[KAFKA-6091] Authorization API is called hundred's of times when there are no privileges

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.11.0.0
• Component/s: security
• Assignee: Unassigned
• Reporter: Krishna Kalyan
• Created: 19/Oct/17 20:58
• Updated: 25/Jan/18 17:20
• Resolved: 25/Jan/18 17:20

Description

This issue is observed with kafka/sentry integration. When sentry does not have any permissions for a topic and there is a producer trying to add a message to a topic, sentry returns failure but Kafka is not able to handle it properly and is ending up invoking sentry Auth API ~564 times. This will choke authorization service.

Here are the list of privileges that are needed for a producer to add a message to a topic
In this example "192.168.0.3" is hostname and topic name is "tOpIc1"

HOST=192.168.0.3->Topic=tOpIc1->action=DESCRIBE
HOST=192.168.0.3->Cluster=kafka-cluster->action=CREATE
HOST=192.168.0.3->Topic=tOpIc1->action=WRITE

This problem is reported in this jira is seen when there are no permissions. Movement a DESCRIBE permission is added, this issue is not seen. Authorization fails but kafka doesn't bombard with he more requests.

Issue Links

• is duplicated by: KAFKA-5547 Return topic authorization failed if no topic describe access