Chapter 8. Using OPA policy-based authorization

Procedure

1. Write the OPA policies required for authorizing client requests to perform operations on the Kafka brokers.

   See Defining OPA policies.

   Now configure the Kafka brokers to use OPA.

2. Install the OPA authorizer plugin for Kafka.

   See Connecting to the OPA.

   Make sure that the plugin files are included in the Kafka classpath.

3. Add the following to the Kafka server.properties configuration file to enable the OPA plugin:

   authorizer.class.name: com.bisnode.kafka.authorization.OpaAuthorizer

   Copy to Clipboard Toggle word wrap

4. Add further configuration to server.properties for the Kafka brokers to access the OPA policy engine and policies.

   For example:

   opa.authorizer.url=https://OPA-ADDRESS/allow 

   1

   
   opa.authorizer.allow.on.error=false 

   2

   
   opa.authorizer.cache.initial.capacity=50000 

   3

   
   opa.authorizer.cache.maximum.size=50000 

   4

   
   opa.authorizer.cache.expire.after.seconds=600000 

   5

   
   super.users=User:alice;User:bob 

   6

   Copy to Clipboard Toggle word wrap

   1

   (Required) The OAuth 2.0 token endpoint URL for the policy the authorizer plugin will query. In this example, the policy is called allow.

   2

   Flag to specify whether a client is allowed or denied access by default if the authorizer plugin fails to connect with the OPA policy engine.

   3

   Initial capacity in bytes of the local cache. The cache is used so that the plugin does not have to query the OPA policy engine for every request.

   4

   Maximum capacity in bytes of the local cache.

   5

   Time in milliseconds that the local cache is refreshed by reloading from the OPA policy engine.

   6

   A list of user principals treated as super users, so that they are always allowed without querying the Open Policy Agent policy.

   Refer to the Open Policy Agent website for information on authentication and authorization options.

5. Verify the configured permissions by accessing Kafka brokers using clients that have and do not have the correct authorization.