Group connection restiction #1008

ddellarocca · 2022-01-31T14:05:37Z

ddellarocca
Jan 31, 2022

Hi,
I'm testing out the feature to use groups in order to grant access to akhq for the users, but i'm facing some issues.
What i want to archive is segregate a group to a single cluster, for example i have two clusters development and production and i want a group of user to be admin of development and another one to be admin of production, the configuration is the following:

micronaut:
  server:
    host: 0.0.0.0
    port: 8080
  security:
    enabled: true
    ldap:
      default:
        enabled: true
        context:
          server: 'ldaps://ldap.server:636'
          managerDn: 'uid=readOnlyAdmin,dc=ldap,dc=server'
          managerPassword: 'password'
        search:
          base: "dc=ldap,dc=server"
        groups:
          enabled: true
          base: "ou=groups,dc=ldap,dc=server"

akhq:
  connections:
    development:
      properties:
        bootstrap.servers: node-1.development:9093,node-2.development:9093,node-3.development:9093
        security.protocol: SASL_SSL
        sasl.mechanism: PLAIN
        sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="password";
    production:
      properties:
        bootstrap.servers: node-1.production:9093,node-2.production:9093,node-3.production:9093
        security.protocol: SASL_SSL
        sasl.mechanism: PLAIN
        sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="password";

  security:
    default-group: no-roles
    groups:
      development-admin:
        name: akhq-development-admin
        roles:
          - topic/read
          - topic/insert
          - topic/delete
          - topic/config/update
          - node/read
          - node/config/update
          - topic/data/read
          - topic/data/insert
          - topic/data/delete
          - group/read
          - group/delete
          - group/offsets/update
          - registry/read
          - registry/insert
          - registry/update
          - registry/delete
          - registry/version/delete
          - acls/read
        attributes:
          connects-filter-regexp:
            - "^development.*$"
      production-admin:
        name: akhq-production-admin
        roles:
          - topic/read
          - topic/insert
          - topic/delete
          - topic/config/update
          - node/read
          - node/config/update
          - topic/data/read
          - topic/data/insert
          - topic/data/delete
          - group/read
          - group/delete
          - group/offsets/update
          - registry/read
          - registry/insert
          - registry/update
          - registry/delete
          - registry/version/delete
          - acls/read
        attributes:
          connects-filter-regexp:
            - "^production.*$"

    ldap:
      default-group: no-roles
      groups:
        - name: akhq-development-admin
          groups:
            - akhq-development-admin
        - name: akhq-production-admin
          groups:
            - akhq-production-admin