Authorization filter guide

This table lists the resource types and operations enforced by the authorization filter:

In the authorization model, some operations imply permission to perform other operations. This table lists the higher-level operations and the implied lower-level operations they include.

The following example shows the overall outline of a rule file. The sections that follow give more details.

// Comment
from io.kroxylicious.filter.authorization import TopicResource as Topic;

deny User with name = "alice" to * Topic with name = "payments-received";
allow User with name = "alice" to * Topic with name like "payments-*";

otherwise deny;

// Comment
from io.kroxylicious.filter.authorization import TopicResource as Topic;

deny User with name = "alice" to * Topic with name = "payments-received";
allow User with name = "alice" to * Topic with name like "payments-*";

otherwise deny;

Both line and block comments are supported. Line comments are preceded by //. Block comments are bracketed by /* …​ */ markers. Comments are ignored.

Resource types must be imported before use. This is achieved using a from / import statement.

from <package> import <element> [as <alias>][,... , <elementn> [as <aliasn>]];

from <package> import <element> [as <alias>][,... , <elementn> [as <aliasn>]];

where:

For example, TopicResource is the implementation that represents Kafka topics. To declare it use a import statement like this.

from io.kroxylicious.filter.authorization import TopicResource;

from io.kroxylicious.filter.authorization import TopicResource;

To declare it with an alias, use an import statement like this:

from io.kroxylicious.filter.authorization import TopicResource as Topic;

from io.kroxylicious.filter.authorization import TopicResource as Topic;

The basic form of a rule is as follows:

<allow|deny> User with <user predicate> to <operation> <resource type> with <resource predicate>;

<allow|deny> User with <user predicate> to <operation> <resource type> with <resource predicate>;

where:

Rules must be ordered so that any deny rules precede the allow rules.

When rules are evaluated, they are considered from top to bottom, with the first matching rule taking precedence.

Rules files must end with the statement otherwise deny. This stipulation means that all rules files have deny-by-default semantics.

...
otherwise deny;

...
otherwise deny;

The following User predicates are supported:

The following resource predicates are supported:

Operations in rules can be specified in the following ways:

If your instance of Streams for Apache Kafka Proxy runs on OpenShift, you must use a KafkaProtocolFilter resource to contain the filter configuration.

Here’s a complete example of a KafkaProtocolFilter resource configured for authorization:

kind: KafkaProtocolFilter
metadata:
  name: my-authorization
spec:
  type: Authorization
  configTemplate:
    authorizer: AclAuthorizerService
    authorizerConfig:
      aclFile: ${configmap:acl-rules:acl-rules.txt}

kind: KafkaProtocolFilter
metadata:
  name: my-authorization
spec:
  type: Authorization
  configTemplate:
    authorizer: AclAuthorizerService
    authorizerConfig:
      aclFile: ${configmap:acl-rules:acl-rules.txt}

If your instance of Streams for Apache Kafka Proxy runs on OpenShift, you must use a ConfigMap resource to contain the ACL rules.

Here’s a complete example of a ConfigMap resource configured for authorization:

apiVersion: v1
kind: ConfigMap
metadata:
  name: acl-rules
data:
  acl-rules.txt: |
    from io.kroxylicious.filter.authorization import TopicResource as Topic;
    deny User with name = "alice" to * Topic with name = "payments-received";
    allow User with name = "alice" to * Topic with name like "payments-*";
    allow User with name = "bob" to * Topic with name = "payments-received";
    otherwise deny;

apiVersion: v1
kind: ConfigMap
metadata:
  name: acl-rules
data:
  acl-rules.txt: |
    from io.kroxylicious.filter.authorization import TopicResource as Topic;
    deny User with name = "alice" to * Topic with name = "payments-received";
    allow User with name = "alice" to * Topic with name like "payments-*";
    allow User with name = "bob" to * Topic with name = "payments-received";
    otherwise deny;