[
https://issues.apache.org/jira/browse/KAFKA-1688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14376977#comment-14376977
]
Prasad Mujumdar commented on KAFKA-1688:
----------------------------------------
[~bosco] and [~parth.brahmbhatt] With my limited understanding of Kafka, the
authorization interface design looks fine to me.
A couple of minor comments/suggestions:
- Hierarchical privileges
The current proposed doesn't have hierarchical privileges. I am wondering if
a global/cluster level namespace would make sense here. It's very useful for
managing admin or superuser privileges. Also it provides a cleaner way to
manage 'create topic' privilege. Without a global namespace, you'll need to
grant create access on a topic that doesn't exist. In the database world for
example, you would grant create access on a database to allow users to create
tables under it.
- 'ALL' privilege which combines all the available privileges.
> Add authorization interface and naive implementation
> ----------------------------------------------------
>
> Key: KAFKA-1688
> URL: https://issues.apache.org/jira/browse/KAFKA-1688
> Project: Kafka
> Issue Type: Sub-task
> Components: security
> Reporter: Jay Kreps
> Assignee: Parth Brahmbhatt
> Fix For: 0.8.3
>
>
> Add a PermissionManager interface as described here:
> https://cwiki.apache.org/confluence/display/KAFKA/Security
> (possibly there is a better name?)
> Implement calls to the PermissionsManager in KafkaApis for the main requests
> (FetchRequest, ProduceRequest, etc). We will need to add a new error code and
> exception to the protocol to indicate "permission denied".
> Add a server configuration to give the class you want to instantiate that
> implements that interface. That class can define its own configuration
> properties from the main config file.
> Provide a simple implementation of this interface which just takes a user and
> ip whitelist and permits those in either of the whitelists to do anything,
> and denies all others.
> Rather than writing an integration test for this class we can probably just
> use this class for the TLS and SASL authentication testing.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
