Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Schema linking testing #1196

Draft
wants to merge 2 commits into
base: 7.3.2-post
Choose a base branch
from
Draft

Schema linking testing #1196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0caca8f
schema linking rbac testing
amalgawa Mar 7, 2023
ac96726
added one more permission for 7.4
amalgawa Mar 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion security/rbac/delta_configs/schema-registry.properties.delta
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ kafkastore.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBe
schema.registry.group.id=schema-registry-demo

# These properties install the Schema Registry security plugin, and configure it to use RBAC for authorization and OAuth for authentication
schema.registry.resource.extension.class=io.confluent.kafka.schemaregistry.security.SchemaRegistrySecurityResourceExtension
schema.registry.resource.extension.class=io.confluent.kafka.schemaregistry.security.SchemaRegistrySecurityResourceExtension,io.confluent.schema.exporter.SchemaExporterResourceExtension
confluent.schema.registry.authorizer.class=io.confluent.kafka.schemaregistry.security.authorizer.rbac.RbacAuthorizer
rest.servlet.initializor.classes=io.confluent.common.security.jetty.initializer.InstallBearerOrBasicSecurityHandler

Expand All @@ -23,5 +23,9 @@ confluent.metadata.http.auth.credentials.provider=BASIC
public.key.path=/tmp/tokenPublicKey.pem

# This enables anonymous access with a principal of User:ANONYMOUS
schema.linking.rbac.enable=true
confluent.schema.registry.anonymous.principal=true
authentication.skip.paths=/*
kafkastore.update.handlers=io.confluent.schema.exporter.storage.SchemaExporterUpdateHandler
password.encoder.secret=mysecret

11 changes: 11 additions & 0 deletions security/rbac/scripts/enable-rbac-schema-registry.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,21 @@ login_mds $MDS
# Get the Kafka cluster id
get_cluster_id_kafka



echo -e "\n# Grant principal User:$USER_ADMIN_SCHEMA_REGISTRY the ResourceOwner role to Topic:_schemas"
echo "confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_schemas --kafka-cluster-id $KAFKA_CLUSTER_ID"
confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_schemas --kafka-cluster-id $KAFKA_CLUSTER_ID

echo -e "\n# Grant principal User:$USER_ADMIN_SCHEMA_REGISTRY the ResourceOwner role to Topic:_schemas"
echo "confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_exporter_configs --kafka-cluster-id $KAFKA_CLUSTER_ID"
confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_exporter_configs --kafka-cluster-id $KAFKA_CLUSTER_ID
echo "$KAFKA_CLUSTER_ID"
confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_exporter_states --kafka-cluster-id $KAFKA_CLUSTER_ID

# ONLY NEEDED FOR 7.4.0
confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Topic:_schema_encoders --kafka-cluster-id $KAFKA_CLUSTER_ID

echo -e "\n# Grant principal User:$USER_ADMIN_SCHEMA_REGISTRY the ResourceOwner role to Group:schema-registry-demo"
echo "confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Group:schema-registry-demo --kafka-cluster-id $KAFKA_CLUSTER_ID"
confluent iam rbac role-binding create --principal User:$USER_ADMIN_SCHEMA_REGISTRY --role ResourceOwner --resource Group:schema-registry-demo --kafka-cluster-id $KAFKA_CLUSTER_ID
Expand Down
2 changes: 1 addition & 1 deletion security/rbac/scripts/init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ check_jq || exit 1
mkdir -p /tmp/original_configs
mkdir -p /tmp/rbac_configs

./create_login_properties.py
python3 create_login_properties.py

# Generate keys
openssl genrsa -out /tmp/tokenKeypair.pem 2048
Expand Down