.WildCardHost(), Read$.MODULE$));

    failureClient.removeAcls(readAcl, resource);
}
Example #18
Source File: SentryKafkaAuthorizerTest.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
public SentryKafkaAuthorizerTest() throws UnknownHostException {
  authorizer = new SentryKafkaAuthorizer();
  testHostName1 = InetAddress.getByAddress("host1", new byte[] {1, 2, 3, 4});
  testHostName2 = InetAddress.getByAddress("host2", new byte[] {2, 3, 4, 5});
  resourceName = Resource$.MODULE$.ClusterResourceName();
  clusterResource = new Resource(ResourceType$.MODULE$.fromString("cluster"), resourceName);
  topic1Resource = new Resource(ResourceType$.MODULE$.fromString("topic"), "t1");
}
Example #19
Source File: SentryKafkaAuthorizer.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
@Override
  public boolean authorize(RequestChannel.Session session, Operation operation,
                           Resource resource) {
    LOG.debug("Authorizing Session: " + session + " for Operation: " + operation + " on Resource: " + resource);
    final KafkaPrincipal user = session.principal();
    if (isSuperUser(user)) {
      LOG.debug("Allowing SuperUser: " + user + " in " + session + " for Operation: " + operation + " on Resource: " + resource);
      return true;
    }
    LOG.debug("User: " + user + " is not a SuperUser");
    return binding.authorize(session, operation, resource);
}
Example #20
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
public Map<Resource, scala.collection.immutable.Set<Acl>> getAcls(KafkaPrincipal principal) {
    if (principal.getPrincipalType().toLowerCase().equals("group")) {
        List<String> roles = getRolesforGroup(principal.getName());
        return getAclsForRoles(roles);
    } else {
        LOG.info("Did not recognize Principal type: " + principal.getPrincipalType() + ". Returning Acls for all principals.");
        return getAcls();
    }
}
Example #21
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
private TSentryPrivilege toTSentryPrivilege(Acl acl, Resource resource) {
    final List<Authorizable> authorizables = ConvertUtil.convertResourceToAuthorizable(acl.host(), resource);
    final List<TAuthorizable> tAuthorizables = new ArrayList<>();
    for (Authorizable authorizable : authorizables) {
        tAuthorizables.add(new TAuthorizable(authorizable.getTypeName(), authorizable.getName()));
    }
    TSentryPrivilege tSentryPrivilege = new TSentryPrivilege(COMPONENT_NAME, instanceName, tAuthorizables, acl.operation().name());
    return tSentryPrivilege;
}
Example #22
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
private boolean isPrivilegeForResource(TSentryPrivilege tSentryPrivilege, Resource resource) {
    final java.util.Iterator<TAuthorizable> authorizablesIterator = tSentryPrivilege.getAuthorizablesIterator();
    while (authorizablesIterator.hasNext()) {
        TAuthorizable tAuthorizable = authorizablesIterator.next();
        if (tAuthorizable.getType().equals(resource.resourceType().name())) {
            return true;
        }
    }
    return false;
}
Example #23
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
private java.util.Map<Resource, scala.collection.immutable.Set<Acl>> rolePrivilegesToResourceAcls(java.util.Map<String, scala.collection.immutable.Set<TSentryPrivilege>> rolePrivilegesMap) {
    final java.util.Map<Resource, scala.collection.immutable.Set<Acl>> resourceAclsMap = new HashMap<>();
    for (String role : rolePrivilegesMap.keySet()) {
        scala.collection.immutable.Set<TSentryPrivilege> privileges = rolePrivilegesMap.get(role);
        final Iterator<TSentryPrivilege> iterator = privileges.iterator();
        while (iterator.hasNext()) {
            TSentryPrivilege privilege = iterator.next();
            final List<TAuthorizable> authorizables = privilege.getAuthorizables();
            String host = null;
            String operation = privilege.getAction();
            for (TAuthorizable tAuthorizable : authorizables) {
                if (tAuthorizable.getType().equals(KafkaAuthorizable.AuthorizableType.HOST.name())) {
                    host = tAuthorizable.getName();
                } else {
                    Resource resource = new Resource(ResourceType$.MODULE$.fromString(tAuthorizable.getType()), tAuthorizable.getName());
                    if (operation.equals("*")) {
                        operation = "All";
                    }
                    Acl acl = new Acl(new KafkaPrincipal("role", role), Allow$.MODULE$, host, Operation$.MODULE$.fromString(operation));
                    Set<Acl> newAclsJava = new HashSet<Acl>();
                    newAclsJava.add(acl);
                    addExistingAclsForResource(resourceAclsMap, resource, newAclsJava);
                    final scala.collection.mutable.Set<Acl> aclScala = JavaConversions.asScalaSet(newAclsJava);
                    resourceAclsMap.put(resource, aclScala.<Acl>toSet());
                }
            }
        }
    }

