[KAFKA-3186] KIP-50: Move Authorizer and related classes to separate package.

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 0.9.0.0
• Assignee: Ashish Singh
• Reporter: Ashish Singh
• Created: 01/Feb/16 23:01
• Updated: 19/Dec/19 15:09
• Resolved: 19/Dec/19 15:09

Description

KIP-50 has more details.

Kafka supports pluggable authorization. Third party authorizer implementations allow existing authorization systems like, Apache Sentry, Apache Ranger, etc to extend authorization to Kafka as well. Implementing Kafka's authorizer interface requires depending on kafka's core, which is huge. This has been already raised as a concern by Sentry, Ranger and Kafka community. Even Kafka clients require duplication of authorization related classes, like Resource, Operation, etc, for adding ACLs CRUD APIs.

Kafka authorizer is agnostic of principal types it supports, so are the acls CRUD methods in Authorizer interface. The intent behind is to keep Kafka principal types pluggable, which is really great. However, this leads to Acls CRUD methods not performing any check on validity of acls, as they are not aware of what principal types Authorizer implementation supports. This opens up space for lots of user errors, KAFKA-3097 is an instance.

Issue Links

• is duplicated by: KAFKA-8865 KIP-504: New Java Authorizer API

Sub-Tasks

• Make kafka-acls.sh help messages more generic.: Resolved