When implementing a custom Authorizer, one has to map authorization requests coming from Kafka to a different backend system.
The following table lists all the authorization combinations that can come from Kafka as of 2.0:
...
| Topic | Group | Cluster (singleton) | TransactionalId | DelegationToken | ||
|---|---|---|---|---|---|---|
| Produce | Write |
| Produce (Idempotent) | Write |
| IdempotentWrite |
| Produce (Transactional) | Write |
| Write |
Fetch (Follower) | Read |
| ClusterAction |
| Fetch (Consumer) | Read |
| ListOffsets | Describe |
| Metadata | Describe |
| LeaderAndIsr |
| ClusterAction |
| StopReplica |
| ClusterAction |
| UpdateMetadata |
| ClusterAction |
| ControlledShutdown |
| ClusterAction |
| OffsetCommit | Read | Read |
| OffsetFetch | Describe | Describe |
| FindCoordinator (Group) |
| Describe |
| FindCoordinator (Transaction) |
| Describe |
| JoinGroup |
| Read |
| Heartbeat |
| Read |
| LeaveGroup |
| Read |
| SyncGroup |
| Read |
| DescribeGroups |
| Describe |
| ListGroups |
| Describe |
| SaslHandshake |
| ApiVersions |
| CreateTopics | Create (Added in 2.0) |
| Create |
From 2.0 onwards, CREATE permission on Topic OR CREATE permission on Cluster is required. | |||
| DeleteTopics | Delete |
| DeleteRecords | Delete |
| InitProducerId (Idempotent) |
| IdempotentWrite |
| InitProducerId (Transaction) |
| Write |
| OffsetsForLeaderEpoch |
| ClusterAction |
| AddPartitionsToTxn | Write |
| Write |
| AddOffsetsToTxn |
| Read |
| Write |
| EndTxn |
| Write |
| WriteTxnMarkers |
| ClusterAction |
| TxnOffsetCommit | Read | Read |
| Write |
| DescribeAcls |
| Describe |
| CreateAcls |
| Alter |
| DeleteAcls |
| Alter |
| DescribeConfigs (Broker) |
| DescribeConfigs |
| DescribeConfigs (Topic) | DescribeConfigs |
AlterConfigs (Broker) |
| AlterConfigs |
| AlterConfigs (Topic) | AlterConfigs |
| AlterReplicaLogDirs |
| Alter |
| DescribeLogDirs |
| Describe |
| SaslAuthenticate |
| CreatePartitions | Alter |
| CreateDeletegationToken |
| RenewDelegationToken |
| ExpireDelegationToken |
| DescribeDelegationTokens |
| Describe | ||||||
| DeleteGroups |
| Delete |
The following table lists all the authorization combinations that can come from Kafka as of 1.1.0:
...
| Topic | Group | Cluster (singleton) | TransactionalId | DelegationToken | |
|---|---|---|---|---|---|
| Produce | Write |
| Produce (Idempotent) | Write |
| IdempotentWrite |
| Produce (Transactional) | Write |
| Write |
Fetch (Follower) | Read |
| ClusterAction |
| Fetch (Consumer) | Read |
| ListOffsets | Describe |
| Metadata | Describe |
| LeaderAndIsr |
| ClusterAction |
| StopReplica |
| ClusterAction |
| UpdateMetadata |
| ClusterAction |
| ControlledShutdown |
| ClusterAction |
| OffsetCommit | Read | Read |
| OffsetFetch | Describe | Describe |
| FindCoordinator (Group) |
| Describe |
| FindCoordinator (Transaction) |
| Describe |
| JoinGroup |
| Read |
| Heartbeat |
| Read |
| LeaveGroup |
| Read |
| SyncGroup |
| Read |
| DescribeGroups |
| Describe |
| ListGroups |
| Describe |
| SaslHandshake |
| ApiVersions |
| CreateTopics |
| Create |
| DeleteTopics | Delete |
| DeleteRecords | Delete |
| InitProducerId (Idempotent) |
| IdempotentWrite |
| InitProducerId (Transaction) |
| Write |
| OffsetsForLeaderEpoch |
| ClusterAction |
| AddPartitionsToTxn | Write |
| Write |
| AddOffsetsToTxn |
| Read |
| Write |
| EndTxn |
| Write |
| WriteTxnMarkers |
| ClusterAction |
| TxnOffsetCommit | Read | Read |
| Write |
| DescribeAcls |
| Describe |
| CreateAcls |
| Alter |
| DeleteAcls |
| Alter |
| DescribeConfigs (Broker) |
| DescribeConfigs |
| DescribeConfigs (Topic) | DescribeConfigs |
AlterConfigs (Broker) |
| AlterConfigs |
| AlterConfigs (Topic) | AlterConfigs |
| AlterReplicaLogDirs |
| Alter |
| DescribeLogDirs |
| Describe |
| SaslAuthenticate |
| CreatePartitions | Alter |
| CreateDeletegationToken |
| RenewDelegationToken |
| ExpireDelegationToken |
| DescribeDelegationTokens |
| Describe | |||||
| DeleteGroups |
| Delete |