    return resourceAclsMap;
}
Example #24
Source File: KafkaAuthBinding.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
private void addExistingAclsForResource(java.util.Map<Resource, scala.collection.immutable.Set<Acl>> resourceAclsMap, Resource resource, java.util.Set<Acl> newAclsJava) {
    final scala.collection.immutable.Set<Acl> existingAcls = resourceAclsMap.get(resource);
    if (existingAcls != null) {
        final Iterator<Acl> aclsIter = existingAcls.iterator();
        while (aclsIter.hasNext()) {
            Acl curAcl = aclsIter.next();
            newAclsJava.add(curAcl);
        }
    }
}
Example #25
Source File: KeycloakRBACAuthorizer.java    From strimzi-kafka-oauth with Apache License 2.0 5 votes vote down vote up 
boolean delegateIfRequested(RequestChannel.Session session, Operation operation, Resource resource, JsonNode authz) {
    String nonAuthMessageFragment = session.principal() instanceof JwtKafkaPrincipal ? "" : " non-oauth";
    if (delegateToKafkaACL) {
        boolean granted = super.authorize(session, operation, resource);

        boolean grantLogOn = granted && GRANT_LOG.isDebugEnabled();
        boolean denyLogOn = !granted && DENY_LOG.isDebugEnabled();

        if (grantLogOn || denyLogOn) {
            String status = granted ? "GRANTED" : "DENIED";
            String message = "Authorization " + status + " by ACL -" + nonAuthMessageFragment + " user: " + session.principal() + ", operation: " + operation + ", resource: " + resource;

            if (grantLogOn) {
                GRANT_LOG.debug(message);
            } else if (denyLogOn) {
                DENY_LOG.debug(message);
            }
        }
        return granted;
    }

    if (DENY_LOG.isDebugEnabled()) {
        DENY_LOG.debug("Authorization DENIED -" + nonAuthMessageFragment + " user: " + session.principal() +
                ", cluster: " + clusterName + ", operation: " + operation + ", resource: " + resource + ",\n permissions: " + authz);
    }
    return false;
}
Example #26
Source File: KafkaAdminClientTest.java    From common-kafka with Apache License 2.0 5 votes vote down vote up 
@Test
public void removeAcls() {
    KafkaPrincipal user = new KafkaPrincipal(KafkaPrincipal.USER_TYPE, "my_user");
    Resource topic1 = Resource.fromString(Topic.name() + Resource.Separator() + "topic1");
    Set<Acl> readAcl = Collections.singleton(new Acl(user, Allow$.MODULE$, Acl.WildCardHost(), Read$.MODULE$));

    client.addAcls(readAcl, topic1);

    assertThat(client.getAcls(topic1), is(readAcl));

    client.removeAcls(readAcl, topic1);

    assertThat(client.getAcls(topic1), is(empty()));
}
Example #27
Source File: KeycloakRBACAuthorizer.java    From strimzi-kafka-oauth with Apache License 2.0 5 votes vote down vote up 
@Override
public void addAcls(Set<Acl> acls, Resource resource) {
    if (!delegateToKafkaACL) {
        throw new RuntimeException("Simple ACL delegation not enabled");
    }
    super.addAcls(acls, resource);
}
Example #28
Source File: KeycloakRBACAuthorizer.java    From strimzi-kafka-oauth with Apache License 2.0 5 votes vote down vote up 
@Override
public boolean removeAcls(Set<Acl> aclsTobeRemoved, Resource resource) {
    if (!delegateToKafkaACL) {
        throw new RuntimeException("Simple ACL delegation not enabled");
    }
    return super.removeAcls(aclsTobeRemoved, resource);
}
Example #29
Source File: KeycloakRBACAuthorizer.java    From strimzi-kafka-oauth with Apache License 2.0 5 votes vote down vote up 
@Override
public boolean removeAcls(Resource resource) {
    if (!delegateToKafkaACL) {
        throw new RuntimeException("Simple ACL delegation not enabled");
    }
    return super.removeAcls(resource);
}
Example #30
Source File: KeycloakRBACAuthorizer.java    From strimzi-kafka-oauth with Apache License 2.0 5 votes vote down vote up 
@Override
public Set<Acl> getAcls(Resource resource) {
    if (!delegateToKafkaACL) {
        throw new RuntimeException("Simple ACL delegation not enabled");
    }
    return super.getAcls(resource);
}