Status

Current state: Under Discussion

Discussion thread: here [Change the link from the KIP proposal email archive to your own email thread]

JIRA: KAFKA-3186

Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast).

Motivation

Kafka supports pluggable authorization. Third party authorizer implementations allow existing authorization systems like, Apache Sentry, Apache Ranger, etc to extend authorization to Kafka as well. Implementing Kafka's authorizer interface requires depending on kafka's core, which is huge. This has been already raised as a concern by Sentry, Ranger and Kafka community. Even Kafka clients require duplication of authorization related classes, like Resource, Operation, etc, for adding ACLs CRUD APIs.

Kafka authorizer is agnostic of principal types it supports, so are the acls CRUD methods in Authorizer interface. The intent behind is to keep Kafka principal types pluggable, which is really great. However, this leads to Acls CRUD methods not performing any check on validity of acls, as they are not aware of what principal types Authorizer implementation supports. This opens up space for lots of user errors, KAFKA-3097 is an instance.

Public Interfaces

Move following interfaces to new package, org.apche.kafka.authorizer. The new package will be a separate module, so that third party implementations can add it as a dependency without having to depend on clients or core.

1. Authorizer
2. Acl
3. Operation
4. PermissionType
5. Resource
6. ResourceType
7. KafkaPrincipal
8. Session

Add following public methods to Authorizer interface.

/**
* description of authorizer implementation, like, valid principal types.
* @return description of authorizer implementation.
*/
public String description()

Update Authorizer interface to get rid of getter naming convention.

public interface Authorizer extends Configurable {

    /**
     * @param session   The session being authenticated.
     * @param operation Type of operation client is trying to perform on resource.
     * @param resource  Resource the client is trying to access.
     * @return
     */
    public boolean authorize(Session session, Operation operation, Resource resource);

    /**
     * implementation specific description, like, supported principal types.
     *
     * @return implementation specific description.
     */
    public String description();

    /**
     * add the acls to resource, this is an additive operation so existing acls will not be overwritten, instead these new
     * acls will be added to existing acls.
     *
     * @param acls     set of acls to add to existing acls
     * @param resource the resource to which these acls should be attached.
     */
    public void addAcls(Set<Acl> acls, Resource resource);

    /**
     * remove these acls from the resource.
     *
     * @param acls     set of acls to be removed.
     * @param resource resource from which the acls should be removed.
     * @return true if some acl got removed, false if no acl was removed.
     */
    public boolean removeAcls(Set<Acl> acls, Resource resource);

    /**
     * remove a resource along with all of its acls from acl store.
     *
     * @param resource
     * @return
     */
    public boolean removeAcls(Resource resource);

    /**
     * get set of acls for this resource
     *
     * @param resource
     * @return empty set if no acls are found, otherwise the acls for the resource.
     */
    public Set<Acl> acls(Resource resource);

    /**
     * get the acls for this principal.
     *
     * @param principal
     * @return empty Map if no acls exist for this principal, otherwise a map of resource -> acls for the principal.
     */
    public Map<Resource, Set<Acl>> acls(KafkaPrincipal principal);

    /**
     * gets the map of resource to acls for all resources.
     */
    public Map<Resource, Set<Acl>> acls();

    /**
     * Closes this instance.
     */
    public void close();

}

Proposed Changes

The KIP proposes to move authorizer interface and all related classes, i.e., Acl, Operation, PermissionType, Resource, ResourceType, KafkaPrincipal and Session, to a separate package, org.apache.kafka.authorizer, that third-party authorizer implementations,  core and clients packages can depend on. Only change made to default authorizer, SimpleAclAuthorizer, will be the interface it extends.

Authorizer interface will be updated to remove getter naming convention. 

description() will be added to Authorizer interface. Each authorizer implementation can override this method to provide info on implementation specific aspects of authorizer, for instance, Principal Types it supports. The description will be provided by kafka-acls.sh CLI when --help is specified. The KIP suggests that acls should be validated in authorizer implementations.

The changes are backwards incompatible and authorizer implementations will have to be updated to use the new interface and related classes. Apache Ranger and Apache Sentry, only known third party authorizer implementations, are OK with making this backwards incompatible change. 

Compatibility, Deprecation, and Migration Plan

• What impact (if any) will there be on existing users?
  • Users will have to upgrade third party authorizer implementations along with broker upgrade, else Kafka broker will fail to start.
• If we are changing behavior how will we phase out the older behavior?
  • This will require a breaking change for third party implementations. Apache Ranger and Apache Sentry, only known third party authorizer implementations, are OK with making this backwards incompatible change.
• If we need special migration tools, describe them here.
  • None.
• When will we remove the existing behavior?
  • Existing Authorizer interface and related classes will be removed as part of the changes made as per this KIP.

Rejected Alternatives

• Add getSupportedPrincipalTypes in authorizer interface.
• Add validation at Authorizer level.
• An alternative of providing supported Principal types via interface is via a config option.
• Add description() method to Authorizer.