JWT/AUTH role requirements for dekaf -- broker

[jdekoning]

Hi, nice product! Thanks for all the hard work.

I was busy configuring the JWT auth setup for pulsar. I can manage to get it to work using the DEKAF_DEFAULT_PULSAR_AUTH and providing an admin role, previously discussed already in #331. But I run into problems when trying to configure a more secure setup.

What I would like to have is the following:

• Possibility to access the UI with limited authorization
• Overwrite the default token as seems to already be possible
• So explicitly not link an admin token for all to use

As far as I see I have two options, configure a default token with limited access, or simply set a anonymous role in pulsar itself. The problem is that I keep getting only error messages that complain that it cannot GET_CLUSTER, LIST_RUNTIME_CONFIG etc.

Do you know which authorizations would be sufficient for the UI to function?

[visortelle]

@jdekoning hi,
Thank you for the feedback! I'm glad you’re enjoying the project.

At this moment Dekaf doesn't implement authentication and authorization, user management, etc. It's fully relies on Pulsar in this sense. The disadvantage is that with limited access, some UI elements should be hidden or disabled, but we can't determine which ones. When I started Dekaf, I expected that at some moment something like kubectl auth can-i <some_action> will be implemented in Pulsar, but it's not the case.

If you want to limit access to some users, you should:

• Remove defaultAuth configuration.
• Share credentials to each user. It's on your side.
• Each user should click the 🔑 Default button at the top left side of UI:

• Click the Add button:

• Select the credentials type, fill required fields and click the Save button:

In case if you become stuck on the error overlay, delete browser cookies. This is a UI bug, sure it's a bad idea to block the whole screen with this overlay.

---

You can find permission list in the org.apache.pulsar.common.policies.data package. Files you want are named like <something>Operation.java

• https://github.com/apache/pulsar/blob/436ca727abfdb289f787ec61688a9819623fb8dd/pulsar-common/src/main/java/org/apache/pulsar/common/policies/data/BrokerOperation.java
• https://github.com/apache/pulsar/blob/436ca727abfdb289f787ec61688a9819623fb8dd/pulsar-common/src/main/java/org/apache/pulsar/common/policies/data/NamespaceOperation.java
• https://github.com/apache/pulsar/blob/436ca727abfdb289f787ec61688a9819623fb8dd/pulsar-common/src/main/java/org/apache/pulsar/common/policies/data/TenantOperation.java
• ...maybe something else, depending on your needs.

As Dekaf adoption gradually grows, at some moment I plan to introduce built-in user management with a predefined set of roles.

PRs and collaboration toward this goal are highly appreciated.

[visortelle]

Closing this for now.