[SENTRY-2276] Sentry-Kafka integration does not support Kafka's Alter/DescribeConfigs and IdempotentWrite operations

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.2.0
• Component/s: kafka-integration

Environment

Cloudera's Kafka (CDK 3.1.0) and Sentry Distribution, as included with CDH 5.13

• Assignee: Gergo Wilder
• Reporter: Julian Eberius
• Created: 21/Jun/18 13:13
• Updated: 02/Jan/20 17:07
• Resolved: 18/Jul/19 17:55

Description

When sending AlterConfigs or DescribeConfigs requests using Kafka's AdminClient class to a Sentry-enabled Kafka broker, I noticed that the request would fail on the broker side with a NullPointerException in ResourceAuthorizationProvider::buildPermissions, the action being null.

However, other requests, such as DescribeTopics, would work fine. I discovered that these request type are not covered in Sentry's KafkaActionFactory which leads to null values being returned as Actions, e.g., from getActionByName.

Sentry's Kafka binding does not support the following actions that are defined by Kafka's authorization model:

• AlterConfigs
• DescribeConfigs
• IdempotentWrite

It does not support the TransactionalId authorizable resource either that is required for using Kafka's transactional capabilities in combination with Sentry authorizer.

 

Issue Links

• links to: Review board