...
This page is meant as a template for writing a KIP. To create a KIP choose Tools->Copy on this page and modify with your content and replace the heading with the next KIP number and a description of your issue. Replace anything in italics with your own description.
Status
Current state: "Under Discussion"Accepted
Discussion thread: here
JIRA:
Jira | ||||||
---|---|---|---|---|---|---|
|
...
To represent the new User resource type we have to modify the AclCommand slightly and add a new option called --usersuser-principal
. This would have a semicolon separated list of users as parameterrepresents a user principal of principal type "User". By specifying this parameter we would control (allow or deny) the token requester principal to create or describe tokens of those owner usersfor the user-principal.
For instance:
Code Block | ||
---|---|---|
| ||
>> bin/kafka-acls.sh --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:tokenRequester --allow-host * --operation CreateTokens --user-principal "owner1" |
...
The version of CreateAcl, DescribeAcl and DeleteAcl will be increased to avoid serialization errors in case of older brokers which can't handle the newly added User resource type. This way the client can reject a request that the broker doesn't support.
Proposed Changes
Create/Renew Tokens:
...