[KAFKA-6591] Move check for super user in SimpleAclProvider before ACL evaluation

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 2.1.0
• Component/s: core, security
• Assignee: Sönke Liebau
• Reporter: Sönke Liebau
• Reviewer: Jun Rao
• Created: 25/Feb/18 21:33
• Updated: 25/Jun/18 22:46
• Resolved: 25/Jun/18 22:46

Description

Currently the check whether a user as a super user in SimpleAclAuthorizer is performed only after all other ACLs have been evaluated. Since all requests from a super user are granted we don't really need to apply the ACLs.

I believe this is unnecessary effort that could easily be avoided. I've rigged a small test that created 1000 ACLs for a topic and performed a million authorize calls with a principal that was a super user but didn't match any ACLs.

The implementation from trunk took 43 seconds, whereas a version with the super user check moved up only took half a second. Granted, this is a constructed case, but the effects will be the same, if less pronounced for setups with fewer rules.

Issue Links

• links to: GitHub Pull Request #4618