Re: Use self contained tokens instead of ACL

2017-11-02 Thread Manikumar
Manikumar [mailto:manikumar.re...@gmail.com] > Sent: Montag, 30. Oktober 2017 08:53 > To: dev@kafka.apache.org > Subject: Re: Use self contained tokens instead of ACL > > Hi, > > In the first phase, we are trying implement the components/design > discussed in the KIP. &g

RE: Use self contained tokens instead of ACL

2017-11-02 Thread Postmann, P. (Peter)
Subject: Re: Use self contained tokens instead of ACL Hi, In the first phase, we are trying implement the components/design discussed in the KIP. Yes, we can definitely improve some of the components to be more extensible. We are planning to implement in future KIPs/PRs. Thanks On Fri, Oct 27, 2017

Re: Use self contained tokens instead of ACL

2017-10-30 Thread Manikumar
a > > > > talk about this: https://www.youtube.com/watch?v=Yke6Vut2Shc > > > > > > > > We want to use the same mechanism with Kafka: > > > > - Connect via Mutual TLS > > > > - Provide a peer token which contains metod:topics > > > &g

Re: Use self contained tokens instead of ACL

2017-10-27 Thread Sönke Liebau
same mechanism with Kafka: > > > - Connect via Mutual TLS > > > - Provide a peer token which contains metod:topics > > > > > > I understood that it should be possible to get the details from the > > > certificate, but we also need the token. The combination of

Re: Use self contained tokens instead of ACL

2017-10-27 Thread Manikumar
ward > a > > token, if it wasn’t bound to a certificate). > > > > I agree with the revocation part, but we are only looking at internal > > clients. The process would be to revoke access in the Portal which > prevents > > new instances to connect to the service.

Re: Use self contained tokens instead of ACL

2017-10-27 Thread Sönke Liebau
gt; new instances to connect to the service. If we really encounter malicious > behaviour, the prefer way is to shut down the misbehaving client. > > Kind Regards, > Peter > > > -----Original Message- > From: Sönke Liebau [mailto:soenke.lie...@opencore.com.INVALID]

RE: Use self contained tokens instead of ACL

2017-10-27 Thread Postmann, P. (Peter)
ber 2017 14:59 To: dev@kafka.apache.org Subject: Re: Use self contained tokens instead of ACL Hi Peter, I am not entirely sure that I understand what you mean when you say "at application level" to be honest, but I do understand that you want to forego 3rd party tools. However, this wo

Re: Use self contained tokens instead of ACL

2017-10-26 Thread Sönke Liebau
ittwoch, 25. Oktober 2017 12:37 > To: dev@kafka.apache.org > Subject: Re: Use self contained tokens instead of ACL > > The concept you describe sounds similar to what Microsoft calls "claims > based authorization". > > At a high level I should think that using Kerberos

RE: Use self contained tokens instead of ACL

2017-10-25 Thread Postmann, P. (Peter)
. Oktober 2017 12:37 To: dev@kafka.apache.org Subject: Re: Use self contained tokens instead of ACL The concept you describe sounds similar to what Microsoft calls "claims based authorization". At a high level I should think that using Kerberos as a vehicle to transport the information wo

Re: Use self contained tokens instead of ACL

2017-10-25 Thread Sönke Liebau
The concept you describe sounds similar to what Microsoft calls "claims based authorization". At a high level I should think that using Kerberos as a vehicle to transport the information would be the way to go, as it is established and already supported by Kafka. I believe tickets have a field tha

Use self contained tokens instead of ACL

2017-10-25 Thread Postmann, P. (Peter)
Hi everyone, I´m working on a concept to use Kafka with self-contained tokens (instead of ACL). The idea: - A client requests access to a certain topic (in some kind of portal) - The owner of the topic approves the request (in some kind of portal) - The client recei