Skip to main content

Kafka Authorization Using ACLs

Hands-On Lab

 

Photo of Will Boyd

Will Boyd

DevOps Team Lead in Content

Length

00:30:00

Difficulty

Intermediate

Kafka provides the ability to exercise granular control over access to objects and operations within the cluster through the use of ACLs. In this hands-on lab, you will have the opportunity to work with ACLs in Kafka by making some changes to an existing cluster in order to provide access to a new user. This will give you a hands-on introduction to the use of ACLs to manage authorization in Kafka.

What are Hands-On Labs?

Hands-On Labs are scenario-based learning environments where learners can practice without consequences. Don't compromise a system or waste money on expensive downloads. Practice real-world skills without the real-world risk, no assembly required.

Kafka Authorization Using ACLs

Introduction

Kafka provides the ability to exercise granular control over access to objects and operations within the cluster through the use of ACLs. In this hands-on lab, you will have the opportunity to work with ACLs in Kafka by making some changes to an existing cluster in order to provide access to a new user. This will give you a hands-on introduction to the use of ACLs to manage authorization in Kafka.

Solution

Begin by logging in to the lab servers using the credentials provided on the hands-on lab page:

  ssh cloud_user@PUBLIC_IP_ADDRESS

Add an ACL to Give kafkauser Read and Write Access to the inventory_purchases Topic

  1. Create the ACL.

    kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:kafkauser --operation read --operation write --topic inventory_purchases
  2. Verify that the read access works by consuming from the topic.

    kafka-console-consumer --bootstrap-server zoo1:9093 --topic inventory_purchases --from-beginning --consumer.config client-ssl.properties

    Data from that topic should be displayed. Pressing Ctrl+C will stop the command so that we can continue.

  3. Verify that the write access works by writing data to the topic.

    kafka-console-producer --broker-list zoo1:9093 --topic inventory_purchases --producer.config client-ssl.properties

    After running this command, provide some sample data such as "test data" or "another test" and press Enter. If no errors are displayed, the write was successful. Press Ctrl+C to stop the command to continue.

Remove All Existing ACLs for the member_signups Topic

  1. List the ACLs for the topic.

    kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --topic member_signups --list
  2. Remove the existing ACL for the topic.

    kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --topic member_signups --remove

    At the prompt, enter y to confirm the removal.

  3. Verify that you can read from the topic as kafkauser.

    kafka-console-consumer --bootstrap-server zoo1:9093 --topic member_signups --from-beginning --consumer.config client-ssl.properties

    Data from the topic should be displayed.

Conclusion

Congratulations — you've completed this hands-on lab!