This repository has been archived by the owner on Jan 24, 2024. It is now read-only.
[FEATURE] Super roles don't need to be granted permissions #571
Labels
type/feature
Indicates new functionality
Comments
Demogorgon314
added a commit
that referenced
this issue
Aug 21, 2021
Add authorization to handleTopicMetadataRequest(#236 ). Fix #415 and #571 ## Motivation When client fetch metadata need check topic permission, so we need add authorization in handleTopicMetadataRequest, and do not perform role verification in authentication. ## Modifications Add a common method in `KafkaRequestHandler#authorize` , this method use `authorizer` to authorization. Modify the authentication behavior, and do not verify the role during authentication, verify the role in fetch metadata(#571 )
wangjialing218
pushed a commit
to wangjialing218/kop
that referenced
this issue
Aug 24, 2021
…ative#662) Add authorization to handleTopicMetadataRequest(streamnative#236 ). Fix streamnative#415 and streamnative#571 ## Motivation When client fetch metadata need check topic permission, so we need add authorization in handleTopicMetadataRequest, and do not perform role verification in authentication. ## Modifications Add a common method in `KafkaRequestHandler#authorize` , this method use `authorizer` to authorization. Modify the authentication behavior, and do not verify the role during authentication, verify the role in fetch metadata(streamnative#571 )
BewareMyPower
pushed a commit
that referenced
this issue
Aug 25, 2021
Add authorization to handleTopicMetadataRequest(#236 ). Fix #415 and #571 ## Motivation When client fetch metadata need check topic permission, so we need add authorization in handleTopicMetadataRequest, and do not perform role verification in authentication. ## Modifications Add a common method in `KafkaRequestHandler#authorize` , this method use `authorizer` to authorization. Modify the authentication behavior, and do not verify the role during authentication, verify the role in fetch metadata(#571 )
|
This issue is solve by #662 , and can be close now. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Is your feature request related to a problem? Please describe.
When KoP is configured with SASL/PLAIN authentication mechanism, it actually uses Pulsar's token authentication. However, for the roles of
superUsersRolesconfiguration, they still need to be grant permissions currently.Describe the solution you'd like
Reuse Pulsar's authorization implementation in KoP.
Describe alternatives you've considered
The simplest solution may be just ignoring the permission check for super user roles.
Additional context
Add any other context or screenshots about the feature request here.
The text was updated successfully, but these errors were encountered: