ACL-based authorization in Kafka - Step-by-Step Execution

Process Flow - ACL-based authorization

Client sends request

↓

Kafka broker receives request

↓

Check ACL rules for client

↓

Allow access

↓

Process

↓

Send response

The Kafka broker checks the client's request against ACL rules to decide if access is allowed or denied.

Execution Sample

Kafka

acl = {
  'user1': ['read', 'write'],
  'user2': ['read']
}

request = {'user': 'user1', 'action': 'write'}

if request['action'] in acl.get(request['user'], []):
  print('Access granted')
else:
  print('Access denied')

This code checks if a user has permission to perform an action based on ACL rules.

Process Table

Step	Action	Evaluation	Result
1	Get user permissions from ACL	acl.get('user1', [])	['read', 'write']
2	Check if action 'write' in permissions	'write' in ['read', 'write']	True
3	Decision based on check	True	Access granted
4	Output	print('Access granted')	Access granted

💡 Access granted because 'write' is in user1's permissions

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
acl	{'user1': ['read', 'write'], 'user2': ['read']}	{'user1': ['read', 'write'], 'user2': ['read']}	{'user1': ['read', 'write'], 'user2': ['read']}	{'user1': ['read', 'write'], 'user2': ['read']}
request	{'user': 'user1', 'action': 'write'}	{'user': 'user1', 'action': 'write'}	{'user': 'user1', 'action': 'write'}	{'user': 'user1', 'action': 'write'}
permissions	N/A	['read', 'write']	['read', 'write']	['read', 'write']
action_allowed	N/A	N/A	True	True

Key Moments - 2 Insights

Why does the code check acl.get(user, []) instead of acl[user]?

Using acl.get(user, []) avoids errors if the user is not in the ACL by returning an empty list, as shown in Step 1 of the execution_table.

What happens if the action is not in the user's permissions?

If the action is not found, the condition in Step 2 becomes False, leading to 'Access denied' output, as explained in the exit_note.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'permissions' after Step 1?

A []

B ['read']

C ['read', 'write']

D None

💡 Hint

Check the 'Evaluation' column in Step 1 of the execution_table.

At which step does the code decide to grant access?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Result' column where the decision is made.

If the request action was 'delete', what would happen in Step 2?

A The check would be False

B The check would be True

C An error would occur

D Permissions would change

💡 Hint

Refer to the condition check in Step 2 and the exit_note.

Concept Snapshot

ACL-based authorization in Kafka:
- ACLs list users and allowed actions
- Broker checks user action against ACL
- If allowed, access granted; else denied
- Use safe lookup (get) to avoid errors
- Controls who can read/write topics

Full Transcript

This visual trace shows how Kafka uses ACL-based authorization. When a client sends a request, the broker checks the ACL rules for that user. The code example shows a dictionary of users and their allowed actions. The program looks up the user's permissions safely using get to avoid errors if the user is missing. It then checks if the requested action is allowed. If yes, it prints 'Access granted'; otherwise, 'Access denied'. The execution table walks through each step, showing variable values and decisions. Key moments clarify why safe lookup is used and what happens if the action is not allowed. The quiz tests understanding of permissions lookup, decision step, and behavior with disallowed actions. This helps beginners see how ACLs control access in Kafka simply and clearly.

Practice

1. What is the main purpose of ACL-based authorization in Kafka?

easy

A. To control who can access Kafka topics and perform operations

B. To speed up message processing in Kafka

C. To store messages in a compressed format

D. To monitor Kafka cluster health

Solution

1. Step 1: Understand ACL-based authorization

   ACL-based authorization is used to manage permissions for users or clients in Kafka.

2. Step 2: Identify its main role

   Its main role is to control access to Kafka topics and operations, ensuring security.

3. Final Answer:

   To control who can access Kafka topics and perform operations -> Option A

4. Quick Check:

   ACL controls access = B [OK]

Hint: ACL means controlling access rights in Kafka [OK]

Common Mistakes:

• Confusing ACL with performance tuning
• Thinking ACL compresses data
• Assuming ACL monitors cluster health

2. Which of the following is the correct command to add an ACL for a user named alice to read from topic orders?

easy

A. kafka-acls --add --allow-principal User:alice --operation Read --topic orders

B. kafka-acls --remove --allow-principal User:alice --operation Read --topic orders

C. kafka-acls --add --deny-principal User:alice --operation Write --topic orders

D. kafka-acls --add --allow-principal User:bob --operation Read --topic orders

Solution

1. Step 1: Identify the command to add ACL

   The command to add an ACL uses --add and specifies the principal and operation.

2. Step 2: Match user, operation, and topic

   We want to add read permission for user alice on topic orders, so the command must include these exactly.

3. Final Answer:

   kafka-acls --add --allow-principal User:alice --operation Read --topic orders -> Option A

4. Quick Check:

   Add ACL for alice to read orders = D [OK]

Hint: Add ACL uses --add and --allow-principal [OK]

Common Mistakes:

• Using --remove instead of --add
• Using deny instead of allow
• Specifying wrong user or operation

3. Given the following ACLs:

kafka-acls --add --allow-principal User:bob --operation Write --topic payments
kafka-acls --add --allow-principal User:bob --operation Read --topic payments

What will happen if user bob tries to consume messages from topic payments?

medium

A. Bob can only produce messages but not consume

B. Bob will get a permission denied error when consuming messages

C. Bob can neither produce nor consume messages

D. Bob will be able to consume messages from the payments topic

Solution

1. Step 1: Analyze the ACLs for user bob

   Bob has both Write and Read permissions on the payments topic.

2. Step 2: Understand consuming messages requires Read permission

   Since Bob has Read permission, he can consume messages from the payments topic.

3. Final Answer:

   Bob will be able to consume messages from the payments topic -> Option D

4. Quick Check:

   Read permission allows consume = C [OK]

Hint: Read permission lets user consume messages [OK]

Common Mistakes:

• Assuming Write permission alone allows consuming
• Confusing produce and consume permissions
• Ignoring the Read permission present

4. You run the command:

kafka-acls --add --allow-principal User:carol --operation Read --topic sales

But Carol still cannot read from the sales topic. What is the most likely cause?

medium

A. The ACL was added but the Kafka broker was not restarted

B. Carol needs Write permission to read messages

C. Carol's client is not authenticating as User:carol

D. The ACL was added for the wrong user

Solution

1. Step 1: Check if ACL command syntax is correct

   The command correctly adds Read permission for User:carol on topic sales.

2. Step 2: Consider authentication and identity

   If Carol cannot read despite ACL, likely her client is not authenticating as User:carol, so ACL does not apply.

3. Final Answer:

   Carol's client is not authenticating as User:carol -> Option C

4. Quick Check:

   ACL needs matching user identity = A [OK]

Hint: ACLs depend on correct user authentication [OK]

Common Mistakes:

• Thinking Write permission is needed to read
• Assuming Kafka broker restart is required for ACL changes
• Confusing user names in ACL commands

5. You want to allow a group of users to produce messages to topic logs but deny them from deleting the topic. Which ACL commands correctly achieve this?

hard

A. Add allow ACL for Produce operation only; deny is not needed because deny is default

B. Add allow ACL for Produce operation and add deny ACL for Delete operation for the user group

C. Add allow ACL for Produce and Delete operations for the user group

D. Add deny ACL for Produce and allow ACL for Delete operations for the user group

Solution

1. Step 1: Understand permission requirements

   The users should be allowed to produce messages but denied from deleting the topic.

2. Step 2: Use allow and deny ACLs appropriately

   We add an allow ACL for Produce operation and explicitly add a deny ACL for Delete operation to prevent deletion.

3. Final Answer:

   Add allow ACL for Produce operation and add deny ACL for Delete operation for the user group -> Option B

4. Quick Check:

   Allow produce + deny delete = A [OK]

Hint: Use allow for produce and deny for delete explicitly [OK]

Common Mistakes:

• Assuming deny is default without adding deny ACL
• Allowing delete by mistake
• Mixing up allow and deny commands