No ACL found for cluster using io.strimzi.kafka.oauth.server.authorizer.KeycloakRBACAuthorizer

[sookeke]

I am using akhq with keycloak as OIDC provider. Thanks to your effort, everything seems to work as expected except the ACL view.

The ACL UI Tab returns
No ACLS found, or the "authorizer.class.name" parameter is not configured on the cluster. with users with role acls/read

But the cluster is currently configured to use authorizer.class.name as io.strimzi.kafka.oauth.server.authorizer.KeycloakRBACAuthorizer with multiple ACLs configured via keycloak

[tchiotludo]

Most of the time, this error mean that the akhq users don't have the right to read acls entries on Kafka

[sookeke]

Yes, I am trying to understand some AKHQ concepts first. How does akhq get the topic acls if the ACL store is in zookeeper?In our case, the ACL is managed in Kyecloak. Is there communication with the zookeeper and how?

[tchiotludo]

No, there is no communication with zookeeper in akhq, we are using only Kafka api to get the ACL on the cluster

[sookeke]

Ah seems like there's no way to get resource acl using AKHQ as in our case ACLs are stored and managed in Keycloak and not in the cluster. Using Kafka client to query the acl stored in the cluster will return null in our case.

[tchiotludo]

Ok didn't know that this is possible 🤣

[sookeke]

yes, I'm hoping to extend the class library KeycloakRBACAuthorizer to cache the ACL from z-k in the cluster