Repository: provectus/kafka-ui
Issue: Oauth2 with problem delete permission
Labels: type/bug
scope/backend

**Describe the bug**
(A clear and concise description of what the bug is.)
When enable "AUTH_ENABLED" the options delete Clear Message and Delete Topic return 403 with method DELETE.

**Set up**
(How do you run the app?)
the application is running in kubernetes , created by helm with follow args:
`
helm install kafka-ui kafka-ui/kafka-ui \
--set envs.config.KAFKA_CLUSTER_0_NAME= "<Cluster Name>" \
--set envs.config.KAFKA_CLUSTER_0_BOOTSTRAPSERVERS= "URL_BROKER1:port\,URL_BROKER2:port\,URL_BROKER3:port" \
--set envs.config.KAFKA_CLUSTER_0_ZOOKEEPER="URL_ZOOKEEPER1:port\,URL_ZOOKEEPER2:port\,URL_ZOOKEEPER3:port" \
--set envs.config.KAFKA_CLUSTER_0_PROPERTIES_SECURITY_PROTOCOL="SSL" \
--set envs.config.SECURITY_BASIC_ENABLED="'true'" \
--set envs.config.SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID=<client id> \
--set envs.config.SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET=<secret client id> \
--set envs.config.SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=<url> \
--set envs.config.AUTH_ENABLED="'true'"

**Steps to Reproduce**
Steps to reproduce the behavior:

1. Clusters -> <NameCluster> -> Topic -> button tools -> Clear Message or Remove Topic.

**Expected behavior**
(A clear and concise description of what you expected to happen)
Delete the messages or topic.

**Screenshots**
(If applicable, add screenshots to help explain your problem)
![IMG_20210811_172628446_HDR](https://user-images.githubusercontent.com/50408314/129098872-4ba6f157-179d-4866-be02-8fdfcd308f61.jpg)
![IMG_20210811_172652263_HDR](https://user-images.githubusercontent.com/50408314/129098877-0f54d957-1624-48b4-83de-5eecfc243f2a.jpg)
![request1](https://user-images.githubusercontent.com/50408314/129098887-358eb379-5a1e-48d2-8480-1baca41ef3a2.jpg)
`


**Additional context**
I tried force de optins KAFKA_CLUSTERS_0_READONLY but the same erro occurs. When remove AUTH_ENABLED the validation stop but actions return work.

Issue comments:
@GladstoneChagas, thank for creating this issue. We'll try to fix it soon.
We added specific security config. Now it should work fine, please let us know, how it's working on your environment. 

Pull request review comments:

Patch that resolved the issue:
diff --git a/kafka-ui-api/src/main/java/com/provectus/kafka/ui/config/OAuthSecurityConfig.java b/kafka-ui-api/src/main/java/com/provectus/kafka/ui/config/OAuthSecurityConfig.java
new file mode 100644
index 00000000000..f28e96ed82f
--- /dev/null
+++ b/kafka-ui-api/src/main/java/com/provectus/kafka/ui/config/OAuthSecurityConfig.java
@@ -0,0 +1,40 @@
+package com.provectus.kafka.ui.config;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+@Configuration
+@EnableWebFluxSecurity
+@ConditionalOnProperty(value = "auth.enabled", havingValue = "true")
+public class OAuthSecurityConfig {
+
+  private static final String[] AUTH_WHITELIST = {
+      "/css/**",
+      "/js/**",
+      "/media/**",
+      "/resources/**",
+      "/actuator/health",
+      "/actuator/info",
+      "/login",
+      "/logout",
+      "/oauth2/**"
+  };
+
+  @Bean
+  public SecurityWebFilterChain configure(ServerHttpSecurity http) {
+    return http.authorizeExchange()
+        .pathMatchers(AUTH_WHITELIST).permitAll()
+        .anyExchange().authenticated()
+        .and()
+        .oauth2Login()
+        .and()
+        .csrf().disable()
+        .build();
+  }
+
+}
+


Test patch: