Chapter 24. KafkaAuthorizationCustom schema reference Used in: KafkaClusterSpec Full list of KafkaAuthorizationCustom schema properties Configures the Kafka custom resource to use a custom authorizer and define Access Control Lists (ACLs). ACLs allow you to define which users have access to which resources at a granular level. Configure the Kafka custom resource to specify an authorizer class that implements the org.apache.kafka.server.authorizer.Authorizer interface to support custom ACLs. Set the type property in the authorization section to the value custom , and configure a list of super users. Super users are always allowed without querying ACL rules. Add additional configuration for initializing the custom authorizer using Kafka.spec.kafka.config . Example custom authorization configuration apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster namespace: myproject spec: kafka: # ... authorization: type: custom authorizerClass: io.mycompany.CustomAuthorizer superUsers: - CN=user-1 - user-2 - CN=user-3 # ... config: authorization.custom.property1=value1 authorization.custom.property2=value2 # ... Note The super.user configuration option in the config property in Kafka.spec.kafka is ignored. Designate super users in the authorization property instead. 24.1. Adding custom authorizer JAR files to the container image In addition to the Kafka custom resource configuration, the JAR files containing the custom authorizer class along with its dependencies must be available on the classpath of the Kafka broker. You can add them by building Streams for Apache Kafka from the source-code. The Streams for Apache Kafka build process provides a mechanism to add custom third-party libraries to the generated Kafka broker container image by adding them as dependencies in the pom.xml file under the docker-images/artifacts/kafka-thirdparty-libs directory. The directory contains different folders for different Kafka versions. Choose the appropriate folder. Before modifying the pom.xml file, the third-party library must be available in a Maven repository, and that Maven repository must be accessible to the Streams for Apache Kafka build process. Alternatively, you can add the JARs to an existing Streams for Apache Kafka container image: 24.2. Using custom authorizers with OAuth authentication When using oauth authentication with a groupsClaim configuration to extract user group information from JWT tokens, group information can be used in custom authorization calls. Groups are accessible through the OAuthKafkaPrincipal object during custom authorization calls, as follows: 24.3. KafkaAuthorizationCustom schema properties The type property is a discriminator that distinguishes use of the KafkaAuthorizationCustom type from KafkaAuthorizationSimple , KafkaAuthorizationOpa , KafkaAuthorizationKeycloak . It must have the value custom for the type KafkaAuthorizationCustom . Property Property type Description type string Must be custom . authorizerClass string Authorization implementation class, which must be available in classpath. superUsers string array List of super users, which are user principals with unlimited access rights. supportsAdminApi boolean Indicates whether the custom authorizer supports the APIs for managing ACLs using the Kafka Admin API. Defaults to false .

Commands:
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster namespace: myproject spec: kafka: # authorization: type: custom authorizerClass: io.mycompany.CustomAuthorizer superUsers: - CN=user-1 - user-2 - CN=user-3 # config: authorization.custom.property1=value1 authorization.custom.property2=value2 #
FROM registry.redhat.io/amq-streams/kafka-39-rhel9:2.9.0 USER root:root COPY ./ my-authorizer / /opt/kafka/libs/ USER 1001
public List<AuthorizationResult> authorize(AuthorizableRequestContext requestContext, List<Action> actions) { KafkaPrincipal principal = requestContext.principal(); if (principal instanceof OAuthKafkaPrincipal) { OAuthKafkaPrincipal p = (OAuthKafkaPrincipal) principal; for (String group: p.getGroups()) { System.out.println("Group: " + group); } } }