io.strimzi.kafka.oauth.server

Class OAuthSessionAuthorizer

java.lang.Object

io.strimzi.kafka.oauth.server.OAuthSessionAuthorizer

All Implemented Interfaces:

kafka.security.auth.Authorizer, org.apache.kafka.common.Configurable

public class OAuthSessionAuthorizer
extends java.lang.Object
implements kafka.security.auth.Authorizer

An authorizer that grants access only if the access token used during SASL/OAUTHBEARER based authentication has not yet expired based on expiry time of the token as set by Authorization Server when the token was issued.

This authorizer does not detect if the token was invalidated mid-session by explicitly revoking it at the authorization server or by revoking the JWKS signing keys at the authorization server.

To install this authorizer in Kafka broker, specify the following in your 'server.properties':

     authorizer.class.name=io.strimzi.kafka.oauth.server.OAuthSessionAuthorizer
     principal.builder.class=io.strimzi.kafka.oauth.server.OAuthKafkaPrincipalBuilder
 

When you would otherwise configure another authorizer, you'll need to specify that other authorizer as the delegate authorizer using the strimzi.authorizer.delegate.class.name configuration property. For example:

     strimzi.authorizer.delegate.class.name=kafka.security.auth.SimpleAclAuthorizer
 

The specified delegate authorizer should be configured according to its documentation, as if it was installed as the main authorizer (using authorizer.class.name).

If the `strimzi.authorizer.delegate.class.name` is not set, then you need to explicitly specify that all authorizations should be granted, as long as the access token has not expired by specifying:

     strimzi.authorizer.grant.when.no.delegate=true
 

With this setting the OAuthSessionAuthorizer behaves as if there was no authorizer installed - it grants everything with the exception that the sessions using SASL/OAUTHBEARER with expired token will be denied.

This authorizer doesn't take super.users setting into account. When used without a delegate every user effectively becomes a super user.

Constructor Summary

Constructors

Constructor and Description
OAuthSessionAuthorizer()

Method Summary

Modifier and Type	Method and Description
void	addAcls(scala.collection.immutable.Set<kafka.security.auth.Acl> acls, kafka.security.auth.Resource resource)
boolean	authorize(kafka.network.RequestChannel.Session session, kafka.security.auth.Operation operation, kafka.security.auth.Resource resource)
void	close()
void	configure(java.util.Map<java.lang.String,?> configs)
scala.collection.immutable.Map<kafka.security.auth.Resource,scala.collection.immutable.Set<kafka.security.auth.Acl>>	getAcls()
scala.collection.immutable.Map<kafka.security.auth.Resource,scala.collection.immutable.Set<kafka.security.auth.Acl>>	getAcls(org.apache.kafka.common.security.auth.KafkaPrincipal principal)
scala.collection.immutable.Set<kafka.security.auth.Acl>	getAcls(kafka.security.auth.Resource resource)
boolean	removeAcls(kafka.security.auth.Resource resource)
boolean	removeAcls(scala.collection.immutable.Set<kafka.security.auth.Acl> acls, kafka.security.auth.Resource resource)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OAuthSessionAuthorizer

public OAuthSessionAuthorizer()

Method Detail

configure

public void configure(java.util.Map<java.lang.String,?> configs)

Specified by:

configure in interface org.apache.kafka.common.Configurable

authorize

public boolean authorize(kafka.network.RequestChannel.Session session,
                         kafka.security.auth.Operation operation,
                         kafka.security.auth.Resource resource)

Specified by:

authorize in interface kafka.security.auth.Authorizer

addAcls

public void addAcls(scala.collection.immutable.Set<kafka.security.auth.Acl> acls,
                    kafka.security.auth.Resource resource)

Specified by:

addAcls in interface kafka.security.auth.Authorizer

removeAcls

public boolean removeAcls(scala.collection.immutable.Set<kafka.security.auth.Acl> acls,
                          kafka.security.auth.Resource resource)

Specified by:

removeAcls in interface kafka.security.auth.Authorizer

removeAcls

public boolean removeAcls(kafka.security.auth.Resource resource)

Specified by:

removeAcls in interface kafka.security.auth.Authorizer

getAcls

public scala.collection.immutable.Set<kafka.security.auth.Acl> getAcls(kafka.security.auth.Resource resource)

Specified by:

getAcls in interface kafka.security.auth.Authorizer

getAcls

public scala.collection.immutable.Map<kafka.security.auth.Resource,scala.collection.immutable.Set<kafka.security.auth.Acl>> getAcls(org.apache.kafka.common.security.auth.KafkaPrincipal principal)

Specified by:

getAcls in interface kafka.security.auth.Authorizer

getAcls

public scala.collection.immutable.Map<kafka.security.auth.Resource,scala.collection.immutable.Set<kafka.security.auth.Acl>> getAcls()

Specified by:

getAcls in interface kafka.security.auth.Authorizer

close

public void close()

Specified by:

close in interface kafka.security.auth.Authorizer