Topic authorization failed.

[deadmandrive]

Now we able to use kafka ui with SASL_SSL_SCRAM-512.
But when we turn on ACL. we found this error.

 INFO  [parallel-1] o.a.k.c.s.a.AbstractLogin: Successfully logged in.
2022-09-02 10:34:42,182 INFO  [parallel-1] o.a.k.c.u.AppInfoParser: Kafka version: 2.8.0
2022-09-02 10:34:42,182 INFO  [parallel-1] o.a.k.c.u.AppInfoParser: Kafka commitId: ebb1d6e21cc92130
2022-09-02 10:34:42,182 INFO  [parallel-1] o.a.k.c.u.AppInfoParser: Kafka startTimeMs: 1662114882180
2022-09-02 10:34:43,037 ERROR [parallel-1] c.p.k.u.s.MetricsService: Failed to collect cluster dev-uat info
org.apache.kafka.common.errors.TopicAuthorizationException: Topic authorization failed.
2022-09-02 10:34:43,039 DEBUG [parallel-1] c.p.k.u.s.ClustersMetricsScheduler: Metrics updated for cluster: dev-uat
2022-09-02 10:35:11,658 DEBUG [parallel-3] c.p.k.u.s.ClustersMetricsScheduler: Start getting metrics for kafkaCluster: dev-uat
2022-09-02 10:35:11,696 ERROR [parallel-1] c.p.k.u.s.MetricsService: Failed to collect cluster dev-uat info
org.apache.kafka.common.errors.TopicAuthorizationException: Topic authorization failed.
2022-09-02 10:35:11,697 DEBUG [parallel-1] c.p.k.u.s.ClustersMetricsScheduler: Metrics updated for cluster: dev-uat
2022-09-02 10:35:41,657 DEBUG [parallel-3] c.p.k.u.s.ClustersMetricsScheduler: Start getting metrics for kafkaCluster: dev-uat
2022-09-02 10:35:41,681 ERROR [parallel-1] c.p.k.u.s.MetricsService: Failed to collect cluster dev-uat info
org.apache.kafka.common.errors.TopicAuthorizationException: Topic authorization failed.
2022-09-02 10:35:41,682 DEBUG [parallel-1] c.p.k.u.s.ClustersMetricsScheduler: Metrics updated for cluster: dev-uat
^C

We add acl to user that use on kafka-ui and we test by kafka-cli using the same user and it fine.
Any suggestion? Thank you.

[Haarolean]

Hi, thanks for reaching out.

Upon collecting metrics we do the following for the topics:
Describe, DescribeConfigs and Read. Of course, you'd need others if you need to modify topics.

You can also try this image (public.ecr.aws/provectus/kafka-ui-custom-build:2211) it will produce more logs upon authorization exceptions.

[deadmandrive]

Where can i add these permission? or I need to add

kafka-acls --authorizer-properties zookeeper.connect=0.0.0.0:2181 --add --allow-principal User:metricsreporter --operation read --operation write --operation describe --operation describeconfigs --topic [topic name]

Somethings like this?

[Haarolean]

These are kafka's ACLs.
Take a look at this.

[deadmandrive]

Ok. I read those and still have some confusion. So I need to add acl to all topics or I can add as cluster (in resouce section).

[deadmandrive]

@Haarolean Solved. Like you said. I add operations that need to all topic. Thank you for your great support.

[Haarolean]

@deadmandrive glad to hear! You're welcome