-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a customized principal builder #6
Conversation
7fcc700
to
a731a7c
Compare
This working in our testing env Granted UserA with producer permission before the testing. UserA, with producer permission, server side log:
UserB, without producer permission, server side log:
ANONYMOUS, connecting Kafka on plaintext port 9092
|
If you guys have a moment: @SonicWang @alexism @parasitew |
String distinguishedName = principal.getName(); | ||
|
||
// Dname example: `CN=writeuser,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown` | ||
return distinguishedName.split(",", 6)[0].split("=")[1]; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
a small detail: why limit = 6
if the only [0]
is used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for reviewing this man.
Basically this function extracts the common name from the distinguished name. For example, the distinguished name is in this format: CN=xu_zhang,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown
, the function will extract the xu_zhang
from it. Then when we using ACL, we can just put user:xu_zhang
instead of user:CN=xu_zhang,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm lacking context and it's hard to understand the purpose of this class based on the existing documentation.
but otherwise code LGTM.
@alexism thanks for reviewing this man ;-). I will add some internal documentation about this. |
Add a CommonNamePrincipalBuilder, only merge to
0.10.2.1
branch.Why we need this:
By default, the SSL user name will be of the form
CN=writeuser,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown
. We can change that by setting a customized PrincipalBuilder in theserver.conf
.This class:
CommonNamePrincipalBuilder
gets the Common Name from the cert, which iswriteuser
, as the username.By using this, we can do the following command to grant the produce permission: