{"action":"created","comment":{"url":"https://api.github.com/repos/apache/kafka/pulls/comments/39446002","id":39446002,"diff_hunk":"@@ -0,0 +1,286 @@\n+/**\n+ * Licensed to the Apache Software Foundation (ASF) under one or more\n+ * contributor license agreements.  See the NOTICE file distributed with\n+ * this work for additional information regarding copyright ownership.\n+ * The ASF licenses this file to You under the Apache License, Version 2.0\n+ * (the \"License\"); you may not use this file except in compliance with\n+ * the License.  You may obtain a copy of the License at\n+ *\n+ * http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+package kafka.security.auth\n+\n+import java.util\n+import java.util.concurrent.locks.ReentrantReadWriteLock\n+import kafka.common.{NotificationHandler, ZkNodeChangeNotificationListener}\n+import org.apache.zookeeper.Watcher.Event.KeeperState\n+\n+\n+import kafka.network.RequestChannel.Session\n+import kafka.server.KafkaConfig\n+import kafka.utils.CoreUtils.{inReadLock, inWriteLock}\n+import kafka.utils._\n+import org.I0Itec.zkclient.{IZkStateListener, IZkDataListener, ZkClient}\n+import org.apache.kafka.common.security.auth.KafkaPrincipal\n+import scala.collection.JavaConverters._\n+\n+object SimpleAclAuthorizer {\n+  //the zookeeper cluster where acls will be stored, defaults to value specified for \"zkConnect\"\n+  val ZkUrlProp = \"zookeeper.url\"\n+  //List of users that will be treated as super users and will have access to all the resources for all actions from all hosts, defaults to no super users.\n+  val SuperUsersProp = \"super.users\"\n+  //If set to true when no acls are found for a resource , authorizer allows access to everyone. Defaults to false.\n+  val AllowEveryoneIfNoAclIsFoundProp = \"allow.everyone.if.no.acl.found\"\n+\n+  /**\n+   * The root acl storage node. Under this node there will be one child node per resource type (Topic, Cluster, ConsumerGroup).\n+   * under each resourceType there will be a unique child for each resource instance and the data for that child will contain\n+   * list of its acls as a json object. Following gives an example:\n+   *\n+   * <pre>\n+   * /kafka-acl/Topic/topic-1 => {\"version\": 1, \"acls\": [ { \"host\":\"host1\", \"permissionType\": \"Allow\",\"operation\": \"Read\",\"principal\": \"User:alice\"}]}\n+   * /kafka-acl/Cluster/kafka-cluster => {\"version\": 1, \"acls\": [ { \"host\":\"host1\", \"permissionType\": \"Allow\",\"operation\": \"Read\",\"principal\": \"User:alice\"}]}\n+   * /kafka-acl/ConsumerGroup/group-1 => {\"version\": 1, \"acls\": [ { \"host\":\"host1\", \"permissionType\": \"Allow\",\"operation\": \"Read\",\"principal\": \"User:alice\"}]}\n+   * </pre>\n+   */\n+  val AclZkPath = \"/kafka-acl\"\n+\n+  //notification node which gets updated with the resource name when acl on a resource is changed.\n+  val AclChangedZkPath = \"/kafka-acl-changed\"\n+\n+  val AclChangedPrefix = \"aclChanged\"\n+}\n+\n+class SimpleAclAuthorizer extends Authorizer with Logging {\n+  private var superUsers = Set.empty[KafkaPrincipal]\n+  private var shouldAllowEveryoneIfNoAclIsFound: Boolean = _\n+  private var zkClient: ZkClient = _\n+  private var aclChangeListener: ZkNodeChangeNotificationListener = _\n+\n+  private val aclCache: scala.collection.mutable.HashMap[Resource, Set[Acl]] = new scala.collection.mutable.HashMap[Resource, Set[Acl]]\n+  private val lock = new ReentrantReadWriteLock()\n+\n+  /**\n+   * Guaranteed to be called before any authorize call is made.\n+   */\n+  override def configure(configs: util.Map[String, _]): Unit = {\n+    val config = configs.asScala\n+    val props = new java.util.Properties()\n+    config foreach { case (key, value) => props.put(key, value.toString) }\n+    val kafkaConfig = KafkaConfig.fromProps(props)\n+\n+    superUsers = configs.get(SimpleAclAuthorizer.SuperUsersProp) match {\n+      case null => Set.empty[KafkaPrincipal]\n+      case (str: String) => if (!str.isEmpty) str.split(\",\").map(s => KafkaPrincipal.fromString(s.trim)).toSet else Set.empty\n+      case _ => Set.empty\n+    }\n+\n+    shouldAllowEveryoneIfNoAclIsFound = if (config.contains(SimpleAclAuthorizer.AllowEveryoneIfNoAclIsFoundProp))\n+      configs.get(SimpleAclAuthorizer.AllowEveryoneIfNoAclIsFoundProp).toString.toBoolean\n+    else false\n+\n+    val zkUrl = config.getOrElse(SimpleAclAuthorizer.ZkUrlProp, kafkaConfig.zkConnect).toString\n+\n+    zkClient = ZkUtils.createZkClient(zkUrl, Integer2int(kafkaConfig.zkConnectionTimeoutMs), Integer2int(kafkaConfig.zkConnectionTimeoutMs))\n+    ZkUtils.makeSurePersistentPathExists(zkClient, SimpleAclAuthorizer.AclZkPath)\n+\n+    aclChangeListener = new ZkNodeChangeNotificationListener(zkClient, SimpleAclAuthorizer.AclChangedZkPath, SimpleAclAuthorizer.AclChangedPrefix, AclChangedNotificaitonHandler)\n+    aclChangeListener.startup()\n+\n+    zkClient.subscribeStateChanges(ZkStateChangeListener)\n+\n+    loadCache\n+  }\n+\n+  override def authorize(session: Session, operation: Operation, resource: Resource): Boolean = {\n+    val principal: KafkaPrincipal = new KafkaPrincipal(KafkaPrincipal.USER_TYPE, session.principal.getName)\n+    val host = session.host\n+\n+    trace(s\"Authorizer invoked to authorize principal = $principal from host = $host on resource = $resource for operation = $resource\")","path":"core/src/main/scala/kafka/security/auth/SimpleAclAuthorizer.scala","position":110,"original_position":105,"commit_id":"8ba7d4ead62506f7e460c2be70e215b0b808dfe5","original_commit_id":"2c92d3e348c2aa047973cae501f7e9d79709341b","user":{"login":"Parth-Brahmbhatt","id":6914358,"avatar_url":"https://avatars.githubusercontent.com/u/6914358?v=3","gravatar_id":"","url":"https://api.github.com/users/Parth-Brahmbhatt","html_url":"https://github.com/Parth-Brahmbhatt","followers_url":"https://api.github.com/users/Parth-Brahmbhatt/followers","following_url":"https://api.github.com/users/Parth-Brahmbhatt/following{/other_user}","gists_url":"https://api.github.com/users/Parth-Brahmbhatt/gists{/gist_id}","starred_url":"https://api.github.com/users/Parth-Brahmbhatt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Parth-Brahmbhatt/subscriptions","organizations_url":"https://api.github.com/users/Parth-Brahmbhatt/orgs","repos_url":"https://api.github.com/users/Parth-Brahmbhatt/repos","events_url":"https://api.github.com/users/Parth-Brahmbhatt/events{/privacy}","received_events_url":"https://api.github.com/users/Parth-Brahmbhatt/received_events","type":"User","site_admin":false},"body":"Any time we allow or deny we already log the decision and the reasoning behind it, the trace is actually just to mark the entry point. \r\n\r\nModified log4j but I have set the default level at warn which will disable audit logging by default. Let me know if you want it to be enabled by default.","created_at":"2015-09-14T20:56:55Z","updated_at":"2015-09-14T20:56:55Z","html_url":"https://github.com/apache/kafka/pull/195#discussion_r39446002","pull_request_url":"https://api.github.com/repos/apache/kafka/pulls/195","_links":{"self":{"href":"https://api.github.com/repos/apache/kafka/pulls/comments/39446002"},"html":{"href":"https://github.com/apache/kafka/pull/195#discussion_r39446002"},"pull_request":{"href":"https://api.github.com/repos/apache/kafka/pulls/195"}}},"pull_request":{"url":"https://api.github.com/repos/apache/kafka/pulls/195","id":44267004,"html_url":"https://github.com/apache/kafka/pull/195","diff_url":"https://github.com/apache/kafka/pull/195.diff","patch_url":"https://github.com/apache/kafka/pull/195.patch","issue_url":"https://api.github.com/repos/apache/kafka/issues/195","number":195,"state":"open","locked":false,"title":"KAFKA-2211: Adding simpleAclAuthorizer implementation and test cases.","user":{"login":"Parth-Brahmbhatt","id":6914358,"avatar_url":"https://avatars.githubusercontent.com/u/6914358?v=3","gravatar_id":"","url":"https://api.github.com/users/Parth-Brahmbhatt","html_url":"https://github.com/Parth-Brahmbhatt","followers_url":"https://api.github.com/users/Parth-Brahmbhatt/followers","following_url":"https://api.github.com/users/Parth-Brahmbhatt/following{/other_user}","gists_url":"https://api.github.com/users/Parth-Brahmbhatt/gists{/gist_id}","starred_url":"https://api.github.com/users/Parth-Brahmbhatt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Parth-Brahmbhatt/subscriptions","organizations_url":"https://api.github.com/users/Parth-Brahmbhatt/orgs","repos_url":"https://api.github.com/users/Parth-Brahmbhatt/repos","events_url":"https://api.github.com/users/Parth-Brahmbhatt/events{/privacy}","received_events_url":"https://api.github.com/users/Parth-Brahmbhatt/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-09-04T22:23:12Z","updated_at":"2015-09-14T20:56:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5508334ea4e5702a91ddd3c14ef55431cb87abe7","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/apache/kafka/pulls/195/commits","review_comments_url":"https://api.github.com/repos/apache/kafka/pulls/195/comments","review_comment_url":"https://api.github.com/repos/apache/kafka/pulls/comments{/number}","comments_url":"https://api.github.com/repos/apache/kafka/issues/195/comments","statuses_url":"https://api.github.com/repos/apache/kafka/statuses/8ba7d4ead62506f7e460c2be70e215b0b808dfe5","head":{"label":"Parth-Brahmbhatt:KAFKA-2211","ref":"KAFKA-2211","sha":"8ba7d4ead62506f7e460c2be70e215b0b808dfe5","user":{"login":"Parth-Brahmbhatt","id":6914358,"avatar_url":"https://avatars.githubusercontent.com/u/6914358?v=3","gravatar_id":"","url":"https://api.github.com/users/Parth-Brahmbhatt","html_url":"https://github.com/Parth-Brahmbhatt","followers_url":"https://api.github.com/users/Parth-Brahmbhatt/followers","following_url":"https://api.github.com/users/Parth-Brahmbhatt/following{/other_user}","gists_url":"https://api.github.com/users/Parth-Brahmbhatt/gists{/gist_id}","starred_url":"https://api.github.com/users/Parth-Brahmbhatt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Parth-Brahmbhatt/subscriptions","organizations_url":"https://api.github.com/users/Parth-Brahmbhatt/orgs","repos_url":"https://api.github.com/users/Parth-Brahmbhatt/repos","events_url":"https://api.github.com/users/Parth-Brahmbhatt/events{/privacy}","received_events_url":"https://api.github.com/users/Parth-Brahmbhatt/received_events","type":"User","site_admin":false},"repo":{"id":34346413,"name":"kafka","full_name":"Parth-Brahmbhatt/kafka","owner":{"login":"Parth-Brahmbhatt","id":6914358,"avatar_url":"https://avatars.githubusercontent.com/u/6914358?v=3","gravatar_id":"","url":"https://api.github.com/users/Parth-Brahmbhatt","html_url":"https://github.com/Parth-Brahmbhatt","followers_url":"https://api.github.com/users/Parth-Brahmbhatt/followers","following_url":"https://api.github.com/users/Parth-Brahmbhatt/following{/other_user}","gists_url":"https://api.github.com/users/Parth-Brahmbhatt/gists{/gist_id}","starred_url":"https://api.github.com/users/Parth-Brahmbhatt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Parth-Brahmbhatt/subscriptions","organizations_url":"https://api.github.com/users/Parth-Brahmbhatt/orgs","repos_url":"https://api.github.com/users/Parth-Brahmbhatt/repos","events_url":"https://api.github.com/users/Parth-Brahmbhatt/events{/privacy}","received_events_url":"https://api.github.com/users/Parth-Brahmbhatt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Parth-Brahmbhatt/kafka","description":"Mirror of Apache Kafka","fork":true,"url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka","forks_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/forks","keys_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/teams","hooks_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/hooks","issue_events_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/issues/events{/number}","events_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/events","assignees_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/assignees{/user}","branches_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/branches{/branch}","tags_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/tags","blobs_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/git/refs{/sha}","trees_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/statuses/{sha}","languages_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/languages","stargazers_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/stargazers","contributors_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/contributors","subscribers_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/subscribers","subscription_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/subscription","commits_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/commits{/sha}","git_commits_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/git/commits{/sha}","comments_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/comments{/number}","issue_comment_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/issues/comments{/number}","contents_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/contents/{+path}","compare_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/merges","archive_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/downloads","issues_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/issues{/number}","pulls_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/pulls{/number}","milestones_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/milestones{/number}","notifications_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/labels{/name}","releases_url":"https://api.github.com/repos/Parth-Brahmbhatt/kafka/releases{/id}","created_at":"2015-04-21T19:00:48Z","updated_at":"2015-09-10T10:18:32Z","pushed_at":"2015-09-14T20:56:18Z","git_url":"git://github.com/Parth-Brahmbhatt/kafka.git","ssh_url":"git@github.com:Parth-Brahmbhatt/kafka.git","clone_url":"https://github.com/Parth-Brahmbhatt/kafka.git","svn_url":"https://github.com/Parth-Brahmbhatt/kafka","homepage":null,"size":22505,"stargazers_count":1,"watchers_count":1,"language":"Scala","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":1,"default_branch":"0.8.2"}},"base":{"label":"apache:trunk","ref":"trunk","sha":"d88b5bdfde0b6d020e687f6d59ad88d577910ae9","user":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"repo":{"id":2211243,"name":"kafka","full_name":"apache/kafka","owner":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/apache/kafka","description":"Mirror of Apache Kafka","fork":false,"url":"https://api.github.com/repos/apache/kafka","forks_url":"https://api.github.com/repos/apache/kafka/forks","keys_url":"https://api.github.com/repos/apache/kafka/keys{/key_id}","collaborators_url":"https://api.github.com/repos/apache/kafka/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/apache/kafka/teams","hooks_url":"https://api.github.com/repos/apache/kafka/hooks","issue_events_url":"https://api.github.com/repos/apache/kafka/issues/events{/number}","events_url":"https://api.github.com/repos/apache/kafka/events","assignees_url":"https://api.github.com/repos/apache/kafka/assignees{/user}","branches_url":"https://api.github.com/repos/apache/kafka/branches{/branch}","tags_url":"https://api.github.com/repos/apache/kafka/tags","blobs_url":"https://api.github.com/repos/apache/kafka/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/apache/kafka/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/apache/kafka/git/refs{/sha}","trees_url":"https://api.github.com/repos/apache/kafka/git/trees{/sha}","statuses_url":"https://api.github.com/repos/apache/kafka/statuses/{sha}","languages_url":"https://api.github.com/repos/apache/kafka/languages","stargazers_url":"https://api.github.com/repos/apache/kafka/stargazers","contributors_url":"https://api.github.com/repos/apache/kafka/contributors","subscribers_url":"https://api.github.com/repos/apache/kafka/subscribers","subscription_url":"https://api.github.com/repos/apache/kafka/subscription","commits_url":"https://api.github.com/repos/apache/kafka/commits{/sha}","git_commits_url":"https://api.github.com/repos/apache/kafka/git/commits{/sha}","comments_url":"https://api.github.com/repos/apache/kafka/comments{/number}","issue_comment_url":"https://api.github.com/repos/apache/kafka/issues/comments{/number}","contents_url":"https://api.github.com/repos/apache/kafka/contents/{+path}","compare_url":"https://api.github.com/repos/apache/kafka/compare/{base}...{head}","merges_url":"https://api.github.com/repos/apache/kafka/merges","archive_url":"https://api.github.com/repos/apache/kafka/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/apache/kafka/downloads","issues_url":"https://api.github.com/repos/apache/kafka/issues{/number}","pulls_url":"https://api.github.com/repos/apache/kafka/pulls{/number}","milestones_url":"https://api.github.com/repos/apache/kafka/milestones{/number}","notifications_url":"https://api.github.com/repos/apache/kafka/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/apache/kafka/labels{/name}","releases_url":"https://api.github.com/repos/apache/kafka/releases{/id}","created_at":"2011-08-15T18:06:16Z","updated_at":"2015-09-14T16:41:27Z","pushed_at":"2015-09-14T20:56:19Z","git_url":"git://github.com/apache/kafka.git","ssh_url":"git@github.com:apache/kafka.git","clone_url":"https://github.com/apache/kafka.git","svn_url":"https://github.com/apache/kafka","homepage":null,"size":33590,"stargazers_count":1907,"watchers_count":1907,"language":"Scala","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1152,"mirror_url":"git://git.apache.org/kafka.git","open_issues_count":84,"forks":1152,"open_issues":84,"watchers":1907,"default_branch":"trunk"}},"_links":{"self":{"href":"https://api.github.com/repos/apache/kafka/pulls/195"},"html":{"href":"https://github.com/apache/kafka/pull/195"},"issue":{"href":"https://api.github.com/repos/apache/kafka/issues/195"},"comments":{"href":"https://api.github.com/repos/apache/kafka/issues/195/comments"},"review_comments":{"href":"https://api.github.com/repos/apache/kafka/pulls/195/comments"},"review_comment":{"href":"https://api.github.com/repos/apache/kafka/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/apache/kafka/pulls/195/commits"},"statuses":{"href":"https://api.github.com/repos/apache/kafka/statuses/8ba7d4ead62506f7e460c2be70e215b0b808dfe5"}}}}