Extend the external role support

[angeloxx]

In order to support complex scenario where for each LDAP group the user obtain rights to write or read a topic I'm trying to use the external role support, receiving the list user's LDAP group, to authorise the user with the right role for each topic.

Current external role support (seems to) support only a single role attribution, but I need something like:

[{
  "roles": ["topic/read", "..."],
  "attributes":
  {
    "topics-filter-regexp": [".*"],
    "connects-filter-regexp": [".*"],
    "consumer-groups-filter-regexp": [".*"]
  }
},
{
  "roles": ["topic/write", "..."],
  "attributes":
  {
    "topics-filter-regexp": ["^topic-rw.*"],
    "connects-filter-regexp": [".*"],
    "consumer-groups-filter-regexp": [".*"]
  }
}]

Is it possible to extend the external role support in order to map multiple roles?

[tchiotludo]

@twobeeb ? 😄

[twobeeb]

Short answer : It's not possible with current security model.

Long answer :
The current security model allows for a single list of roles and 3 filters that applies to the whole AKHQ instance for a given authenticated user.
The roles are applies to the pages:

• topic/read lets you access topic API, for all Kafka clusters See code
• topic/create lets you access the create topic API, for all Kafka clusters See code

Attributes are applied to the list API:

• On the list topics page, results are optionally filtered with topics-filter-regexp irrespective of the Kafka clusters See code
• Same for connects and consumer groups

I really mean that attributes applies only to list APIs: so if you have topic/create role and topics-filter-regexp attribute, you can still create any topic name.

We are aware of the limitation, that's why the discussion #523 is a good place to explain your needs, which could potentially be taken into account at some point in time.
There are several things to consider : roles per cluster, resources per cluster, roles per resource (as you suggest), and so on... I believe the subject is quite complex

[tchiotludo]

done in #1472