0ct0pu5/kafka-ui
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enabling RBAC check for ACL

Browse source
This commit is contained in:
iliax 2023-05-11 16:35:58 +04:00
parent e7429ce6c6
commit 7b33fbf7eb
1 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
kafka-ui-api/src/main/java/com/provectus/kafka/ui/service/rbac/AccessControlService.java
View file

@ -108,7 +108,8 @@ public class AccessControlService {
&& isConnectAccessible(context, user)
&& isConnectorAccessible(context, user) // TODO connector selectors
&& isSchemaAccessible(context, user)
&& isKsqlAccessible(context, user);
&& isKsqlAccessible(context, user)
&& isAclAccessible(context, user);
if (!accessGranted) {
throw new AccessDeniedException("Access denied");
@ -364,6 +365,23 @@ public class AccessControlService {
return isAccessible(Resource.KSQL, null, user, context, requiredActions);
}
private boolean isAclAccessible(AccessContext context, AuthenticatedUser user) {
if (!rbacEnabled) {
return true;
}
if (context.getAclActions().isEmpty()) {
return true;
}
Set<String> requiredActions = context.getAclActions()
.stream()
.map(a -> a.toString().toUpperCase())
.collect(Collectors.toSet());
return isAccessible(Resource.ACL, null, user, context, requiredActions);
}
public Set<ProviderAuthorityExtractor> getOauthExtractors() {
return oauthExtractors;
}